Code: Select all
éffffffffffffffffffffffffffféâ÷
é é Ø
é TriTel XP1230 é Ø
é Handset Un-Mute & é Ø
é Other Payphones é Ø
é é Ø
é [ Version 1.0 ] é Ø
é é Ø
é ~pHreakaz0id~ é Ø
é é Ø
éúúúúúúúúúúúúúúúúúúúúúúúúúúúé Ø
ÂââââââââââââââââââââââââââââP
Contacting the elusive -=pHreakaz0id=-
>> Aust Phreaking Forum <<
>> phreakaz0id@hotmail.com <<
>> #ausphreak,#p4k on Linuxphreaks.org <<
>> http://www.angelfire.com/freak/az0id <<
"The future is not a single national voice network with
limited connection to the outside world. It will be a mass
of interconnecting networks, under many different ownerships,
of different geographical spreads, offering voice, image,
text and data services from which the customer can choose
quickly and easily."
- Tom McKinlay, DG XIII, Eurpoean Commission [DeBony]
-=-=-=-=-=-=-=-=-=
>> Contents <<
* Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
* TriTel Payphones - The Un-Mute
I. Un-Mute Method for the XP1230
II. The Theory
III. Dispelling the Myths
* TriTel Australia - The Specs
* Protel International & the TrendTek connection
* The Protel XP1230 Payphone - Specs
* Understanding the Payphone Line
I. Payphone Lines
II. Accessing the Line
III. Pricing
* Appendix 1 - PayTel Australia
* Appendix 2 - Siemens Payphones Australia
I. Cityphone Compact
II. Easyset Entry
III. Telstra Interset 751
IV. Diamond (L6 Bluephone)
V. Elasa (Telstra X1/X2)
* Appendix 3 - DORO Zircon Payphones
* Appendix 4 - Vector Technology Corporation (VTC)
* Appendix 5 - Metalwork, Heat Treatment, Tempering
I. Silver Solder Gaff
II. Lock Picks
* Resources & Links
-=-=-=-=-=-=-=-=-=
Somewhere in Australia
May 2002
Tucked away in wooden enclaves or against cement-rendered walls flanked
by bright green palmettes we find the TriTel sitting proudly upon its
metallic throne. Encased within its plastic aegis, the first TriTel I layed
eyes upon beseeched me to lift its Electro-dynamic handset and finger the
delicate yet manipulable keypad as I would a sweet-scented woman.
Enough with the shit, on with the show ...
Summation - "TriTel XP1230 Handset Un-mute & Other Payphones"
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
This article basically covers the method of UN-Muting a TriTel payphone
handset for clear Two-Way Communication with your accomplice, or whomever
has called the phone. It also contains vital information pertaining to these
new payphones seen frequently throughout all major cities in Australia. They
are particularly fond of Westfield Shopping Centres and have been known to
congregate within a variety of other Malls and the like on numerous
occasions. Recent sitings of TriTel herds have been reported in Universities
throughout Sydney and strays have been spotted roaming at the occasional
public venue.
Appendices at the end of the document contain details and various
information on other exotic and rare payphones throughout Australia.
TriTel Payphones - The Un-Mute
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
I. Un-Mute Method for the XP1230
(i) From the Caller's point-of-view: When an External party dials the
number for the payphone, they will hear two rings followed by a long beep.
After this beep the Caller stays connected to the payphone for a period of
approximately 2 minutes.
· Anyone attempting to use the payphone will find that they cannot dial
out since there is an incoming call occupying the line. The External party
at this point will hear only a hollow sound.
· If anyone lifts the handset at the payphone the External party (or
Caller) will hear various clicks as it is being manipulated at the source
and can actually listen in on the DTMF being played down the line as the End
User attempts to dial numbers on the keypad (however, there several seconds
of delay between when the DTMF was heard at the payphone and when they are
heard by the calling party).
· Whilst in this mode the Caller can actually speak to the Receiving
party (at the payphone) but cannot hear any replies as the handset is still
muted.
· The Calling party remains connected for 1 or 2 minutes as mentioned
earlier, they will stay connected for the duration of this period even if
End User's at the payphone lift the handset and attempt to hang it up or
disconnect the incoming call. As with telephone lines the Calling party has
precedent over the connection of the call.
(ii) From the [Payphone] End User's point-of-view: When the external
source is ringing the payphone, for the first two rings there is no
indication that a call is coming through. Once the external source hears the
long beep, the LCD screen at the payphone displays "Thank You. Please
Insert Money/Coins".
· If the Receiving party (person at the payphone) lifts the handset
*before* the long beep (ie. during the first two calls only heard by the
Caller): then they automatically "by-pass" it.
· If the Receiving party lifts the handset *during* the long beep: they
are able to hear the Calling party if they speak loud enough over the beep,
but cannot reply as the handset is still muted. Sometimes the Receiving
party is cut-off when they first lift the handset, see the following point
for details.
· If the Receiving party lifts the handset *after* the long beep: they
will be automatically cut out, he/she must then depress the hook-switch and
lift the handset again (or press Follow-On in some cases).
· At this point the End User at the payphone can hear everything at the
other end of the line but cannot be heard by the Caller. They must dial any
random 1800 (Free to Caller) number. After a short pause of 2 or 3 seconds
the handset is un-muted and both parties can have a continuous conversation
minus interruptions by clicks, beeps or time-delays.
II. The Theory
When studying the XP1230 one begins to understand how it is possible
that the Un-Mute method described here actually works. As will be detailed
later on in the article, there are several outstanding features that make
this payphone distinctly different to that of its rival the Telstra X2
Smartphone.
TriTel payphones work on ROA [R]eversal [O]n [A]nswer, which basically
refers to the line polarity being reversed when a number is dialled thus
unmuting the handset and charging the End User accordingly (Free to Caller
numbers are obviously recognised as such and the payphone cannot charge
you). (For further discussion on this matter See the chapter Understanding
the Payphone Line).
The payphone is an American Protel XP1230 model which has its own
internal recognition software that analyses the actual number itself against
the time of day & day of the week with a charging table - this is known as
Self-Tariffing.
The reason why the Un-Mute Method works is because when the End User
dials the 1800 number, the payphone itself (as an individual entity and not
via CLM) analyses the number that was dialled against the time of day and
the charging table, within those few seconds it realises that the number is
Free to Caller and this is where ROA comes into play. The line polarity is
reversed, no money is taken (since it is free) and the handset is un-muted
to allow the number to connect. Obviously, the number cannot connect since
there is already a call occupying the line.
III. Dispelling the Myths
Over the past six odd months the TriTel payphone discussion has reached
a climax, during that period many myths and misconceptions were distributed
by pretentious neophytes and other undesirables. Provided are some brief
points outlining what, in my extensive experience, are known to be fact:
(a) TriTel XP1230 Ring-tone: this does *not* exist. I have heard of
reference to some TriTel payphones in Canberra that are alleged to have a
ring tone much like a "hushed" L6 Bluephone. Since there is no evidence to
the contrary, the current status quo stands that when TriTel phones are rung
the only external indication that there is an incoming call is a message on
the LCD screen reading "Thank You - Please Insert Money".
(b) The following payphones *cannot* call a TriTel XP1230 payphone for
various reasons:
· Telstra X1/X2 Smartphone (Siemens Elasa)
· TriTel XP1230 (Protel)
When one attempts to dial a TriTel from another TriTel, the line is
immediately disconnected but the Calling party is charged 40 cents for the
call before it drops out. X2's on the other hand are completely barred from
dialling a TriTel XP1230 in some areas, but the vast majority are not barred
from calling other X2 Smartphones.
(c) TriTel payphones *cannot* accept Telstra Phonecards: this is true.
Even though the XP1230 is infact quite capable of doing so, Telstra has
barred access. For further discussion on this matter and consultations with
the ACCC, see the link provided at the end of the "TriTel Australia - The
Specs" chapter.
(d) Yes, using Bankcards in TriTel XP1230's is perfectly acceptible,
there are numerous signs on both the payphone itself and the stand
indicating this.
(e) Free To Caller number the Called Party dials to Un-mute the handset
can "eavesdrop" on the conversation: this is *untrue* and was confirmed
after extensive discussion with numerous phreakers on the Aust Phreaking BBS
and over the phone. The XP1230 is Self-Tariffing rather than utilising
Customer Loop Metering (See Understanding the Payphone Line) and is designed
to analyse the number dialled against the time of day and a pricing chart.
Since the number is Free to Caller (ie. 1800-xxx-xxx) the payphone is
tricked into un-muting the handset, something which occurs via reversal of
the line polarity when the called party lifts the handset - although in this
situation the called party is the payphone itself and the handset is already
off the hook. Due to the fact that the line is already occupied with a call
between the external source and the called-payphone, it cannot actually
connect the 1800 number the End User dialled.
TriTel Australia - The Specs
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
John Bucknell - Managing Director
TriTel Australia Pty. Ltd.
135 Darling Street, Balmain East, Sydney 2041 NSW
Ph: (02) 9810 0146 Fax: (02) 9810 2780
E-mail: tritel@ihug.com.au
· Who: TriTel Australia is the only major alternative to Telstra for
public payphones in Australia (see Appendices for others).
· Evolution: Over the past two years TriTel Australia has expanded
from operating payphones in major shopping centres throughout
Sydney and in South Eastern Queensland, to entering the payphone
market across Australia. They are found in Universities, shopping
centres and a few public locations in almost every State and
territory.
· Payphone: TriTel use an American payphone that was proven in the
USA to be "highly vandal resistant" - the Protel XP1230.
· Objective: Deliver real benefits to the Australian public by
offering substantially better rates than Telstra payphones.
Compete with Telstra's long-standing monopoly of the payphone
industry.
For further discussions on Telstra's smartcard technology trial and its
associations with TriTel paphones see "ACCC To Monitor Negotiations Over
Payphone Service":
- http://www.accc.gov.au/media/mr1999/mr-185-99.htm
Protel International & the TrendTek connection
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
TriTel Australia makes use of the American payphone produced by Protel
International, one of the major US payphone manufacturers. The payphone
itself was provided through a contract with TrendTek Australia, the supplier
of telecommunications products to major carriers, service providers and
retail organisations throughout the Asia Pacific region. TrendTek receive
the Protel XP1230 model via Galaxy Payphones (Supplier Code N1141). In
addition to supplying TriTel with their payphones, TrendTek supplies various
products to organisations such as Telstra, Optus, Alcatel, AT&T Australia,
Ericsson, Australia Post and Queensland Payphones.
The particular model utilised by TriTel is titled the Protel XP1230 and
supports a variety of payment methods and access network connections.
Network connection of the various payphones TrendTek offers can be provided
via:
· Conventional PSTN copper links
· Cellular Wireless Networks (GSM, CDMA, AMPS)
· VHF/UHF radio links
· Digital Pair Gain systems
Beneath the vast majority of these payphones - just under the cash box
to be precise - is a sticker with the following details: "Galaxy Payphones
(Supplier Code N1141) TrendTek Australia".
The Protel XP1230 Payphone - Specs
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
The Protel XP1200/1230 Payphone offers a variety of payment options:
magnetic stripe, microchip and coins/tokens. The XP1200 model is a
coin/token payphone only; the XP1230 model upgrade (distributed in Australia
by TrendTek and currently utilised by TriTel) offers both coins/tokens and
card technology.
Features:
· Line-powered, loop start. 48 VDC line voltage, 20 mA minimum.
· Two Protel [Remotely Programmable Electronic] Coin Scanner models
are available:
ECSII: Accepts coins of up to 27 mm in diameter with a max.
thickness of 2.8 mm.
ECSV: Accepts coins of up to 33mm in diameter with a max.
thickness of 3.3 mm.
· Reads all chip cards conforming to ISO 7816 and magnetic stripe
cards Track 2 conforming to ISO 7810 to ISO 7813.
· Optional SAM authentication (5 slots).
· High Contrast Liquid Crystal Display of 2 lines x 20 characters
per line, 9 mm character height.
· Electro-dynamic handset [High Impact Poly-carbonate], hearing aid
compatible with internal stainless steel lanyard with pull
strength of 450 kg.
· Rugged, Vandal-resistant Construction & Stainless Steel Faceplate
· Magnetic Proximity Hookswitch
· Six function keys for Language selection, Volume amplification,
New Call [Follow On], Redial, Change Card, and Emergency number.
[The last three keys are not yet operational in Australia - pH.]
· Encased state-of-the-art electronics for physical and ESD
protection.
· High Quality Anti-drill Locks
· 4mm Stainless Steel Vault Door
· Anti-stuffing Coin Return
· Call Subscriber Answer includes line reversal, 12/16 Khz, 50 Hz
pulses, DTMF tones.
· Bi-directional communications with the ProNet Payphone Management
System for Call Detail Records and multiple alarm detection.
· All payphone features, including Operating System, are
downloadable from the ProNet Payphone Management System.
· Self-Tariffing - TriTel Australia does not utilise CLM to operate
its payphones. It analyses the dialled number against the weekday,
time and a charging table to determine the call cost.
· Service Difficulties - dial 1800 181 922
· Utilises 1800 REVERSE (1800 738 3773)
· Directory Assistance - Local: 1223 - International: 1225
Understanding the Payphone Line
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
I. Payphone Lines
Standard payphone lines differ in several ways to that of a normal
telephone line. In this section I will attempt to outline the main features
which distinguish its line configuration.
(1) Dial Tones: Payphone lines have a 60-second dial tone; as opposed
to normal lines which have a standard 10 seconds (allowing customers time to
insert money and dial).
(2) ROA (Reversal On Answer): refers to the reversal of line polarity
when the called party lifts the handset. This is necessary to indicate to
the payphone when it should take the money, un-mute the handset and allow
two-way conversation.
(3) CLM (Customer Loop Metering): refers to a mechanism for charging
calls to mobile phones, long distance and so on. For each timed period the
exchange sends a pulse which is used to signal the payphone to deduct
another 40 cents (1 meter pulse = 1 local call). Telstra payphones require
these meter pulses to operate - this includes their Customer Operated L6
Bluephones and C4 Goldphones.
(4) Self-Tariffing: the [Protel] XP1230 TriTel payphone does not
utilise CLM to operate. Instead, it is Self-Tariffing - essentially having
its own intelligence, which allows it to analyse the dialled number against
the weekday, time and a charging table to determine the call cost which is
then displayed on the LCD.
(5) Pre-selected Carrier Barring: the oppressive corporate giant that
is Telstra did not allow payphone lines to be pre-selected to any other
carrier during the pre-2000 era. In effect, tens of thousands of L6 and C4
operators pay full retail rates for each call. In March 2000 Telstra agreed
to create a new line after consultation with the ACCC, it was to be
identical to the standard payphone line, minus CLM.
(6) Payphone Lines vs. Normal Lines: payphones such as the TriTel
XP1230 utilise a Telephone-style 12 Core cable; whilst the common line you
will come across in your own home is a Normal, Austel Approved, Telephone
Cable Flat 4 Core. Depending on the area you are in, the copper wires you
require for beige boxing are Red and Green or alternatively, White and Blue.
II. Accessing the Line
The vast majority of TriTel XP1230's you will come across are encased
in a stand rather than a booth. In many instances the aperture between the
stand and the wall it is backed against can vary from a centimeter to an
inch. If one is able to locate an easily accessible stand with at least one
inch of space, gently pry it slightly wider and take a peek behind the
metallic hull. You will notice several chords leading from both the
mid-section of the payphone and higher up.
(a) White: the thickest chord (several millimeters short of a
centimeter in diameter) encased in corrugated white plastic, is the power
source. Do not cut this line.
(b) Blue: thickness of a standard pen, this houses the phone line and
is known as a Telephone-style cable, 12 Core.
(c) Green-Yellow (striped): several millimeters in diameter, the
thinnest; this is the insulated Earth copper wire.
(d) Black: some TriTel payphones I have come across have a black
telephone cable instead, it is a Flat 6 Core cable and is accessed via a
hole directly underneath the phone itself but in the actual stand, roughly
5cm in diameter.
(e) Grey: this is also an additional line found inconjunction with
Black 6 Core cables on some TriTel phones and is accessed via the same hole
as mentioned above. It is understood to be the Flat Earth copper wire in
some areas.
If you are able to see the phoneline or ascertain its location, it is
possible to create a nice hook out of worked silver solder in order to
"fish" the chord out from behind the stand for beige-boxing. (See Appendix 5
- Metalwork, Heat Treatment, Tempering to create your own "gaff").
WARNING. Please make sure you are very certain the line you are about
to strip is definitely the telephone line. Colours vary in different areas
as I have illustrated above (See d. and e. for some examples of
alternatives). A simple, yet effective, method of getting to the copper
wires underneath the insulation *instead* of stripping the line or slicing
them length-wise with a knife, is to burn off the plastic with a lighter. I
*will not* take responsibility for anything you attempt to do based on what
you have read - you do so at your own risk.
III. Pricing
As mentioned earlier, the corporate behemoth, known as Telstra, charges
full retail rates to all payphone operators who are connected to their
network. Their payphone division pays an estimated 12 cents per meter pulse,
(1 meter pulse = 1 local call). Payphone Operators are thus unable to offer
better rates to the End User due to the method by which they are charged.
TriTel payphones do not need meter pulses to operate (they are
Self-Tariffing) and are thus able to pre-select to other carriers,
theoretically able to offer better rates.
Due to Telstra's control of the Phonecard market (for alternative
phonecards see Appendix 1 - PayTel Australia) and their barring of TriTel
from allowing the XP1230 to read Telstra SmartCards, TriTel has come out
with their own brand of Phonecards which are available at various Newsagents
in certain regions of the country, at this writing they are still hard to
come by.
Appendix 1 - PayTel Australia
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Almost half a year ago, whilst researching various exotic payphones
available around Australia, I came across the PayTel S400 Satellite
Payphone. Although I have never seen one let alone operated one before, I
can provide you with quite a detailed amount of information on it (all of
which I obtained from their website and am essentially presenting here as a
means of preservation and future reference). If any of you Melbournites ever
come across any of these, or anyone across Australia for that matter, have a
good look at them, try various things and email me with some constructive
information (Do they ring? Do tonediallers work on them? Is the handset
muted for incoming calls? Are there any barred services and so on).
PayTel payphones are generally found in a variety of locations and are
designed for providing remote locations with telephone communication. They
utilise wireless technology (Analogue / Digital; Cellular Radio, and/or
Satellite) to provide these services in "mobile environments" or where wire
connections are not available. They can operate on both credit and
phonecards - PayTel is the holder of ISO financial card IIN [I]ssuer
[I]dentification [N]umber 836 600. The phonecards use Magnetic Stripe
technology encoded with a proprietary data system unique to PayTel. Charges
for calls Australia-wide and each of 4 ISD call zones are uploaded into each
S400 by data signalling from the PayTel office (think, Telstra MTMS
updates).
Locations where PayTel S400 Satellite Payphones can be found and are
applied include: Military; Coaches; Outback Tours; Oil Rigs; Trains;
Freighters; Mining Camps; Roadside Assistance; Isolated Communication;
Liners; Remote Events and Emergency Locations.
PayTel is an entirely Australian owned company and claims to be the
only group providing payphones actually designed and manufactured here.
Pay·Tel Australia Pty Ltd
PO Box 456 (4/43 Railway Road)
Blackburn, Victoria 3130, Australia
Phone: (03) 9877 0222, Fax: (03) 9877 9499
Email paytel@melbourne.net
S400 Satellite Payphone - Overview:
· 3rd Generation Coinless Payphone (based on Mk II satellite & cellular
payphones supplied to numerous railway operators across the country)
· "Flash" Memory - payphone operator can change/set phonecall rates, eg.
Subsidy $1 p/min
Cost $2 p/min
Profit $3 p/min
· Features benefits of chosen CAPSAT telephone (phone/credit card phone)
· Payphone Diagnostics performed remotely (data signalling from PayTel
office)
· Allows for pre-paid phone calls
· Operates via Thrane & Thrane Capsat telephone as well as "Inmarsat
· Constructed of strong steel
· LCD (20 x 2) display: Call Duration & Charging Information
· Call payment options: credit cards & pre-paid smart cards (phonecards)
· Payphone Management System provided by PayTel
Further Specifications & Details:
· Measurements: 100mm x 300mm x 380mm (depth x h x w)
· Weight: 5 kg (incl. CAPSAT unit)
· Power: 200-250v AC / 12v DC.
· Solar Power (optional)
· Connection: Voice port & data port, CAPSAT TT-3060, TT-3062A, TT-3062B
· Fittings: CAPSAT unit can be housed in the payphone or separately
· Placement: 4 x 5 mm holes at rear for wall mounting
· Marine protection: Fully cod plated
· Maintenance: Maintenance free, only requires hygiene cleaning
· Call payment: Visa, Mastercard, Bankcard or PayTel phonecard
· Authorisations: Credit Card data sent via modem to PayTel Processing
Unit
· Phonecard personalisation (optional at extra charge)
· Cost of service: 10% credit cards, $6.00 phonecards
· Call charging: Variable according to owner (1 minute increments)
· Call cost: As per Telstra standard billing
· Call information: Duration of call, call cost & remaining call time
credit displayed on LCD
· Enviromental resistance: Indoor application only (recommended)
· Coverage: World-wide Inmarsat coverage according to CAPSAT data
supplied separately
· Usage: Graphically indicated on payphone. English language prompts and
information on LCD
· Customisation: Call charges, card information and other variables
according to the owner
· Cards: Compliant with ISO 7811; PayTel holds IIN 836 600
Appendix 2 - Siemens Payphones Australia
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
"The company is currently the sole supplier to Telstra of owner
operated payphones."
- Siemens
I. Cityphone Compact
The Cityphone Compact is a Multi-chipcard & coin payphone. Siemens
claim that their new phone model is "world leading technology" but has not
yet been released in Australia at this writing. Quite a sexy phone I might
add, silver and sleek (uses Abloy keys I see) but has the same handset as
the Siemens Elasa (better known as the Telstra X2 Smartphone). Since they
are not yet on the market I am going off what was written at the site
re-worded in some cases (See Resources & Links).
(i) Semi-supervised multi-chipcard & coin [Indoor] payphone
· Line-powered payphone for coins and all kinds of chipcards
· Integrated security modules
· S-PMS support & software download
· Visually & mechanically compatible with TSP/TMI
· Modular field upgrades from coin to combinations
(ii) Features
· 2 wire analogue telephone line interface
· DTMF & Pulse dialling
· allows Incoming calls
· Card change function during call
· Various Langauge user messages
· Free to Caller numbers list
· Barred numbers list
· Remote charging
· Self-charging based on polarity reversal (PTT optional)
· Up to 5 coin escrow Upper compartment electronically controlled
(iii) Coins
· Coins escrow
· Remotely programmable electronic coin validator
· Escrow capacity: - 4 coin sequential access - 5 coin random access
· Integrated Coin box (700 cc capacity)
· External coin box optional (2000 cc capacity)
· Electromechanical coin entry slide
(iv) Chipcards
· Chip cards with or without enhanced security algorithms (e.g. SLE
4 43X)
· Electronic purse microprocessor cards
(v) Security Features
· Up to four security modules
· Offline operation
· Cryptographic authentication between chip card and payphone
· Reliable store of the charged units
· Black/white list storage
· Integrated anti line tampering unit
(vi) Statistical Data
· Income (charged quantity)
· Number of calls
· Number of invalid telephone cards
· Management System availability
· Other requirements
(vii) Maintenance Features
· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearance reports
(viii) Management System
· Compatible with existing management system (S-PMS)
· Integrated 2400 bps modem
· Parameters up- and downloading
· Software download
· Download of security access keys
(ix) Technical Characteristics
· Process Capacity
* 16 bits microprocessor
* 4 Mbits Flash EPROM memory
* 32 kBytes EEPROM memory
* 4 Mbits RAM memory
· Power supply
* Telephone line powered
· Communications
* Integrated 2400 bps modem
· Keypad
* CCITT standard numeric keypad.
* Function keys
* Hot keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment
* Temperature range - 20°C to 60°C
· Display / Instructions plate
* 2 line LCD display with 2x20 characters
II. Easyset Entry
Another payphone soon to be released on the Australian market by
Siemens is their latest Indoor coin payphone, the Easyset Entry. All
information included here is either quoted or r-eworded from data supplied
online from websites found after extensive researching.
This boy in dark-blue comes with optional Integrated Anti Line
Tampering security features, which makes for quite an interesting adversary.
Please note that any of these "not yet released on the market" payphones are
bound to appear in various locations across the country over the next few
years, so keep an eye out and keep me posted via email or on the BBS.
(i) Indoor coin payphone; entry model - Features
· 2-wire analogue telephone line interface
· DTMF & pulse dialling
· allows Incoming calls
· 4 different languages for user messages
· Barred numbers
· Free to Caller numbers
· Charging pulses (CLM)
· Self charging with polarity reversal (Push to Talk option)
(ii) Coins
· Remotely programmable coin validator
· Escrow coin storage capacity (2 options):
* 4 coins escrow in sequential mode
* 5 coins escrow in random access mode
· Integrated cash box
· External coin box (optional)
(iii) Security Features
· Reliable collecting scheme
· Integrated Anti-Line Tampering (optional)
· Metal Coin Module
(iv) Statistical Data
· Amount collected
· Number of calls
· Management system access
· Fast dialling keys
· Additional statistics can be implemented on request
(v) Maintenance Features
· Full diagnostics and test capabilities
· Menu-driven program for guided field maintenance
· Display of faulty elements, alarms, parameters and statistics
· Failure clearing reporting
(vi) Management System
· Compatible with existing management system (S-PMS)
· Modem with 1200 bit/s
· Up- and downloading of parameters
(vii) Technical Characteristics
· Processing Power
* 8 bit Microprocessor
* 64 Kbits Flash EPROM
* 32 kBytes EEPROM
* 32 Kbits RAM
· Power Supply
* Line-powered
· Communications
* Integrated 1200 bit/s Modem (V23)
· Keypad
* Standard numerical keypad (CCITT/ITU)
* Function keys
* Fast dialling keys
· Operating Range
* Temperature Range: from 0ºC to +50ºC
· Display
* 2 lines LCD display with 24 characters/line.
III. Telstra Interset 751
Siemens example of "world leading technology" already available in
Australia. A No-Coins payphone that deals in the latest generation of chip
cards. I have not yet seen any of these around but they are said to be
suited to hotels and hospitals and is obviously the reason why. They look
like a dark blue Optus housephone with a Bright Red handset and a chip card
sticking out diagonally on the top right-hand corner. Interestingly, this
one also has anti line tampering modules.
(i) Desktop payphone for latest generation chip cards
· Analogue chip card telephone with integrated anti line tampering
modules
· Bundled with hotel application
· Free flowing data port
· 12 kHz metering or behind PABX
· MTMS support & software download
· Refurbishment option to "as-new" standard for post-Olympic period
(ii) Features
· Analogue telephone line interface
· DTMF & pulse dialing
· accepts Incoming calls
· Number redial
· Change of card during a phone call
· 4 languages
· 8 Hot-line keys
· Storage of barred numbers
· Storage of non-chargeable telephone numbers
· Charge pulse evaluation 16 kHz (12 kHz optional)
· Self tariffing (optional)
· Data socket
(iii) Cards
· Memory cards with algorithm (eg SLE 443X)
· Microprocessor cards with electronic purses
(iv) Security Features
· Up to 3 security modules (eg SLE 44C80)
· Off-line operation
· Cryptographic authentication between chip cards and terminal
· Secure debiting of call charges
· Reliable storage of charge sums
· Storage of black/white list for cards
· Anti line tampering integrated
(v) Statistical Data
· Revenue
· Number of calls
· Invalid telephone cards
· Availability of the management system
· Use of hot-line keys
(vi) Maintenance Features
· Full diagnostics and tests capabilities
· Menu driven program for guided field maintenance
· Displaying of faulty elements, alarms, parameters and statistics
· Maintenance personnel identification
· Failure clearing reporting
(vii) Management System
· Compatible with MTMS Management System
· Modem communication 2400 bit/s
· Parameter upload/download
· Software and firmware download
· Key download to security module
(viii) Technical specification
· Processing Power
* 16 bit microprocessor
* 4 Mbit Flash EPROM
* 32 Kbytes EEPROM
* 4 Mbit RAM
· Power supply
* Telephone line powered
· Communication
* Integrated modem 2400 bit/s
· Keypad
* Numeric keys CCITT standard.
* function keys
* Hot line keys
· Card reader
* Conforms to ISO 7816-2
· Operating environment - Temperature range 10ºC to 40ºC
· Display
* 2 line LCD display with 2x24 digits
IV. Diamond (L6 Bluephone)
Made popular at tens of thousands of locations across Australia, from
Swimming Pools to Newsagents, Chemists, 7-Eleven and other numerous
Convenience Stores, Universities, Schools, Pubs, Petrol Stations and a host
of different "indoor type" locations where these Customer Operated coin-only
Payphones are in use. Marketted by Telstra as the Bluephone, it has been
available in Australia since 1988.
Siemens Communications Pty Ltd
Cnr. Herring and Talavera Rds
North Ryde NSW 2113
Australia
Mail: Locked Bag No. 2500
North Ryde NSW 1670
Phone +61 137 222 Fax +61 1300 360 222
(i) Features
· Aluminium diecast casework
· Fraud resistant (haha)
· All models suitable for wall or desk mounting
· Electronic coin validation for 4 different coins
· Local, long-distance, international, free, barred and operator
facilities
· Follow-on Button
· Decadic (Pulse) / DTMF dialling (payphone identity tone, credit expiry
tone)
· Line powered (no mains req.)
· Self diagnosis of faults
· Owner mode facility allows operation as a normal phone
· Hearing aid facility. Fitted with an inductive coupled hearing aid
adaptor
· 16-character display
· Dimensions: 245mm x 180mm x 310mm (w x d x h)
· Weight: 5 kg
· Operation Range: 0 to 45 degrees Celsius, 10 to 70% RH
· CLM - Called subscriber answer indicated by 50Hz / 12kHz meter pulses.
· Tariff Changing: Pre-set by factory or changed by the owner from the
keypad
· Accepts Incoming calls (has loud ring-tone)
· It is possible to do a 1800-REVERSE call from one Bluephone to another
(ii) Security
· Access to the mechanism compartment and cash container is via a single
keyswitch. A 3rd position on this keyswitch allows use of the
equipment as an ordinary telephone. Cash container capacity 1 litre.
(iii) Coin Handling:
· In-line escrow, capacity 4 coins. Coins are cashed as they are used,
in the order in which they are inserted. Unused coins are returned.
V. Elasa (Telstra X1/X2)
Manufactured in Spain, the Elasa model was originally designed for
indoor use only but Telstra has utilised it as both an outdoor and indoor
semi-supervised location Payphone. MTMS updates are constantly barring
certain numbers that phreakers find and exploit excessively (publicly
announcing "sensitive" numbers on places such as a BBS is highly frowned
upon - this was how the iPrimus DCX and FAST were barred). There are
numerous Workarounds publicised by Zaleth in his article and the Method for
Un-muting an X2 Smartphone Handset are also included in numerous articles
and is the reason for why it is not included here.
This particular subtitle was included to merely record various other
information about the Elasa payphone as well as a list of currently known
facts about X2's. The Smartphones are constantly being updated, some are of
course not and so the differences vary according to location and other
factors.
Facts:
(a) The Ringtone: Yes, it is true that *some* X2 payphones have an
initial two-tone chime to indicate that there is an incoming call. The vast
majority *do not* have any sort of ringtone.
(b) The Un-Mute: Yes, it is possible to un-mute the handset (refer to
numerous other articles detailing this method).
(c) Calling other X2's: It is possible to call other X2 payphones from
an X2 and un-mute the handset for two-way communication. Of course there may
also exist some X2's that have this capability barred.
(d) Calling TriTel XP1230's: *Some* X2's are barred from calling TriTel
payphones.
(e) Workarounds: Yes, these do work and are necessary if you wish to
call FAST or the iPrimus DCX.
(f) Tonediallers: Some X2's will only accept tonedialler DTMF if at
least 1 digit has been pressed on the actual keypad, others do not accept
tonediallers at all.
(g) DTMF Time-delay: Almost all X2 Smartphones have a time-delay
between pressing the number on the keypad and hearing the actual DTMF being
played down the line (this only occurs after several digits have been
pressed). It is possible to find some X2's that are not updated and do not
have this annoying feature, they simply play the DTMF the moment you press
the keypad for as many numbers as you dial.
(h) Straw-trick: This is pathetic, old and does not work any longer.
The vast majority of payphones will not let you complete the call after
$1.50 or so has been used up in credit (the line is disconnected and ERROR
appears on the screen). I'm am quite sure that it isn't even possible now to
do the straw-trick even for that minimal credit (it's been so long...)
(i) MTMS: this is dialled up automatically by the phone when an
excessive amount of unconnected 1800 numbers have been dialled sequentially.
Appendix 3 - DORO Zircon Payphones
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
The DORO Zircon is an Indoor Coin-Only type Customer Operated payphone
and can be found in a number of places, particularly Clubs, Restaurants,
various Shops, Hotels and so on.
DORO Zircon Specifications:
· Exterior: White ABS plastic; compact design; ergonomic handset
· Four memory buttons for fast access to local business
· Redial; Follow-On; Volume Control; Multilingual selection
· Accepts 20c, 50c $1 and $2 coins
· Can be programmed to accept any new coins introduced in the future
· Raising pip on fifth digit to aid the visually impaired
· Can be affixed to a wall or desktop mounted
· Large cashbox capacity
· Backup battery with five-year life
· Liquid crystal display (single line)
· Help-desk coupled with self-diagnostic facility
· Hearing aid compatible
· Rather loud ringtone
· When called, the line connects as soon as the receiving party
lifts the handset
DORO Zircon MX Specifications (includes those above)
· 2mm secure Steel Jacket
· Secure Cashbox Drawer
The majority of this information was taken from the following webpage,
which also includes pictures of these Indoor Coin Payphones:
- http://www.activeelectronics.com.au/doro/doro.html
Appendix 4 - Vector Technology Corporation (VTC)
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
VECTOR Customer Operated Payphone's (VT-200M) are found in a majority
of places throughout Sydney, particularly associated with Newsagents, Phone
stores and other venues in the Chinatown district. They have now spread
across the entire city and can be found just as easily in the suburbs. Be it
in secure, semi-secure and outdoor locations, they are in in more than 80
countries worldwide.
Vector Technology Corporation
7F,No.87 Chung-Yang Rd, Sec. 3
Tuchen Taipei Taiwan
Tel: (886 2) 22678080 Fax: (886 2) 22678181
Email:sales@vector.com.tw
Key Contact: Mr Joe Ran MANAGER
The payphone itself is slightly larger than the Siemens Diamond model
(or as it is more commonly known, the Telstra L6 Bluephone). The VTC's found
commonly in Australia are in dark purple ABS Plastic but Vector Technology
also release models in Yellow, Green, Brick-Red, Crimson-Red, Cream and so
on. The dark purple model is known as the VT-200M and are Coin Only (they
are also designed to accept cards, but I have not come across any with this
feature activated as yet).
VT-200M (VTC Coins-Only Payphone) - Specifications:
· Power: line Power
· Call Limited: Local, STD, IDD, Internet Gateway Acces - (Minimum
insertion options)
· Call Area define: Local 300 sets, STD 300 sets, IDD 400 sets
· Function Button: Hot line, Barred, Emergency Call.
· Coin release: Avoids coin channel being blocked.
· Tariff Rate: Self Tariff, Or System Tariff by Meter Pulsed 12Khz /
16Khz / 50Hz) - Interfaces with all existing metering signals
(Tariff Rates programmable)
· Service Charge, minimum charge.
· LCD 16 Character - Multipurpose display
· Coin Definition: Max 12 Kinds - Smart coin collection - Multi-coin
operations
· Microprocessor Controlled
· Electronic coin diameter validator (VT-100); Electronic
permeability validator (VT-200)
· Self-diagnostics; Cash Box Monitoring; Coin Jam Release
· Coin recognition: diameter, Material
· Tariff Change: By Keypad / By Remote Control System
· Income Monitor: By Keypad / By Remote control System
· Discount Time: 24 Period (Real Time Clock Request)
· Metal CashBox: default 300Pic, External 2000 Pic
· Frame: ABS Plastic
· Desktop / Wall Mouted
· Access to PABX Systems
· Size: 245mm x 183mm x 315mm (w x d x h)
· Weight: 3.5 Kg
Optional Extras:
· GSM 900/1800/1900 Mhz Triple Band Module
· IC Card Option
· Real Time Clock
· External Cash Box
Function List:
Function 00 - Self-Diagnosis
Function 01 - Local / STD /IDD block control
Function 02 - Local/STD/IDD code/rate input
Function 03 - Tone/Pulse selecting
Function 04 - Duration for incoming call
Function 05 - PBX mode setting & Barred code setting
Function 06 - Warning time setting
Function 07 - Hot line program (2 sets)
Function 08 - Accumulation of coins
Function 09 - Coin recognition program (6 different coins)
Function 10 - Money or time display & metering Signal selecting
Function 11 - Owner's password program
Function 12 - Cashbox monitoring password program
Function 13 - Language Mode program (2 languages)
Function 14 - Taxed rate & rate's program for value
Function 15 - Rate's program for timing
Function 16 - Data copy program
Function 17 - Speed dial program (10 sets)
Function 18 - Auto detection (optional)
Function 19 - Real Time clock setting (optional)
Function 20 - Reduce price / periods program
Function 21 - Carrier Setting (reserve)
Function 22 - Date off & service program
Function 23 - Password program
Function 24 - Simple discount
Function 25 - 0+ program (optional)
Function 26 - RMS
Function 27 - Version no.
Function 28 - Cashbox / Volume Selecting
Function 29 - Internet Gateway Access
VT-200M Additional Information:
(a) Call cost is generally 50 cents per local call, $1 initial call to
mobile phones.
(b) Buttons: Follow On, ReDial, Loud.
(c) Payphone line: Standard Flat 4 Core Telephone-style cable, [Austel
Approved].
(c) 50 cents must be inserted in order to place a 1800 call, the vast
majority of VTC phones I have come across will actually charge you for
placing that call - a few simply return the money.
(d) When attempting to dial a 1800 number without money the first digit
registers and the DTMF for 1 is played down the line. However, the following
7 numbers (ie. 800-xxx-x) will not register, after which the phone resets
and asks again for 50 cents. A mobile phone used as a tone dialler will not
work, even after one button is pressed on the keypad. The "Follow On &
ReDial" Workaround pertaining to X2's will not work either since the VTC
will only register the initial DTMF tone if no money is placed in.
(e) VTC payphones can be rung and the line is connected as soon as the
receiving party lifts the handset. The ring-tone is similar to that of the
L6 Bluephone only slightly higher-pitched and louder in some cases.
Appendix 5 - Metalwork, Heat Treatment, Tempering
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
I. Silver Solder Gaff
You can purchase pieces of Silver Solder from Hardware supply stores,
particularly the larger ones as many of the regular BBC stores in your local
area may not actually stock any of it (you'd be surprised). Silver solder is
quite literally, solder containing silver - and is a long piece of solder
about 3 millimeters in diameter and usually found about a metre long. It is
easily recognisable in a brown or shiny grey-brown colour and much more
stiffer than flimsy wire coat-hangers or other similar pieces.
A gaff, by definition, is a device for hooking fish; but in the
phreaking sense I apply my miniaturised-gaff device to "fishing" phonelines
out from the back of payphones, particularly the TriTel XP1230's as they are
accessible this way (the stands are sometimes an inch off the wall). Since
pieces of silver solder can be quite long it is effective; an accomplice can
stand beside you and hold the gaff in place while you have access to the
line and do what you will.
· Using a strong and larger pair of pincers bend the silver solder at a
point no more than a few inches from one side (as you do not want to lose
too much of its overall length). It may take some effort in straightening
and bending (sometimes a hammer can assist in getting it to the right angle)
so that two halves are parallel with one another and there is roughly 1 cm
of gap between them (this provides the perfect hook shape at the bend).
· With the same pair of pincers clip off the shorter half right at the
point where the bending stops. Make sure that any sharp edges are smoothed.
Keep the long section as straight as possible since it can be quite
frustrating attempting to fish for phonelines with a crooked gaff.
____________________________________________________
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯)
¯
· A pathetic ASCII drawing is provided here for my amusement and also
your own. Enjoy. NB. this picture is *greatly* reduced in size.
II. Lock Picks
While this topic is not entirely related to anything else in the
article, it was put in firstly as a prelude to a future article covering
this area; and secondly since the methods for tempering and manipulating
metals applies to both the construction of gaffs and picks. I will attempt
to apply the metal treatments for lockpicks to making a perfect gaff (for
the obsessed).
Constructing a strong torque wrench is done by choosing a nail that
suits the various locks you have been studying. Nails which are roughly .25
cm in diameter, once turned into a torque wrench, suit a majority of locks
you may come across. Please note that some Lock Picking articles online
refer to the "torque" wrench as a tension wrench. Utilising a propane torch
to heat up the nail is ideal, once it glows red gradually remove it from the
flame and allow the air to cool it down - this basically softens the metal.
You can apply this to the silver solder for making your gaff.
· At the point at which you intend on bending the silver solder for
producing the "hook" tip apply a propane torch flame (or gas stove flame if
possible) to the area until it turns red as one does when preparing the
torque wrench. Once the silver solder has cooled in the air it is soft and
easily manipulable.
· Bend the silver solder at the softened point so that two halves are
parallel with one another and there is roughly 1 cm of gap between them
(exactly as you would in the I. Silver Solder Gaff description).
· With a strong pair of pincers cut off the shorter half right at the
point where the bending stops (exactly as you would using the more crude
method of gaff construction detailed in I. Silver Solder Gaff above).
· To harden the hook, now that it has been neatly bent and excess silver
solder cut off, you will have to temper it by heating the hook end with the
propane torch or gas stove flame till it is bright orange. Once it has
reached this state immerse the heated portion in a bucket of ice water. You
will end up with one of the strongest and finest constructed Silver Solder
Gaffs around.
· NB. Make sure that the hook-tip is not too sharp, grind it smooth or
flatten it and file down the edges manually (you dont want to be "fishing" a
line to see if it is the power source or phone cable and end up peircing the
insulation!).
Resources & Links
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Some of the information included in here was obviously obtained from
online sources that I personally researched and has been mainly paraphrased,
re-written in comprehensive terms to partially quoted. These pertain to the
payphones that I was not able to get physical access to (particularly the
PayTel S400 and the four new Siemens payphones).
* Siemens
http://www.siemens.com.au/sections/p_s/ic/ic_payphones/ic_payphones.html
* Pay·Tel Australia
http://www.paytel.com.au/
* DORO Zircon
http://www.activeelectronics.com.au/doro/doro.html
* Vector Technology Corporation
http://www.vector.com.tw/profile.htm
http://showcase.cetra.org.tw/comdex/search/search.asp?midclass=2230&page=11
http://showcase.cetra.org.tw/comdex/search/company.asp?ban=84514030&prodseq=14844&SchClause=midclass%3D2230%26page%3D11
* TrendTek Australia
http://www.trendtek.com.au/
* Protel International
http://WWW.PROTELINC.COM/PROTELInt/INDEX.HTM
Perhaps this will serve to show neophytes entering the scene and
wondering how they can start learning more, that the value of research is
immeasurable. It may take hours, even days before you find what you are
looking for, but the rewards far exceed the cost. The most useful search
engine of them all in my own opinion is the wondrous http://www.google.com/
-=-=-=-=-=-=-=-=-=
Until next time, Addio miei amici. I hope you enjoyed the article and
found it as helpful as it was informative. Positive feedback is always
appreciated.
~pHreakazØid~
-=-=-=-=-=-=-=-=-=
>eof<