TAP YIPL/TAP_and_YIPL_Collection_CD.iso/PHREAK/PAYPHONE/MILL_I~3.TXT

Text File | 2000-03-08 | 8.8 KB | 181 lines

                     The Nortel Millenium Payphone
                     -----------------------------
                               by twiggy


Anyone in Canada (or at least Ontario) not living in a cave for
the last few years has a passing familiarity with the Nortel Millenium
Payphone. Nortel's promotional material tells us this is the phone of
the future, and it sort of looks like one. The bright blue scrolling
display is the most noticeable feature, and the phones have a yellow
card reader mounted on the lower right, which reads Bell's "Quickchange"
smart cards. The old blue card readers, which used to only read mag
stripe cards (Calling Cards and Credit Cards, the latter validated
directly with the Canadian ACCS database), have been widely replaced
with the yellow readers for Bell's promotion of their Quickchange
smart cards. The rest of the phone is a black shell with an aluminum
face for the display and keypad, and a gloss blue top panel. These phones
are markedly different in appearance than our old standby, the Centurion
phone, which are totally brown, less modular, and less modern.

What makes the Millenium truly different from the Centurion is the
fact that the "Millenium" product is a two-component system comprised
of the payphone units and NCC computers that monitor the phones.
Milleniums are well-known for their restraint in activating the
handset mic, fake dialtones, and enhanced control over your
interaction with the phone system. Milleniums come in two types --
the "Universal" (with a coin slot) and the "Card phone" (without
coin slot). These are the first Canadian payphones to operate
entirely without physical currency. Even newer are "desktop" Card
phones, often seen in hotels, which are the size of a regular set.

There are several myths about the Millenium phones, some of which
contradict themselves. I hope to clear up a few of those myths here.
Some rumours about these phones stem from a general lack of knowledge
about them, as Bell and Nortel certainly do consider these phones to
be an extremely valuable tool against "phone fraud" and "abuse" and
don't throw a lot of information about the Millenium around. In any
case, let's try to clear up a few myths about these phones.


Myth #1: Millenium phones physically cannot ring and/or lack bells.
-------

Millenium phones do in fact have an internal bell and can be made to
ring. Most people have never heard one of these phones actually ring,
however, and have concluded they lack the function. Milleniums can,
for example, be made to ring by an operator. One night, a Bell operator
became so infuriated with an individual who had been repeatedly dialing
0 from a Millenium (and harrassing, to some extent, said operator) that
she called the phone back and it indeed rang. While there may be some
Millenium phones that have never rung, they all do have an internal
ringer, so it's always possible. Operators always know when you're
calling from a Millenium phone, as well. A special 0(+) MIL_CARD or
0(+) MIL_UNIV flag denotes your call and subjects you to restrictions;
for example, an operator won't allow you to dial 0 and use a Calling
Card number to call overseas when they see a "MIL" flag on your call.
Operators (to my knowledge) are the only people who can call back
a Millenium phone and actually make it ring.


Myth #2: You can change the display contents from the keypad.
-------

Bzzzt. Wrong. The top/front quarter has to be unlocked and lifted up
and back first. Inside you'll find a port that a small portable
keyboard can be plugged into, and at that point you can truly go
about the alteration of the screen contents. I am still researching
this to determine 1) who produces the terminal/keyboard units (most
likely Nortel), 2) what protocols are involved, and 3) what jacks
are required. Anyway the point is that you can't write custom
messages from the keypad to the scrolling display.


Myth #3: You cannot change the display contents from the keypad.
-------

Bzzzt. Wrong again. There are several pre-set, unchangable, but most
certainly different messages you can make appear on the Millenium's
screen from the keypad. You know at this point that you can't just
add whatever you want (sorry, "THiS P4YpH0n3 iS 0WnED bY _______") is
out of the question), but you *can* change a number of other things,
and alter the operation of the phone in general.

To do this we have to get into a little bit of Millenium programming,
involving what Bell calls Opcodes. Opcodes are short numerical strings
that are preset functions for the Millenium, and perform common types
of functions that Bell's service people aren't going to want to rip
the whole top off the phone to perform (or that must be done *before*
the phone is opened). First, however, you must correctly access the
phone and enter a PIN before you'll have the option to input Opcodes.

In 416/905, what worked for some time was to dial 2541965, but only
with the hook down. Another (but unconfirmed) number was 2727378.
After dialing, you would be asked for your PIN number. One of the
correct PIN numbers (I am assuming there is more than one) was 25563.
Inputting this PIN allowed you to enter Opcodes at will, and you were
asked to input one. At this point you could try one of the following,
or try to scan out something new:

 267    # Answer detect
 274    # Display brightness control (down?)
 277    # Display brightness control (up?)
 349    # Unknown - Someone know this one?
 636    # Memory Access
 688    # Unknown - Possibly the "Out of Service" message
 66666    # Motor sound, prompts to open phone - Probably coin removal
 996    # "Error has occurred"

There are many other Opcodes that perform other functions and
servicing tasks. With this, you do in fact have the ability to
change screen content - and the function of the entire phone in
general - directly from the Millenium keypad.

However, the first known "config" number cited above, 2541965, fails
to work now. I am unsure if the PIN will still work on another number,
it may well. What I do know is that the Opcodes will continue to work
on Millenium phones provided the phone has been accessed properly.
We are currently working to determine the new "configuration"
number, and to obtain more information on Opcodes and Opcode entry.


Myth #4: You cannot redbox/tone-dial/send anything from the handset.
-------

I won't actually try to prove that you can redbox from a Millenium,
as I haven't bothered to find out. What *is* possible, however, is
tone-dialing from the Millenium handset. Sure, when you pick up a
Millenium, you hear a completely fake and useless dialtone. The
Milleniums have a dialing pre-processor, and won't let you hear a
real dialtone until you have stuck in your card or your money. But
even at that people wondered if the Millenium ever really lets the
handset mic interact with a live dialtone. Surely enough, pausing
until after an operator message allows the tones to work -- the
handset mic DOES work prior to a completed call, which a lot of
people didn't believe. I've made calls from Nortel Millenium phones
(the ones beside Starbucks on Queen St. West, actually) without ever
touching the keypad, which in and of itself is not a big deal, but
it is something we weren't sure could be done with these phones.


Outro:
-----

I hope I've cleared up a few long-standing myths about these phones.
Obviously, further exploration of the Opcode functions is needed and
could prove to be powerful, or at least interesting to those that
walk by a payphone and actually wonder how it works. What is still
not known, and deserves some research:

1) Are there different "Configuration" numbers for each NPA?
2) Are the PIN's static, or do they change? Do they vary by NPA?
3) How many Opcodes are there? Are any extremely powerful?
4) Are "MIL" calls to Chile, Iran, India, or Pakistan allowed yet?
5) Has *anyone* else heard a Millenium ring?   ;)

The following numbers may be of interest, and may provide some
insight to those that know how to use them, but please remember
to be careful and not abuse anything. This a good prefix guide
as well, if you're trying to scan out any interesting Bell 800
numbers (in addition to 465 and 861). Relevant to the topic are:

 1-800-263-7412        # Bell Canada Millenium (Help Line)
 1-800-567-2448        # Bell Canada Millenium (Test Line)
 1-800-461-1747        # Bell Canada Millenium (Voice Test)
 1-800-461-1879        # Bell Canada Millenium (Data Test)
 1-800-772-2141        # Bell Canada Millenium (Setshop)
 1-800-668-4862        # Bell Canada Millenium (Coin)
 1-800-668-6851        # Bell Canada Millenium (Alarm)
 1-800-461-1760        # Bell Canada Millenium (Unknown)
 1-800-361-7874        # Bell Canada Millenium (Unknown)

Hope everyone that seeks, finds. Good luck. Play safe. Peace to 613,
705, 905, 416, shout-outs to 416/905/613 2600, EFnet #2600, and many
others. Special thanks go to mannikin and hexnix as some of their
research appears in this article.


1998