The Complete Guide to the Elcotel Grapevine Smart-Phone Date: 06/10/01 Written by: The Clone - Introduction - - Physical Overview - - Remote Overview - - Network Elcotel SNMP Scan - - GrapeVine COCOT List - - Grapevine References - - Conclusion - - Credit - - Contact Information - [] Introduction -- Over the past 100 years, the public telecommunications industry, more commonly known as "payphones", has evolved into one of the most easy-to-use and widely accepted communications networks. The core device in public communications - the payphone - literally has made "on the go" communications possible for millions of people daily. In recent years, however, unprecedented technological, competitive and regulatory changes within the telecommunications industry create an equally unprecedented challenge for the public communications sector. A decade ago, the payphone was the only way most people on the go kept connected to home or office. Talking on the phone while walking down the street or through a busy airport was still a concept out of Star Trek. Today, however, wireless phones keep everyone -- from high school students to housewives to business travelers -- in touch while on the go. The Internet likewise has revolutionized how people communicate by replacing cards and letters with e-mail, how they shop using e-commerce and how they access news, information and services through personalized portals. As a result, telecommunications today is about personal connectivity on a 24/7 basis. Consumers increasingly demand access to "content" anytime, anywhere, not just the voice communications provided by wireline or wireless phones. Content equals information, ranging from voice calls to local news, mapped directions and investments updates to e-commerce transactions, e-mail and connectivity with the home, office and web-based information. Think of a time when all local events, local transportation contacts, local maps and weather, sports results, and stock performance information can be retrieved by any consumer simply by going to the closest public phone terminal. Envision downloading or uploading e-mail from a Palm Pilot or a high-capacity smart card at a public phone terminal through the phone's infrared dataport or reading and responding to messages on the phone's color screen. Imagine a point-of-sale phone terminal for e-commerce transactions, with an ATM-like capability for funds transfer and electronic banking. Speed dial buttons linking advertisers and consumers directly enable immediate purchase of anything from airline or concert tickets to flowers delivered to your mother for her birthday. Think of a medium where all advertising can be delivered to the consumer on a terminal-by-terminal, time-of-day and interactive basis in any indoor environment. Advertisements can be changed selectively, one by one, on any terminal at any time. Product launches, specials, sales promotions, targeted messages, and local services can be location specific. This flexibility has no comparison in the advertising world. Imagine having airline and train schedules, convention agendas, weekly specials and sales promotions, public service information, local transportation numbers, event schedules, and local directions to nearby sites - all available from a public phone. Now imagine that this technology is already available... because it is. -- Physical Overview - (Image: http://www.nettwerked.net/grapevine.jpg) Speed-dial Buttons ------------------ There are eight black speed-dial buttons down the middle of the Grapevine. The top button is labelled "Collect Call", the second one says "Send Flowers". The remaining three are "Repair", "Data Jack", and "Language". As well, you will likely notice an Infrared Data Access (IrDA) - used for transfering data such as electronic mail to your PDA (Palm, Visor). Collect Call - This connects you to the local AT&T operator Send Flowers - This allows you to send flowers to your loved ones with a credit card via 1-800-FLOWERS Repair - Press this button if the Grapevine you are operating is not working properly. You will be directly connected to a Canada Payphone Corp (the distributors who are 20% owned by AT&T), AT&T or private contract repairman. Data Jack - Press this button if you plan to insert a phone jack into the RJ-11 data jack to dial up the toll-free number to your ISP. The Grapevine does not allow long-distance or local exchange dialing for data transfers. Though you are connected at 33.6/kbps. Language - Press this button to switch the words on the screen from English to French. Softouch Buttons ---------------- There are five more black oval buttons along the button of the screen on the Grapevine known as 'Softouch Buttons'. The buttons are labelled the following: "Info", "E-com", "Mail", "Data", and "Help". Press 1 and you get a message saying: "This key is not yet operational". When implemented, it will provide some important information designed for travellers. The INFOS screens will offer maps, weather, financial news, and sports scores -- all at the simple touch of a button. If you press the "help" key you will get: "You have pressed the HELP key. Context-sensitive online help is available for the Grapevine Cashless ATM and E-Commerce functions. If you need additional information, press the HELP key." You have pressed the help key. If you need additional information, press the help key. Obviously this is a glitch in the Grapevine. Grapevine Display ----------------- On the Grapevine smart-phone, the first thing you will likely notice is the rotating ads for 'CBC', 'Best Western Hotels', 'Esso', and 'FTD' - all of which are either corporate sponsors or location hosts. The display on the Grapevine smart-phone is a simple 5 1/4" VGA screen. Physical Administration ----------------------- Physical administration on the Grapevine smart-phone is done much the same way as physical administration is done on the Eclipse and 9520C model Elcotel COCOTs - with total lack of respect for security. ;) -= PIN ADMIN =- The benefit of Physical Administration over Remote Administration is that you are not required to enter an ID of some sort before entering the PIN. The physical administration PIN scheme on the Grapevine phone is exactly the same as the PIN scheme for the Eclipse / 9520C models... 1. Press # (8 digit default pin). 2. After entering the physical admin PIN the display on the Grapevine will say 'thank you'. 3. Now enter series of 3 digit flags: the flags are from 000-999. For example: 999 - resets the phone, 998 - is a memory test. If you enter the correct 3 digit flag, you will have the ability to: - empty out the cash box - change screen messages - administrate rate tables - see how many calls were made with the phone in a given time period - see how many days the phone has not been in use - debit card information - several security parameters - etcetera Just so you know, every time you administrate (or attempt to bruteforce the physical admin PIN) the Grapevine will send the statistics to CPC (Canada Payphone Corp) for updating... (604)-717-6532. If CPC notices a strange pattern in the number of times the Grapevine was administrated, then they will start to pay attention to that particular phone, and will likely wait for you return. When you're caught, CPC will grab you buy your throat and cut off your hands... so you may never again wreck havoc on with their equipment again! Alarm PIN Information --------------------- Disabling the alarm on the Elcotel Grapevine is relatively simple. What you are required to enter is a three digit PIN, which if correctly entered, will turn off the local alarm in the phone. This means that the static connection from the phone to Canada Payphone's NCC computer in Burnaby British Columbia will be severed. However, if you enter an incorrect alarm PIN on the Grapevine, you'll get an error message on the display. Q: How do I disable the alarm? A: By picking up the receiver on the phone, pressing #, and entering the three digit PIN. Q: How do I know I'm doing it correctly? A: You'll know you're doing it correctly when you see ### on the display... the ### represent the PIN. If you entered the right PIN, the display message will say "OK". Q: How do I enable the alarm again? A: - Pick up the receiver (if it was hung up) and type #CPC. - Hang up the receiver and wait for approximately twenty seconds for the phone to reconfigure itself. (You'll know you can use the phone again when you hear the components in the Elcotel Grapevine) shifting. Note: Just like physical PIN administration, fucking with the alarm PIN will cause the Grapevine to send statistical information to CPC HQ. -- Remote Overview - Remote administration of the Grapevine payphone is simple: With a computer a modem, and the proper remote administration software, dial the local or long distance phone number of belonging to a particular Grapevine phone. If you successfully connected (2400 baud), you will be prompted for your ID - the ID ranges from 8000 and up. Knowing this, we can presumably say that all ID's are programmed to be four digits - or at least four digits by default. Next is the PIN; the remote administration PIN by default is 8 digits long using the same number: i.e. 11111111, 22222222, etc. Remote Administration Software to look for: * PollQuest (aka 'International Payphone Network Management System') * Coin Net * Expressnet * PNMPLUS Lite * Pronet An example of what you will see: Option info OPTION FILE ........=############ (####) Next Date Phone Call In =!%%/%%/%%! RATE FILE ..........=############ (####) Next Time Phone Call In =!%%:%%! EXCEPTION TABLE .....=############ (####) No. Days Bump Call In =## LOOKUP TABLE .......=############ (####) POLL INTERRUPT DISABLE ..<->#### DIAL STRINGS .......=############ (####) Enable History logging ..<->#### RATE OVERRIDE ......=############ (####) Enable CDR [UP+CLEAR] ...<->#### CCR TABLE ..........=############ (####) Cash Box records to save ..=## VOICE FILE .........=############ (####) Days for no activity ......=## IPIN TABLE .........=############ (####) Nickel equiv. for full CB =## SECURITY PARAMETERS =############ (####) DEBIT CARD TABLE ...=############ (####) DISPLAY option on ph.....<->#### -- Network Elcotel SNMP Scan - <-- Begin Scan --> Elcotel Scan - 206.96.181.128 - 206.96.181.159 - 206.96.181.128 : alpha2.elcotelga.com Cisco 2600 Description: Cisco Internetwork Operating System Software IOS (tm) C2600 Software (C2600-IS56I-M), Version 12.0(5)T1, RELEASE SOFTWARE (fc1) Copyright (c) 1986-1999 by cisco Systems, Inc. Compiled Tue 17-Aug-99 14:47 by cmon Contact: Bill Digby,770-833-4339,bdigby@elcotel.com Location: Alpha PBX room 206.96.181.129 : ALPHAWWW01 Windows NT Server Description: Hardware: x86 Family 6 Model 7 Stepping 3 AT/AT COMPATIBLE Software: Windows 2000 Version 5.0 (Build 2195 Uniprocessor) Accounts: alphadog bdigby Guest IUSR_ALPHAWWW01 IWAM_ALPHAWWW01 TsInternetUser VUSR_ALPHAWWW01 Services: Alerter CIO Array Management Service 4.01 CIO Event Notifier CIOArrayManager RPC Command CIOArrayManager RPC Event CIODell COM+ Event System Computer Browser Dell BaseBoard Agent DHCP Client Distributed File System Distributed Link Tracking Client DNS Client Event Log Event Log Monitor Agent FAST Remote Services Agent IIS Admin Service IPSEC Policy Agent Logical Disk Manager Messenger Net Logon Network Connections NobleNet Portmapper Plug and Play Print Spooler Protected Storage Remote Procedure Call (RPC) Remote Procedure Call (RPC) Locator Remote Registry Service Removable Storage Routing and Remote Access RunAs Service Security Accounts Manager Server SNMP Service System Event Notification Task Scheduler TCP/IP NetBIOS Helper Service Telephony Terminal Services Uninterruptible Power Supply WebTool Win32sl Windows Management Instrumentation Windows Management Instrumentation Driver Extensions Windows Time Workstation World Wide Web Publishing Service <-- End Scan --> *sn0rt* yeah their routers are vulnerable. -- GrapeVine COCOT List - Province: Ontario Location: Cambridge Holiday Inn - 200 holidayInn Dr. (519)-658-8992 (519)-658-9026 (519)-658-9374 (519)-658-9589 - Province: Ontario Location: Kitchener Holiday Inn - 30 Fairway (519)-893-3660 (519)-893-0237 (519)-893.4223 (519)-893.4470 - State: Florida Location: Tampa (941)-360-9049 (941)-355-3512 -- Grapevine References - (From a number of various sources) http://www.fcc.gov Applicant: ELCOTEL, INC. Equipment Description: PAYPHONE WITH 2 DIFFERENT INTERNAL MODEMS Trade Names: ELCOTEL Model Numbers: HAC GRAPEVINE Fee A: 8145836 Fee B: 1 Fee Date: 3/28/00 NSD Rcvd Date: 3/31/00 1273-CX-2000 REGISTRANT: ELCOTEL INC. MANUFACTURER: ELCOTEL INC TYPE OF FILING: ORIGINAL REGISTRATION REG. NO: E2DUSA-35024-CX-E - REG. CLASS: TERMINAL DEVICE TYPE OF EQUIPMENT: PRIVATELY OWNED COIN PHONES WITH INSTRUMENTED-IMPLEMENTED FEATURES. EQUIPMENT DESCRIPTION: PAYPHONE WITH 2400BPS AND 33600BPS INTERNAL MODEMS TRADE NAME: ELCOTEL MODEL: HAC VC GRAPEVINE The certificate for 1273-CX-2000 will be sent to the following address: PRODUCT SAFETY ENGINEERING - CHIP FOERSTNER 12955 BELLAMY BROS. BLVD. DADE CITY, FL 33525 http://www.elcotel.com/Press_Releases/Comdex/comdex.html Grapevine and the e-Prism "back office" management software integrate the Windows CE 2.12 and Windows NT platforms to create a complete end-to-end Microsoft solution. The Grapevine desktop uses the same components as the wallmount terminal, already in production and being installed throughout North America. Services to each Grapevine terminal, whether desktop or wallmount, are delivered and managed on a location-by-location and time-of-day basis from Elcotel's Data Center in Alpharetta, Georgia. http://www.elcotel.com/Press_Releases/ESC/esc.html The Grapevine terminal represents a non-PC-based internet appliance designed specifically for the public communications market. Elcotel has utilized the Microsoft NT operating system for its e-Prism server and Microsoft CE as its thin client operating system on the Grapevine terminal. http://www.bizjournals.com/phoenix/stories/2000/09/11/focus3.html Following its research, Elcotel uses push content, where targeted information on specific topics is available in an easy-to-use format. The wall-mounted Grapevine upright terminal is in a familiar case of polycarbonate plastic. Features of the Grapevine terminal from: www.canadapayphone.com/grapevine_terminal.html Full color video screen Multi-card reader for credit cards and smart cards Free calls using the speed-dial buttons Interactive design allows customers to respond to advertised offers by telephone, or over the Internet Infrared Data Access (IrDA) port allows customers to download data and e-mail via a laptop or Palm Pilot Features of the Grapevine desktop from: www.canadapayphone.com/grapevine_desktop.html Full color video screen Multi-card reader for credit cards and smart cards Customers can check their e-mail and talk on the phone at the same time Free calls using the speed-dial buttons Interactive design allows customers to respond to advertised offers by telephone, or over the Internet Data jack allows customers to download data and e-mail onto their laptop computer http://www.elcotel.com/Grapevine/Terminals/terminals.html 5" 1/4 VGA screen that displays information and advertising. 5 soft keys located below the dynamic screen for accessing content on the screen. 8 speed-dial buttons that easily connect consumers with advertisers or service providers, such as taxi services, restaurant reservations, etc. A cashbox and coin slot calibrated to accept most North American coins. An insert-type card reader that accepts credit and smart cards, extending the selection of payment options for the user. Traditional dataport access for laptop connectivity. http://www.elcotel.com/Grapevine/Services/services.html Content Mangement Services will: handle media traffic administration, including scheduling and display specifications give comprehensive media management - downloads, updates, trial tests and termination provide interactive reporting on active impressions, speed-dial contacts and direct dials to sponsors offer customer support/help desk Network Server Operations will: focus on development, management and maintenance of the server network manage network and database backups design and install regional servers Payphone Management Services will: streamline the management of the entire terminal network provide interactive, operational reports via the Web on payphone functions (SMDR, cash collections, alarms) download terminal software and poll the Grapevine terminals -- Conclusion - The payphone of the 21st century isn't phone at all; it's a "high-tech information station" offering "controlled Web content to customers who are hungry for it." The people who make payphones, and the people who use expressions like "high-tech information stations" say there's a para- digm shift going on in this industry. People like myself look at the Grapevine smart-phone as a huge technological progression in the telecom- munications industry... just another toy to phreak. :) -- Credit - Without the following people helping with over a year and a half worth of research, this guide would likely not be released... so huge thanks to: Magma, Psychospy, and (of course) RT. -- Contact Information - e-mail: theclone@hackcanada.com irc: irc.h410g3n.com #cpu (key), #hackcanada web-site: www.nettwerked.net A P R E D E F C O N N I N E R E L E A S E