__________ __ ________________ / _____/ \ / \/ _ \__ ___/___ _____ _____ \_____ \\ \/\/ / /_\ \| |_/ __ \\__ \ / \ / \\ / | \ |\ ___/ / __ \| Y Y \ /_______ / \__/\ /\____|__ /____| \___ >____ /__|_| / \/ \/ \/ \/ \/ \/ [ 1998 - 2010 - Hacking, Phreaking & Anarchy in the UK ] January 12 2010 . *Shalmessly stolen from an alt.phreaking post* Author - betty Cracker ---------------------------------------------------------- [ Millenium phones - 0wned ] ---------------------------------------------------------- **NOTE: Some of these methods may not be possible or may differ slightly from one Millenium phone to another. There has been some new Millenium phones in the making and some I don't have access to in my area. There are 3 different types currently and some of these types differ a bit from other models in its type. There is the universal (card and coin) type, card type and desktop type. The card type only takes cards and the desktop type is a smaller one usually found in a hotel with a data jack on the side. Besides, this is only a source for reference ;) ** ---------------------- Millennium is an advanced public communications access system developed by Nortel. These are a definate step beyond your average payphone. The first thing that sets them apart from the old guys is thei appearance. You'll seen a display screen on them along with a card slot. The card slot accepts credit cards, calling cards, smart cards, cash cards, telecards, etc. Some of these things also take the dollar coin. They have a "next call" key so you don't have to re-enter your card info. There is a data jack to hook up your favorite computing device up to. These phones are "smart" per se. They call in when the change box needs to be emptied, when they need servicing, etc. They have a self diagnosic system running all the time. With all these features you can be sure some new opportunities will arise. BUT, be forwarned, they also added security features. The card slot takes the worry out of would be onlookers. Cards are check to a red flag list, there is a more sophisticated coin sensor and a watchdog program for suspicious card activity. You can red box these but only by going through the operator. That means your not actually red boxing them but instead the easily fooled human operator. The program used for managing these phones is called Millennium Manager. How about when the power goes out? Are these "great" inventions then shit? Well the dial tone you normally hear is pre-recorded. If the power goes out it goes into a failsafe mode that only allows you to dial number starting in a 1 and 8... yes, 1-800 numbers. No big deal since you could already dial these for free anyways. But what exactly is this failsafe mode? Well it only disables the keypad so either use a tone dialer or dial 1-8 and record the number you want to dial. After its recorded hang up and play the recording into the handset. Just make sure its done as fast as possible, the dial tone gets dropped with in 15 seconds. You can also perform the old school exploit of dialing up an 800 number and waiting untill it hangs up, returning you to a dial tone. To do either of these, remember, the power has to be off. This means either cut the power line (BE CAREFUL!) or flip the breaker mounted in the light on top of a booth or pedestal mounted phones. Lets talk about disabling the phone from collecting your money for good (or at least untill the Telco finds out.) When you deposit your money into the phone it is held in an area untill either you get an answer (the money is then collected) or you hang up without an answer, you get a busy signal, etc (you money is then returned). What signals the money to be collected though? Well when the telco detects the phone being answered it flashes a voltage reversal down the line making the "positive ring, negative tip" "negative tip, postivie ring" instead. It then switches back. Then you money is swallowed, keypad activated and time ticks away in the case of a long distance call. Well you CAN prevent the phone from swallowing your money... and all you have to do is install a full-wave rectifier in the line. If you open up the service door on the ceiling you will see the phone box and a 110 power supply (it may be hard wired or it may be a plug). There will be a terminal on the left and on the right of the phone box. On the left terminal (tip line) there will be 2 wires, 1 going to the phone and one going to the line. On the right terminal (ring line) there will be 2 wires, one going to the phone and one going to the line. Well remove the line wire from each terminal and connect them each individually to their own AC input on the rectifier. Then take the positive lead of the rectifier to the right terminal and the negative lead to the left terminal. Now check the phone... if you have a dial tone you in business.. if the LCD screen now says the phone needs service you fucked up. Next deposit your money and make a local call.. if the call is answered, you hang up and then get your money back you did well. Wanna be a super phone ninja? Hard wire the rectifier in, you can even use the phones 110 power to run your soldering iron. Close it all up and make it look nice... this phone may be offering free calls for many months to come. Dial into a Millenium phone* with your computer and after 14 rings the phone will automatically pick up with it's internal modem. You'll then be promted to enter a password. These are common defaults... all 0's, millenium, 12345, an abbreviation of one of the 4? making companies, sometimes the phone's number, etc. Once inside there is a menu driven interface that allows you to change everything from the cost of local calls the the LCD menu display. It is unknown if the callers number is logged or any other security measures taken to help prevent this. It does not appear so thus far. *NOTE: Many millenium phones do not allow you to directly call into them. If this is the case you must convince an operator to connect you (they can do this). If you can not dial into the phone then the only way to change its LCD screen is by having both keys that it takes to open the phone (rob a telco truck maybe) and a special keypad the plugs into the phone (probably also in the telco truck). Some of the display outputs are presets and some can be manually put it. Millenium phones can be slightly programmed/tweeked from their keypads. You can give them "OP CODES." Put the phone ON-HOOK, and dial "CRASERV" (2727378) and then input a 5 digit PIN (The default is 12345)(also I have read that maybe 25563 works?). Range of PINs PIN uses 00000-39999 'Enter op code' 40000-79999 'Open terminal' 80000-99999 'Invalid PIN, access denied' There may be some 'special' PIN #'s hidden amongst these. You go ahead and test all 100,000 possibilities. These are the op codes that may get some sort of response. Supposedly OP codes differ from region to region. These may be of no use to you. OP CODES are 3 digits long -------------------------- 267 # Answer detect 274 # Display brightness control (down) 277 # Display brightness control (up) 349 # Unknown 636 # Memory Access 688 # Unknown - Possibly the "Out of Service" message 66666 # Motor sound, prompts to open phone - Probably coin removal (this is actually a PIN) 996 # "Error has occurred" When you enter the OP code and press * it gets saved. After 8 of these the LCD display says "Maximum of 8 codes, last code not saved". Then you get the main display. If you re-enter the OP mode and try to enter a new OP code you'll get "Maximum of 8 Codes" and be booted back out. If you continue to try this it'll eventually let you enter new OP codes. Feeling malicious? Take a screwdriver and pop off the little metal panel underneath the phone. Then touch the leads that you see inside to the circuit board. Your trying to short anything and everything out. With in the next 10 seconds you should hear its alarm go off. Now you can either leave or rip the phone cord from the wall and leave the millenium baby in its shitty diapers. You can also rip off the yellow card readers and wire them to read cards with you computer. Just pry them out with your screwdriver. Honestly I think the phone companies took a step down in this creation... the more features the more there is to fuck with. Thanks MaBell, phreakers around the world 0wn you. #telephony irc.efnet.net _________________________________________________________________________ If you want more information about Millennium pay phones phone their hotlines where they put up with phreakers not being able to red box off of their phones. Here are the numbers: 1-800-263-7412 Bell Canada Millennium (Help Line) 1-800-567-2448 Bell Canada Millennium (Test Line) 1-800-461-1747 Bell Canada Millennium (Voice Test) 1-800-461-1879 Bell Canada Millennium (Data Test) 1-800-772-2141 Bell Canada Millennium (Setshop) 1-800-668-4862 Bell Canada Millennium (Coin) 1-800-668-6851 Bell Canada Millennium (Alarm) 1-800-461-1760 Bell Canada Millennium (Unknown) 1-800-361-7874 Bell Canada Millennium (Unknown) 1-800-466-7835 Millennium sales representative 1-214-684-5930 Millennium sales representative 1-416-748-2694 Bell Canada, Pay phone Department 1-800-777-7777 The coolest number in the world! Do you want a Millennium pay phone in your area? Mail them at: Millennium Sales and Marketing Northern Telecom 2221 Lakeside Blvd. Richardson, TX 75082-4399