'Exploiting Telus POTS / Payphone Lines in Calgary, AB.'

Here are some things that do strange things with other things, if that makes any
sense at all, on Telus systems in Calgary, AB (+1403):


Nortel Centurions are bright orange under those black and brown covers which are
fully removable!  This is an armour plate - you can access the coin vault from
it but need a key or a lockpick to access the circuits.


777-XXXX: 

777 is an area which appears to be assigned mostly to an offsite Meridian PBX
for the CBE; each room in the CBE schools has its own phone number that starts
with 777 as far as I can tell.

However, it is not all assigned to them. 777-9759 and 777-9758 both route to 911
operators. I obviously didn’t want to keep scanning there, they would have
figured it out pretty quick.


211: 

211 service exists from pots lines and cell phones, but not payphones 


Possible exploits: 

Here, I believe I may have discovered where Telus is hiding all its diagnostics.


A few things one should know: 

- A busy signal is usually Telus telling us that we aren't allowed to do what we
  are doing

- It can also mean you got the password wrong 

- There is no law against scanning in Alberta, or (I think) any other province.
  Stop confusing American state laws with Canadian ones.


Exploit A: Telus 101XXXX codes 

The codes assigned to Telus used in Calgary are as follows: 

0424: Payphones 
0324: Not payphones

If you dial 1010324# from a POTS line, you get a dialtone.  If you dial it from
a payphone, the carrier access code is wrong (like it is for every other valid
carrier).

Should you dial 1010424# instead, if you are on a POTS line you will get a busy
signal. If you are on a payphone, it will do one of a few things.  It might not
let you call it or just hang up when you do (Millenniums), or tell you that you
aren't authorised to call that number.  It will do the same thing if you dial
1010424-0# from a pots line.


Exploit B: 

Interestingly enough, if you dial 1010424-1-403-XXX-XXXX from a POTS line,
"your local call is proceeding...".  It won't.

Now, should you choose to dial 1010424-1-570-XXX-XXXX from the same phone,
it will be busy. However, if you dial 570XXXXXXX where XXXXXXX is not your
own phone number, the call cannot be completed as dialed.

511XXXXXXXXXX will also be busy.  However, it has done strange things in the
past, like given recordings and routed before 10 digits after the 511.


Exploit C: 

From a POTS line, dial #XXXXXX.  You don't have that feature, apparently -
what feature is this?  Probably tests and loops, et cetera.

----------

In +1403, from the prespective of calgary (mainly): 

On the topic of 511: Sometimes it routes after different numbers of digits
than 10 after the 511 

Near pine lake, ALTA, 511 lets one digit after and they cannot be completed as
dialed instead of being busy (511X) as it does on payphones

The carrier codes for telus are 0324 and 0424: 

1010324# from a POTS line gives you a dialtone 
1010424# from a POTS line is busy 
10104240# from a POTS line is "you are not authorised to dial that number" 
1010424-1-403-XXX-XXXX (pots): your local call is proceeding, there is no need
  to dial long distance 
1010424-1-570-XXX-XXXX (pots): busy...

1010324# from a payphone is the wrong code for the carrier message 
1010424# from a payphone is the same as 10104240# from a pots 
10104240# from a payphone routes to an operator 

211 service exists from pots lines and cell phones, but not payphones 

Milennium payphones differ in programming - some allow 1010424# (but it routes
to unauthorised); some say it is disallowed; some call it and just hang up
(could there be a dialtone there?)

## on some millenium payphones prompts for equipment to be connected and gives
a dialtone (but the keypad is off); on others it stops you at #.  On the former
ones, *8**8* is not allowed.

From a pots phone, *# is busy 


-- Falcon Kirtaran

10/18/04