лл 'The Comprehensive Guide to Paytel Canada payphones' Written by: The Clone On Friday July 14, 2000 Updated: Thursday October 5, 2000 лл __________ ./_CONTENTS_\. ` ` .; Disclaimer .; PayTel Canada offices .; Protel Model Phones .; Intellicall Model Phones .; Resources .; Conclusion .; Contact .; Shouts _,_ Disclaimer -- Within the pages of this document is information pertaining to the technological ins and outs of a huge chunk of the payphone market in Canada. I am by no way responsible for any damage someone or somebody causes by reading this document. If you want to break something and risk a fine or prison time, by all means leave me the hell out of it. In other words, if I in some way AM contributing to that slight increase in Canadian youth crime, I don't take responsibility for it. So please, use this information to learn and grow and not to piss off your phone company, the police department, or national defense. _-_ 'PayTel Canada offices' Several months ago, in my document titled 'The Complete Guide to the Elcotel Payphone' I listed off every Corporation that currently has an account with Elcotel; this included specific account information in alphabetical order. From what I assume, that information was deemed useful by my readers so for that I've taken a similar approach with this section. For now, here is a list of every PayTel office in Canada in order from west to north - just a good resource for Canadian phreakers who may be interested in this company. __ Paytel's national head office is located in Surrey, British Columbia, with the following branch offices in: Alberta (Calgary), Ontario (Toronto, Markham), Quebec (Mirabel), New Brunswick (Moncton) and Nova Scotia (Dartmouth). Western Canada (Head Office) 2428 King George Hwy Surrey, BC V4P 1H5 Tel: (604) 542-2010 Fax: (604) 542-2011 Toll-free: 1-877-542-2010 Ontario Region 6 Adelaide Street East Suite 500 Toronto, ON M5C 1H6 Tel: (416) 504-7400 Fax: (416) 504-7211 Customer Service: 1-800-265-2953 info@paytelcanada.com Quebec Region 17,000, rue Charles bureau 100 Mirabel, PQ J7J 1X9 Tel: (405) 433-0001 Fax: (405) 433-1303 Toll-free: 1-877-433-3553 Eastern Region 201 Brownlow Avenue Unit 57 Dartmouth, NS B3B 1W2 Tel: (902) 468-1716 Fax: (902) 468-1717 Toll-free: 1-877-575-7555 _-_ 'Protel Model Phones' Protel, Inc. of Lakeland, Florida is North Americas leading manufacturer of smart public payphones. In 1984 Protel introduced the first line-powered smart payphone in the USA. Protel were one of the first key-players in the development of the first Customer Owned Customer Operated Telephones (COCOT) in the early 1990's, and have strived to bring quality yet cost effective phones to millions of people around the globe. Protel develops several payphones, though only having slight differences between them, which are unique and interesting to mess around with for a couple of obvious reasons; interaction with the phones' diagnostic - statistical information is possible by using a series of secret codes, and physical/remote security is fairly weak. This is just the type of thing any telephone enthusiast loves to read. Note: I haven't personally found an abundant amount of these payphones within Edmonton in comparison to the Intellicall model phones, but keep in mind, the telecommunications industry is an ever-changing one so who knows what to expect in the next six months or so. Keep your eyes peeled and lemme know if you find any Protel Model payphones in your area. PayTel Canada's Protel Phone ---------------------------- This is one of the few widely distributed Protel phones in Canada: http://www.nettwerked.net/protel.jpg Payphones and Accessories ------------------------- http://www.protelinc.com/PROTELInt/payphone/Fpayph.htm Protel Locations ---------------- Restaurants - Truck Stops - Schools - Service Stations - Churches - Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts - Low-income Housing - Convenience Stores - Apartments - Bars - Lounges - Hotels - Motels Features -------- - When dialing a call on a Protel phone, the phone slowly dials each digit while it waits for you to finish dialing or finish paying. You'll be able to hear this in the background, but it is often quiet so open your damn ears! - Leaving a Protel receiver off the hook for too long will cause the phone to produce an interesting beeping sound. - Credit Card slots; some of these phones DO have credit card slots which accept many major credit cards (ie. Visa, Mastercard, e.t.c). - Internal Alarms; can be disabled by entering *# and the correct two to four digit pin code, most likely in default mode and easily bruteforceable. - Ringers; Protel model phones will most often ring when called. After five rings a modem carrier will pick up which is sometimes followed by an automated voice that reads off how much money is in the phone including the date/time. Special Features ---------------- - A particularly special feature about the Protel model payphones are the unique Protel-only *# options that allow any phreaker to learn about the phones' internal information simply by entering a few codes. Here are the *#6X codes I'm aware of at this present time: ` *#61 should give you ANI information ` *#62 will ID the software version the phone is utilizing ` *#65 sometimes discloses the phones company's HQ modem number - in Canada the modem carrier number would belong to PayTel Canada. ` *#68 disables the phone all together ! Tip: by hand-scanning other *# codes (ie. *#0X, *#1X, *#2X, e.t.c.) you may find more neat options like the ones noted above. Remote Administration Software ------------------------------ * Expressnet - ftp://208.49.251.4/Xv150.exe - (official Protel software) ftp://208.49.251.4/XnetV151.exe - "" * Panorama - http://filexfer.tripod.com * Pronet - http://www.protelinc.com/PROTELInt/pronet/fpronet.htm Security Issues --------------- 'Physical Administration' To my knowledge there are two ways to gain physical administrative powers on a Protel model payphone, the first way is somewhat easier. Here's what you do; ` Enter *# and then the correct four digit admin PIN code which are most likely defaults such as: *#1234, *#5555, *#9999, and so on. Once you enter the correct PIN code you will have total access to all menus, rate tables, and will have the ability to alter restrictions on what phone numbers can be dialed. ` The second way is quite a bit more difficult but is successful nonetheless. After entering the correct two to four digit *# alarm code, and opening the phone with the proper keys, you will notice a 'setup' button on the printed circuit board. Press the button and immediately you'll be prompted for the correct PIN code. ` Enter *#000000 (6 digits) - at this point you will have total access to all menus, rate tables, including the ability to alter restrictions on what phone numbers can be dialed. 'Remote Administration' Remote Administration of the Protel phone can be both enjoyable and profitable, if done correctly. In this section, I'll be explaining step by step on how to successfully take over a payphone or many payphones by using just a computer with a modem and the proper software. The first thing you'll need in order to successfully take over a Protel payphone remotely is the particular payphone's phone number. This can be accomplished by either writing down the phone number listed on the phone, or by entering *#61 with the receiver off the hook. Secondly, you're going to need the right payphone administration software. Remember; some software which might work for administering one payphone may not necessarily work for another. The reason for this is that some software just isn't compatible with the payphones' chip, making it impossible to even connect to the phone correctly. Another reason may be that the software you're using doesn't allow you to enter the necessary number of digits that would be required of you when prompted for the PIN code. In this case, you'll need software that allows you to enter a 6-8 digit payphone admin PIN. The PIN code; because of the fact that most payphone administration PIN codes (by default) are a series of numbers with only one number and 6-8 digits, and if we remember that the internal physical administration PIN for the Protel is *#000000, I would say that the default PIN for all Protel phones is likely an easy guess. *-- Canadian Distributors --------------------- C. G. Industries Limited 30 Shields Court Markham, Ont. L3R8V2 Phone: 905-475-5093 Fax: 905-475-5389 http://www.cgil.com International Connectors & Cable, Inc. (ICC) 16918 Edwards Rd. Cerritos, CA 90703-2400 Phone: 562-926-0734 Fax: 562-926-5290 Toll Free: 1-800-333-7776 http://www.icc-payphone.com Palco Telecom, Inc. 7825 Flint Road S.E. Calgary, Alberta T2H 1G3 (800) 661-1886 (403) 255-4481 Fax: (403) 259-0101 http://www.palcotel.com Pay Phone Technologies 80D Centurian Drive Unit 8 Markham, ON L3R 8C1 905-947-8216 Fax: 905-947-8209 Toll Free: 1-877-488-0041 http://www.foc-ppt.com -`- 'Intellicall Model Phones' `` Using advanced technology and the experience of over 12 years in the industry, Intellicall produces two payphone models that may both be customized with a variety of options to meet the demands of your locations. The UltraTel payphone is the economical workhorse of the industry for those installations that use AC power. The AstraTel payphone is the proven answer where line power is preferred. Both are highly robust systems that deliver the long term reliability required in any successful payphone network. '' Paytel Canada's Intellicall Phone --------------------------------- Paytel Canada distributes this model of payphone by Intellicall called the AstraTel 2: http://www.nettwerked.net/astraltel2.jpg Intellicall: 'AstraTel & Ultratel' Audio Samples --------------------------------------------------- http://www.payphone-directory.org/sounds/wav/web/intvoice.wav http://www.payphone-directory.org/sounds/wav/web/intavoice.wav http://www.payphone-directory.org/sounds/wav/web/a.wav http://www.payphone-directory.org/sounds/wav/web/intring.wav Payphones and Accessories ------------------------- http://www.universal-comm.net/intell.htm Intellicall Locations --------------------- Restaurants - Truck Stops - Schools - Service Stations - Churches - Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts - Low-income Housing - Convenience Stores - Apartments - Bars - Lounges - Hotels - Motels Features -------- [On UltraTel Models] - After Approximately five rings, a modem carrier will pick up - Some models of this phone have a scrambled keypad, that is, when you dial a number, the tones you hear don't match the numbers you push. After a call is completed, the scrambling ends. - This phone requires an AC power source to function properly. - During a call, it will take your money as soon as it thinks the call is answered. If it is left off the hook too long it will say: "Please hang up and try again." [On AstraTel Models] - After Approximately five rings, a modem carrier will pick up - It has a 14,400 baud modem, which is very fast for a pay phone. It runs only on phone line power. If you don't deposit enough for a call, you will be told to just deposit the difference. - if you leave this phone off hook too long it will generate a fake fast busy signal. Special Features ---------------- Toll Fraud Prevention -- The fraud prevention is this: if you call your friend on an Intellicall phone (UltraTel & AstraTel models) and your friend answers, the phone will automatically dial '111'. If you were to call this phone from either the payphone next to it or from a cellphone; have it ring once, pick it up and then hang up, and pick it up again you'd get an unrestricted dial tone which would allow you to use a tone dialer (since the keypad is temporarly disabled) to make free local calls. The auto-111 DTMF tones override the dialtone, thus preventing toll-fraud. Security Issues --------------- - Internal Alarm Bruteforcing - Internal Alarm Bruteforcing can be done by firstly entering pound then a four digit PIN. Because of previous problems involving the disclosure of alarm codes, I will not be posting it on this article. Too many people were abusing the #CPC code that was mentioned on the 'Complete Guide to the Elcotel Payphone', and because of that Canada Payphone changed the PIN and set up a trap (at least in Edmonton) which automatically caused the phone to dial out for help. If you wish to bruteforce the PIN then all the power to you. 'Phone Seizing Problems - will give free phone calls' Well whaddya know, the very same exploit I discovered on the Elcotel 9520C model payphones works on the Intellicall model payphones as well. When will these payphone developers and their distributors ever take their security seriously? The answer is; until the specific fraud being committed has reached such prevalent levels that the chance of a yearly revenue is slim to none. Using a twenty dollar Genexxa 33-Number Memory Pocket Tone Dialer from Radio Shack, one can easily take advantage of Paytel's incompetence in relation to call seizing. -- Typical Scenario -- CALL TO PAYTEL CANADA Operator: Paytel Canada, how may I help you? Phantom Phreak: Yes, may I have the number for directory assistance? Operator: Just a moment... Phantom Phreak: Thank-you. Operator: 1-877-542-2010 Phantom Phreak: No no no, thank-you! * Operator Hangs Up * * Phantom Phreak is dropped to an unrestricted line, and then proceeds to play his pre-programmed 7 digit DTMF tones into the receiver allowing him a free local call. * Useful Numbers: The keypad isn't disabled when using these local numbers, meaning you will not need to go through the trouble of using a tone-dialer: ** 0 ** 411 ** 611 ** 811 ** 911 (?) | see: 'SKANNING' at www.nettwerked.net for a listing of thousands of these: | * Blocked From Area - Will eventually drop you to an unrestricted line * Call Cannot Be Completed - Will eventually drop you to an unrestricted line * Disconnected - Will eventually drop you to an unrestricted line * Not In Service - Will eventually drop you to an unrestricted line * Unsuccessful VMB Login Attempts - will usually drop you to an unrestricted line after several unsuccessful login attempts (not recommended) Modem Carrier Numbers (AstraTel 2): 519-576-0354 - Kitchener, Ontario, Canada 780-483-9783 - Edmonton, Alberta, Canada 780-456-9983 - 127St/139Ave: Edmonton, Alberta, Canada 905-453-9794 - Halifax, Nova Scotia, Canada (corner of Robie and Young streets) 'Resources' Resources list - URL's of web-sites that helped me with the R&D for this document: -+ GHU - The Grasshopper Unit: http://internettrash.com/users/mtghu/ -+ Intellicall Inc: http://www.intellicall.com/ -+ Pay Phone Directory: http://www.payphone-directory.org -+ PayTel Canada: http://www.paytelcanada.com/ -+ Protel Inc: http://protelinc.com -+ Protel Inc (ftp): ftp://protelinc.com -+ Tatung Telecom: http://www.tatungtel.com/ 'Conclusion' I'd firstly like to thank some people who helped directly and indirectly with the creation of this document: Cyber Thief, Magma, Miklos, and RT. Secondly: Oh you big scary Telecom companies popping up everywhere trying to make a buck (or should I say 'quarter') off the slowly dying payphone industry in Canada, without ever paying attention to security. I'm not going to chant about how you guys should INCREASE your security. See that's just something honest 'white hat' folks do. The more you make it easier for the Canadian phreakers to exploit you physically and remotely, the better. Although I don't mind a challenge every now and again... or do I? All this STUFF just comes so easily to me... tee-hee. Def Con 8: YES! Hack Canada and several of their Canadian friends will be attending Def Con 8 this year for some good 'ol fashion fun! This will be Hack Canada's second year attending this crazy Las Vegas conference, and we plan on having a few surprises for all you people. Look for a lot more pictures and reviews this year - hell just look for us and share your beer, eh. PeAcE OuT... _ Contact me _ E-mail: theclone@nettwerked.net URL - http://www.nettwerked.net Shouts: Hack Canada A P R E - D E F C O N 2 0 0 0 R E L E A S E