!;;;;::--==--::--==--::--:[ ]:--::--==--::--==--::;;;;! :: {{{ K - 1 i n e }}} :: ;; ;; :: a new beginning :: `:==--::--==--::--==--::--==--::--==--::--==--::-- ]:--::--==--::--==--::--==:' ^ ^ ^ April 2000 ^ ^ ^ *: 'A Nettwerked Product' :* *: :* *: :* *: [-] Introduction .......................................... The Clone :* *: (-) Contact Information ................................... The Clone :* *: (-) In Memory Of .......................................... The Clone :* *:-=><=--=><=--=><=--=><=--=><=--=><=--=><=--=><=--=><=--=><=--=><=--=>g4p<=:* *: # Personal Writings # ^^^^^^^^^^^^^^^^^ *: (x) 'ACiD & plastik' ...................................... The Clone :* *: (x) 'Cyber Renditions' ...................................... warVamp :* *: (x) 'She makes me wait' .............................. Susan Larcombe :* *: (x) 'Nannou' .............................................. The Clone :* *: (x) 'I want you, Vetesgirl' .......................... Anonymous (#1) :* *: (x) 'Lil Jawa Hubbard' ............................... Anonymous (#2) :* *: (x) 'Ravers' ......................................... Anonymous (#3) :* *: (x) 'A K-rad Toy' .......................................... The P0pe :* # Technical Documentation # ^^^^^^^^^^^^^^^^^^^^^^^ *: (x) 'Basic NAM Programming' ............................... The Clone :* *: (x) 'Lame Theatre Hack Text' ................................... KAN0 :* *: (x) 'The Complete Guide to the Elcotel Payphone' .......... The Clone :* *: [-] Conclusion ............................................ The Clone :* *: :* *: :* *: :* *: :* *: :* *: :* -| -| b e g i n t r a n s m i s s i o n . . . =-=- == -= - . -= = =- -= - = ., . , -=-=-=-=- =- -= -= =- = = -= = , . =- == - , , ;. --{[{{}}{[ ]}{{}}]}-- , , ;. - == - - = - -= = - .,. ,. -= =- = = - .,. , - , ,. , =- -= - -= , , . . . ., =- -= = .=, , , ., , ., , Introduction - At last the third edition to my zine is finally completed, and it's only been about eleven months since I've written one! This issue promises to be one of the best so far - filled an interview, personal writings, technical hacking/phreaking documentation by my friends, acquaintances, and of course myself. In the previous zines I didn't have much feedback by anyone, so I was forced to do all technical and personal writing for them... tough job if you ask me. Luckly I didn't run by anyone elses schedual but my own because hell, I really don't give a flying fuck if you want my zine out on a quarterly basis. Now we enter the spring of 2000; what better time to release this issue... ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; The 780 Undergr0und Clown; /\ / \ / \ / \ '--------' | | < () > \ [] / - (Even a stopped clock has the right time ______ twice a day!) || ----{ }---- | | | | | | | | | | | | | | | | === | | === ;;; | | ;;; ---- ^^^----- \ / -----^^^ [ ]----- ~~ -----[ ] ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; ;.; Contact Information ------------------- Founder/Editor: The Clone E-mail: webmaster@nettwerk.hypermart.net URL: http://nettwerk.hypermart.net -- Shouts: Firstly I'd like to give shouts to all the people who have contributed to this issue of K-1ine. If it wasn't for you contributing I'd be forced to write all the material myself, and God wouldn't that be a hellish task! ____________________________________________________________________ ///////////////////////////////////////////////////////////////////// ¥ extra supa dope thanks to: Anonymous (#1, 2 & 3), KAN0, Susan Larcombe, The P0pe and warVamp \\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ ____________________________________________________________________ Misc Shouts -- All the Hack Canada crew (www.hackcanada.com): ªND; irc.2600.net #2600ca crew ªND; Mogel @ scene.textfiles.com, P&P Hartnoll (Orbital), Richard D. James, Stevyn @ Iron Feather Journal, Tom & Ed Chemical, Underworld -0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^-0-0-^^ In Memory of our good friend Backslash \ Bryne Cooper - 08\19\1953 - 03\06\2000 May you rest in peace my friend. What I remember; I remember warm personality and jokes filled our 2600 meets. I remember having some very good conversations with you, that you always ended with a smile. I never knew you closely, but I considered you a friend anyways. You touched your friends and family members hearts in so many ways, and you will never be forgotten. - The Clone ¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥ Personal Writings -- 'ACiD & plastik' --_-]]]]] Date: Wednesday February 9, 2000 ; Time Start: Not Documented ; Time End: 3:03am ; URL: http://nettwerk.hypermart.net ; EMAIL: webmaster@nettwerk.hypermart.net --- This document is the first of a kind. The first acid trip at home. God it's nice to be home doing this shit. One can't complain. I'm used to loud banging house and trance and the clubs/raves while doing this substance. But I've had far too many of those experiences. Yes sir. Now it's time for the techno/ambient experience of Plastikman's album 'Consumed'. [Novamute / M_nus]... Prepare... =- =- =- What what... what's wrong? nothing. ;-) Plastikman 1. Contain [ALBUM: Consumed]... Richie Hawtin... *,* >.>>>>>>>>>>>>>>>>>..-::;:;_--;;;---;;;;;'> | # () ;[] *_* . / + . ambients from both sides of my ears... the bells ringing in the distance.. a slight dropping of water .. [skip consume track [2] and passage (IN) [3] it's track 4 now.. 'cor ten' the rhythm comes on at 3 MINUTES 39 SECONDS . . . it goes da do da do da do da do... [[[ mixed in are the ambients ||| sounds like hammers on stone... ||| ]]] now track 5... convulse [sic]... underwater deep sea adventure. silent but loud whistling sounds and masked voices. ''obscurity in it's most beautiful form. track 6... ekko. I feel the echoing in my ears... and the constant humming... as the track progresses [26 seconds] the first loud ECHO hits... this has got to be one of the best tracks Richie and his many aliases has ever made.... [1 minute 53 seconds]... the echoing increases ever-so-slightly.. on 2 minutes and 54 seconds the echo is heard in the left ear.. on 3 minutes and 17 seconds the echoing slooooooooooows down. echo.. fading echo... 3 minutes and 55 seconds track ends. >> ffRD >> [zzz] to track 10. 'Consumed'. Now for a treat and a beet. I can't seem to explain this sound. repetitive ambients.. at 45 seconds a small beat is present. A little rhythm. I won't complain though. I'm enjoying this quite a bit. 1 minute 38 seconds rattling that mixes in sync with the first beat @ 45. The energy in this one is flowing very rapidly. Keeping an Open Mind and letting the music take contrOl... . . . ... ^^^ hi-key note in synth. higher frequency water dropplets. Every third beat is a dropplet. Every 0.5 seconds. ... fffoo ... ffFF oOo CCc uuuUU SsS Iii nnNN ggGG fuu.. ((Focus)) 9 minutes and 31 seconds it starts all over again - this time with interference... 10 minutes 9 seconds ;; .. =#.;L$;. [[{[[[ we did consume and now we are consumed. ]]]}]] passage (out) track 11 hi-key notes... soft ambients in a mellow / soft foRm. interrupt @ 3 minutes 4 seconds [pause] stop watch at 9 minutes 32 seconds 90 milliseconds. [unpause] >> 3 minutes 11 seconds exiting fading away END ______ ______ Hey, can you get DWR to Rip out a pay phone for me? ______ ______ Cyber Renditions by warVamp warvamp @ hotmail.com 03/15/2000 With the popularity of the Internet increasing at such an explosive rate. Information exchange is broadening and barriers are subsiding. Knowledge is considered power, and is a valuable resource to attain in any way available. Today millions of users access the Internet and gain knowledge available to them. "Hackers", as they are so often referred to as, are individuals seeking information. But there interests are not settled by the means of the normal conventions, mediums, and teachings. They use experience and inventiveness to explore the secrets that technology holds. And in this event, they are deemed unlawful and considered threats to businesses and even more so to society in general. There is an underground society which is unseen and innovative. Where a group of individuals exist and explore, and who have made many appearances in recent media articles. With alias' to hide there identity, they operate in secret. Deemed "violent anarchists" by the average uniformed individual, they explore the digital domain. Similar to a child in a candy store, hackers marvel at the complexity and beauty of technology. Armed with a keyboard and a digital doorway, they tread lightly in a labyrinth of bits and bytes, stepping beyond the velvet ropes and peering beyond the forbidden gateways. They desire to see past the obvious smoke and mirrors set before the masses, and see the inner workings and protected secrets of society. Hacker is a very broad term in present publications and media coverage. Considered by many to be extremists in this age of computers and technology, they stand apart from the average computer user. There is structure, organization, and development which occur in this isolated faction. Like any social group, there are classes that divide and affiliates who stand out. The majority of this congregation is virtually harmless with only a driving force of curiosity behind them. But unfortunately, the individuals to be noticed recently are deemed destructive. Technology today is evolving in leaps and bounds. Electronic Commerce and the digital marketplace have reached and surpassed several pioneering stages. But in the race for the technological superiority, security measures have been disregarded or often overlooked. Many times only primitive measures have been taken to protect information from the "lawful" abiders, but just as often, security has been totally absent. Creating a secure environment is a tedious undertaking, and interfaces to this environment are constantly changing, so understanding it will always fall distant to its creation. This in turn delivers many individuals a quest to explore and exploit. In the past, technology has developed further to meet the needs of the industry. With this breech of security, hackers have helped to fuel the creation of innovative advancement and development. "Malicious criminal activity" has become the common scapegoat for so-called security experts. An effective way, believed by them, to easily put the blame on the individuals they consider offenders. A "direct violation of privacy" and "breach of property" are considered the definitive in hacker related crimes. Many of their actions and nature of expression may have caused humiliation of some "greater power", and the hackers very existence signifies a genuine believed threat which authorities have no concept how to control. Exposing themselves as the victim, power holders gain the publics' sympathy and characterize these hackers as vandals. Ignorance is bliss. And for those who hold this lack of knowledge, many opinions have been fashioned to an uneducated slander. Holding these judgments, society has already decided the line between guilty and innocent before understanding the supposed crime. The voices of the blamed are silenced and only the tainted media's vocalization give a misguided interpretation of these misunderstood intensions. The net has increasingly been transforming from a position where freedom of speech is dominant to one which revolves around the needs of industry. With the advent of new technologies constantly arising, the Digital Underground will continue to thrive and develop. Not all hackers should be viewed as vigilantes, nor should they be disregarded as passive. Understanding the problem must occur before a realistic solution can be developed. Resources: www.hackcanada.com www.2600.com 2600 - The Hacker Quarterly //bp2k// --___-- 'She makes me wait' These thoughts of you, once fleeting, have come to fill my days with fruitless longing, the sterile desires of long-distance wishes, and wet dreams in a bed barely large enough for one. Here is what I remember: a dark nightclub, a red streak, vertical, with bare arms like olive branches, the first time you smiled, blessings bestowed by your gilded tongue, nervous laughter, tender kisses, slender fingers tangled in hair. Then, tea, and courtesies, and restrained want, and the impersonal warmth of comforters and socks, his flesh against mine while you lay, alone, on the couch, and goodbyes - too brief - in the morning. I miss the dance of your eyes. Written by: Susan Larcombe ++ ++ ++ `Nannou` × ÿÓÕ×ÙØÚ½ ×ø Øâ ÎÀ׸¸¸»» ÚÚÙØ ÑÏÂÁÖËÍÎл Ú××ÓÕÒÐà Ô× ¹ × ÿÓÕ×ÙØÚ½ÇÅ× ¹ ظ½Ã¸ÚØâ××× × ×ÎÌËÙº××ÖØÕÒ¹× º ¹ ÿÓÕ×ÙØÚ½ - The Clone --_ --_ --_ 'I want you, Vetesgirl' by: Anonymous March 13, 2000 Oh my god, vetesgirl, I wish you were a testesgirl. Sucking testes left and right, sucking testes, day and night. You are such a wrinkled hag, I really wish you'd suck my bag. I find myself quite perplexed, which wrinkle to stick my wang in next. Pumpin' hard I drop the hammer, and pretend that you're my gramma. Finally I find a way to win, I pop your teeth and stuff it in. Oh, my chowder churns and broils, cuz nothing stokes me like old goils. As I grope your flabby bum, and you beg me for my hot cum, what I need is to feel your pain, I crush your skull and fuck your brain. Bumping tissue harder, hard, oh my god, jiggling your lard. But alas I cannot cum, because you are so fucking dumb. *-%%$ 'Lil Jawa Hubbard' "'lil Jawa Hubbard, went to the cupboard, to felch his cats ass-bone... when he got there, it's sphincter was bare, so he pumped it full'a cock foam." - Anonymous -_#-_#-_#-_#-_#-_# 'Ravers' We are found in dark corners of the cities, rising only when the world is sleeping. We have found that which was tribal, deep in the shadows of our soul, and have remembered the ritual of dance. Once, long ago, we beat our drums, circling the firelight, and chanted beneath the sky and moon. Still we dance. Still we embark, as our ancient fathers did, upon the journey of the mind. Now we gather in the nightclubs, the vacant warehouses, and in the underground basements. Sometimes we revel out beyond the limits of civilization, in the empty wilderness where it is secret and we are free. We are the dancers, the dealers, the technicians. We are the lost children who have found family. It is the ancient ritual of gathering, the firelight replaced now by the flickering of the strobe and the electric sweep of the laser. And the music. The relentless thundering of that great beast that rides onward into the sunrise. Our guide will mold one electronic construct into another, crouching over machines that produce sounds so enormous that the mind cannot encompass them. Swirling, echoing, shattering the empty night, it is an experience of the body. It will carry us away, and we will not only hear the music but see it too. - Anonymous _^^___ A K-rad Toy the p0pe, 2000 well, I’m sitting here on the returning flight from my voyage to see the HC crew out in Edmonton. it was fun fun fun. Sunday, we decided to hit the flea markets. now, we have flea markets back in Halifax, but you would be very hard pressed to find any old school technology there. Edmonton is not like that. so me and dwr are walking around in one of the aforementioned flea markets (which one, I don't remember) and we come across this little booth chock-full of computers. not just any computers, but these crazy old squool computers. we saw a couple c64's, an Atari, and a Tandy trs-80 model 100. now, when I first started playing with computers way back when, I started on my dad's Tandy 1000's. RCA monochrome monitor. 83 key keyboard. analog joystick ports. all that fun stuff. I played with this and other Tandy’s for quite a few years. they always have a special place in my heart. seeing this t102 made me feel all nice and special inside. heh. hell, I just thought it was cool that I found a laptop made in nineteen-fucking-eighty-three. I paid $20 for it, and immediately had to fend off $25 offers from dwr. I started playing with it immediately, promptly discovered that it had a basic compiler (k-rad). upon returning to cyb's, I proceeded to look upon the vast wealth that we know as the internet to find out what, if anything I could do with this piece of hardware. what I found was nice. first off, it has a built in 300 baud modem. now, remember when your at a fucking payphone, chances are you ain't running too many bandwidth-intensive applications. 300 baud is fine for wardialing, or dialing up yer local dod w.o.p.r. or whatever. the second cool thing about it is also the built in modem. this built in modem has two modes : DIR and ACP. DIR stands for Direct, which is when you plug it directly into the phone line via the optional dongle. ACP stands for Acoustic coupler. yes my friends, this means that with either spending ten bucks or making the thing yourself, you have a portable wardialer/w.o.p.r penetrator (*eg*) that runs on 4 AA batteries. it also has some other neato things. there's a plug for a cassette deck, as well as for a printer and, get this, a barcode reader. as I mentioned earlier, it has a built-in basic compiler, and it has standard 32k of memory :). according to the manuals, if you use it for about an hour a day, you get bout 20 days out of it, if 4 hours a day, 5 days (love that math). there's also a plug for an ac adapter. and, a slot so you can burn your own ROM’s for it. one thing that I haven't researched too much about is the BUS plug. the thing has a 40-odd pin plug at the back used for adding such things to the system bus as a floppy drive or an external LCD monitor. probably other neato things if you are good at electronics and m4d basic coding. not bad for 1983, eh? +-(:-) ¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥-¥ Technical Documentation -- | Basic NAM Programming | By: The Clone Date: Sunday March 26, 2000 1) This is test mode NAM Programming: - Turn phone on - FCN,0,0,*,*,8,3,7,8,6,6,3,3,RCL - # to get to main test screen - 55# to get to nam programming - After done # to main screen and 01# to reset phone 2) Normal NAM Programming if factory system code is the default: - Turn phone on - FCN,0,0,0,0,0,0,0,0,0,0,0,0,0,STO (13 zeros) - * to move through NAM programming menu. - To exit go back to the first NAM programming stage and hit SND END http://nettwerk.hypermart.net webmaster@nettwerk.hypermart.net **** ------------ Lame Theatre Hack Text! ------------ by: KAN0 [ http://www.internettrash.com/users/kan0/ ] warning:: this is DEFINATELY lame... I warned you! Picture this: you're in the movie theatre, minding your own business, and some fat bitch sits in front of you, and people sit behind you who have the worst laughing voices in recorded history! Sound familiar? I thought as much. Here's how you can fix that problem nice and simply every time you go to the theatre. You have a jacket, and so does your date, right? Place them into the two seats directly in front of you, reserving these seats for your imaginary friends who are only in the washroom. Make sure any person wishing to sit in those two seats know they're reserved. You have to, of course, sit where there's two seats free in front of you, and it's easier to do the less crowded the theatre is. You could even go as far as to place articles of clothing all around you in a square to rid yourself of any other annoying people, but that could get a tad suspicious. Name tags on the jackets are an idea, and so is extra popcorn where their seat is, to give the impression that people have been there before. This whole thing gets difficult when the theatre starts to get crowded. And, people please, do not use your girlfriend's bras or panties, those tend to me a tad conspicuous. Thank you! -KAN0 $_###_# The Complete Guide to the Elcotel Payphone ¥ By: The Clone ¥ March 31, 2000 ¥ http://nettwerk.hypermart.net ¥ webmaster@nettwerk.hypermart.net _/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/ _ -_- _________________ Table of Contents _________________ * Introduction * Elcotel's International Corporate Customers * Elcotel Payphone Investment [Canada] * Hardware Details [9520C] * Components Catalog * Physical Administration * Elcotel 9520C Phone Seizing Problems * Remote Administration * Central Administration Computer(s) [9520C] * Web-site References * Payphone News: GrapeVine in Canada * Upcoming Projects * Credits * Conclusion _ -_- - Introduction - It's the year 2000 and I can say that without a doubt we are finally in the midst of a payphone revolution. For a greater majority of the 90's, there have been dozens of so-called "break-throughs" in the tele- communications industry's payphone sector. Some of these breakthroughs helped to shape the way we live by finding simple solutions to our complex problems by making the way we communicate convenient, easier, and more efficient. One key player in the innovation of the international payphone market is a company by the name of Elcotel Corporation (NASDAQ: ECTL). Elcotel, based in Sarasota Florida, has rewired the Digital Age and the rules of marketing by creating one-on-one relationships between businesses and the consumers they are trying to reach. In this document I will be lecturing on a wide variety of subjects concerning Elcotel's products, ranging from the basics to the more advanced information. All the information contained in this document has been either researched and/or discovered by myself or my associate, RT. Please Note: I've made every attempt possible to be accurate, so if for some reason I made an error please let me know by e-mailing me the details - I'll try to take every e-mail into consideration. -- - Elcotel's International Corporate Customers - Elcotel has a wide variety of Corporate Customers it deals with on a regular basis, and not a hell of a lot of people are really aware of who these customers are. In this section I've listed off every Corporation that currently has an account with Elcotel, including their account numbers all in alphabetical order. Use this information in any way you wish, but use it responsibly and legally. ----------------------------------------------------------------------------- Account Account # ....... ....... ADITEL 1570101 AEC – SAUDI 1671701 AFRIC – MOROCCO 1500701 AMERICAN SAMOA 1682001 BARAINVER S.A. 1753001 BELIZE TELECOM 1505301 BERMUDA 1437501 CANADA PAYPHONE 1557701 CIMEX 1729501 COMTEL 1469701 CONECELL 1748801 DAEBONG 1760101 DATELCO 1738401 ENTEL 1682201 ERICSSON 1771701 GENESIS 1675601 ITG GROUP (IRELAND) 1739001 MKTC 1765801 MULTI-LINE 1612701 PALMETTO 1751101 PHILCOM 1628301 P T & T 1623601 QUADRUM 1246302 TELCEL 1751701 TELECTRONIC 1557401 TELEFONICA (MYSTIC) 1689401 TORTEL 1778001 TELEFONICA DEL SUR 1580301 TPPR 1729401 TRANSDATA 1520701 WCVC (Telefectivo) 1626301 [TOTAL = 31 International Corporate Customers (ICC)] --- - Elcotel Payphone Investment [Canada] - So you want to invest in an Elcotel payphone -- well you've came to the right place. In my humble opinion, Northern Telecom has somewhat of a monopoly on payphones/data terminals throughout Canada and I'd like to see some more competition from Canada Payphone Corporation. Available on Canada Payphones' web-site is a form that anyone (company) interested in purchasing an Elcotel series phone can do so by correctly filling it out. The form makes an inquiry about the following information: First Name: ____________________ Last Name: ____________________ Employer Name: ____________________ Employer Address: Street: ____________________ City: ____________________ Postal: __________ Province: ____________________ How did you hear of us? +*******************+ * Magazine * * Newspaper * * Television * * Referral * * URL/Search Engine * * Viewed product * +*******************+ How would you like us to contact you? +********+ * E-mail * * Phone * * Fax * * Mail * +********+ Please indicate telephone number where we can reach you: ____________________ At what time of day should we call you? +***********+ * Morning * * Afternoon * * Evening * +***********+ If you prefer to be contacted by fax, please indicate the number: ____________________ If you prefer e-mail correspondence, please provide your e-mail address: ____________________ Site Description: __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ # of payphones required: ______ When do you require these to be installed? ____________________ How many payphones are currently at your location? ______ Would you like information on our Public Internet Terminals? ( )Yes (*)No Are you presently in a contract with your payphone provider? ( )Yes ( )No (*)Unsure Please list any specific questions or comments below: __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ A CPC representative will respond to your request within 72 hours. NOTE: Required fields are followed by a check mark. Reset Send This form can be accessed at the following URL: http://www.canadapayphone.com/contact/request.htm - Hardware Details [9520C] - [_ Full Size Image: http://home.edmc.net/~theclone/Elcotel/attsilver.jpg _] 9520C Features: Stand-alone operation, no expensive platform fees Line-powered High speed modem decreases transmission time, thereby reducing polling and programming costs Supported by Elcotel's state-of-the-art, PNM Plus (Default software; PollQuest) LCD (line-powered) display augments audible (bi-lingual) instructions Speed dial buttons offer convenience and additional revenues when prompted to service providers Multiple payment methods accept coin, credit card, debit card, prepaid card and coinless transactions Digitally recorded, bi-lingual voice prompts provide user-friendly instructions in culturally diverse locations such as airports Standard integrated volume control button ensures ADA compliance Remotely downloadable operating system and site operational files Call diagnostic events recorder enable remote diagnostics and troubleshooting Flexible call routing One year warranty Handles unique call situations using priority parsing Internal Alarm reports (coin jam, vandalism, handset, inactivity, cash box level, etc.) Detailed call records management Full spectrum of answer supervision Modem telemetry for programming and cash box/alarm monitoring via computer Voice telemetry for programming and monitoring through the phone's keypad Specifications: --------------- Power: Telephone line-powered; 48 VDC line voltage (on hook), 23 mA loop current (off hook) FCC Registered Ringer Equivalency: 0.7B Chassis Weight: 2 lbs. Phone Weight: 49 lbs. 14.4 modem Handset: Hearing aid compatible Nine Button "Matrix" speed dial keypad Japanese Model Chips Motherboard Protected by Cash Box IDE Interface ABA magnetic Strip Card Reader Miscellaneous Hardware Information: ----------------------------------- Component Movement ------------------ Q: "What's that crazy noise I hear when I hang up the 9520C?" A: That noise you hear when you hang up the phone, is simply the Physical Component Switch (PCS) resetting the line after recognizing a dialtone. In addition, if you were to open up a 9520C model Elcotel and look inside, you would see a button which operates the Physical Component Switch labeled 'do not press'. Hmm... I've always wondered what would happen if I were to press it. ;-p Ring Back --------- All Elcotel 9520C payphones have a built in ringer though only approximately 10% of them actually ring when you call them up. A simple way to test if the 9520C phone you're using is part of the "10% ringing bracket" is to call it (number located on the phone) from another payphone next to it. If there isn't another payphone close to the Elcotel, which is not uncommon (marketing reasons), just use your cell phone and call the line up to test if the 9520C phones nearest YOU can ring! How many Nortel Millenniums do you know of that ring, let alone answer with a modem carrier when you call them up? NONE. .. For a description of the Elcotel Eclipse, read the 'Product Speculation' section on my document: 'CPC; Elcotel Eclipse Smart Phone' at: http://home.edmc.net/~theclone/Elcotel/cpc_eclipse.txt - Components Catalog - Below is a list of the payphone components you can purchase from Elcotel Corporation. I've listed off the URL's rather than the actual parts, because the web-site is constantly changing and new parts are being added almost daily. At the present time, on-line ordering isn't available from Elcotel's web-site. How to place an order: E-mail lperez@elcotel.com with your first and last name, your address, and the part number(s) of the products you wish to purchase. You will receive an e-mail back from her requesting credit card information. (So much for secure transactions, eh?) Kits ---- Kits of Parts - http://www.elcotel.com/Parts/product.asp?id=11 Loud Button Retrofit Kits - http://www.elcotel.com/Parts/product.asp?id=12 _-_ Major Subassemblies ------------------- 70C Dial - http://www.elcotel.com/Parts/product.asp?id=5 Coin Cover Units - http://www.elcotel.com/Parts/product.asp?id=4 Coin Dial Units - http://www.elcotel.com/Parts/product.asp?id=6 Coin Path - http://www.elcotel.com/Parts/product.asp?id=2 Control and Signaling - http://www.elcotel.com/Parts/product.asp?id=3 Handsets - http://www.elcotel.com/Parts/product.asp?id=7 Hopper Coin Assembly - http://www.elcotel.com/Parts/product.asp?id=1 _-_ Replacement Parts & Accessories ------------------------------- Parts & Accessories - http://www.elcotel.com/Parts/product.asp?id=9 _-_ Security Devices ---------------- Doors, Locks & Other Phone Security Devices - http://www.elcotel.com/Parts/product.asp?id=9 _-_ Tools ----- Tools, Gauges & Materials - http://www.elcotel.com/Parts/product.asp?id=10 _-_ - Physical Administration - Physical Administration of the Elcotel Payphone has got to be the most exhilarating experiences in the Research and Development of the Elcotel Payphone. Using this brand new hi-tech equipment, learning the ins and outs, hacking it, and documenting it all as a pioneer explorer is absolutely incredible. As noted in the 'Hardware Details' section above, the Elcotel 9520C contains two alarms to help detect vandalism and to help discourage theft of the equipment. The main alarm is within the actual phone itself, and if set off for a various reason will send a distress message to the central NCC computer at Canada Payphone Corporation. Canada Payphone if you don't know, is our country's lovely distributors of Elcotel Payphones. Canada Payphone, located in Burnaby British Columbia, will receive this distress message on their computers which then automatically register everything about the phone (including the location). Canada Payphone will then contact either a security company which was contracted by them, or AT&T security who run their data/voice lines. Several minutes later, either the contracted security company or AT&T will take a stroll on by to the premises and investigate the matter. Big trouble for the guy who set that alarm off! :-/ -- Hired contractors for Canada Payphone routinely do physical administration on the phones - installing, programming them, collecting the money, and everything and anything that they are required to do in their job description. Because these contractors are usually lonely guys who have to run around all the time working with machines, they long for human interaction. That is how my associate RT was able to snag some useful information. All he did was walk up to the guy fixing the phone and started a conversation with him. In a calm manner, RT asked several questions about the phones which the contractor was glad to share with him. The information he gave RT has been added to various sections of this document, and for that we THANK HIM. :) -- Alarm PIN Information --------------------- Disabling the alarm on the Elcotel series phones, is relatively simple. What you're required to enter is a three digit PIN, which if correctly entered, will turn off the local alarm in the phone. This means that the static connection from the phone to Canada Payphone's NCC computer in Burnaby BC will be cut off. However, if you enter an incorrect PIN you'll get an error message on the display. (1) How do I disable the alarm? - By picking up the receiver on the phone, pressing #, and entering the three digit PIN. (2) How do I know I'm doing it correctly? - You'll know you're doing it correctly when you see ### on the display... the ### represent the PIN. If you entered the right PIN, the display message will say "OK". (3) What is the PIN? - Canada Payphone, (being the obvious guys that they are) decided to choose a PIN code that would be easy to remember so they picked 'CPC' as the PIN code. CPC standing for Canada Payphone Corporation, wh00p. (4) How do I enable the alarm again? - Pick up the receiver (if it was hung up) and type #CPC. - Then hang up the receiver and try to wait for at least twenty seconds before using the phone again. Why? You have to give the phone some time to reconfigure itself. - You'll know you can use the phone again when you hear the components in the Elcotel shifting. -- Administration PIN Information ------------------------------ The benefit of Physical Administration over Remote Administration is that you're not required to enter an ID of some sort before entering the PIN. What you're required to enter is an eight digit PIN, which if correctly entered, will allow you to open the phones' case granting you full access to the Elcotel's administration system. Giving you the ability to: - empty out the cash box - change screen messages - administrate rate tables - see how many calls were made with the phone in a given time period - see how many days the phone has not been in use - debit card information - several security parameters - etcetera -- - Elcotel 9520C Phone Seizing Problems - 9520C Phone Seizing Problem #1 ------------------------------ - On the Elcotel 9520C model phones which haven't been upgraded with the the new "fool-proof chip" have a severe flaw; Recently Canada Payphone decided that it would have its calls routed through AT&T's switching system instead of their own. The reason for this may be due to AT&T's size and ability to handle several calls without getting the 'bottle-neck' problem like Canada Payphone may have had. Now due to this change-over, a problem occurred with the 9520C model Elcotel's causing a line-seizing problem. Essentially this problem would allow a phreaker to exploit it to make as many free local phone calls as they wished. This is how it's done: - Pick up the receiver - Enter 25¢ for the call - Call someone, and be sure they hang up the telephone after the call is completed. - The line will not be seized at this time, the mouthpiece will not be muted, but the keypad will be disabled. - With the receiver still in your hand, place your tone dialer on the mouth piece and begin to punch in a phone number or play the pre-programmed DTMF tones. Either way should work successfully. Remember that this trick will not work on ALL 9520C series Elcotel payphones. ONLY the 9520C's that haven't had their chip upgraded to prevent this type of fraud will work. ++ Note: Sometimes when dialing a number with the 9520C phone you will get a number that is either 'Not In Service' or 'Cannot Be Completed', the line might not hang itself up. In this case, you could use the same techniques documented above to exploit the seizing problem and make free local calls. ++ 9520C Phone Seizing Problem #2 ------------------------------ - On the Elcotel 9520C model phones which have been upgraded with the the new "fool-proof chip" have a severe flaw; The new chips in the Elcotel 9520C's apparently fixed 30% of the phones in Canada which allow the use of a tone-dialer to make "free local calls" when a line doesn't seize properly. The newer chips apparently do not allow the use of a keypad or DTMF tones in the chance that the line does not seize after a call is completed, thus securing the flaw. However, there is a way around the newer chips' "security features". If done correctly, the trick will allow a phreaker to exploit a different type of line seizing problem unknown by the Telco and unrecognized by the newer 9520C chips. This is how it's done: - Pick up the receiver - Dial '611' (don't worry it's toll-free) - Immediately after, press the bi-lingual button (English to French) located next to the phones' keypad. If done correctly, the payphone will reset causing the connection through AT&T's (the CO) SS7 based switching to end. - At this point you can use the keypad to dial any local number you wish. - Or use a tone-dialer by placing it on the mouth piece of the receiver and begin to punch in a local phone number, or simply play the pre-programmed DTMF tones. The only explanation I have for why the Elcotel 9520C resets the line causing a seizing problem, is due to Elcotel's inability to develop a chip that prevents various types of payphone fraud. If Elcotel can simply keep its promise of developing so-called "fraud resistant" payphones by having regular security audits before they ship their products to their corporate customers, then they wouldn't have to worry about lost revenue caused by phreakers who abuse these vulnerabilities. It's only common sense, RIGHT PEOPLE?! :) - Remote Administration - In my previous document titled 'CPC; Elcotel Eclipse Smart Phone' I gave mention about how one could remotely administer a payphone as long as they had the proper knowledge to do so. I briefly explained that you'd be required to have the payphones' uniquely assigned number, the software to administer it and the ID/PIN to do so. In the document I mentioned that once inside the system you'd have the ability to change rate tables, change scrolling messages, turn the payphone on, etc. It's been five months since that document was written, and the information that I gave was only general and didn't give specific system details. What have I discovered/accomplished since then? ----------------------------------------------- %% Payphone Numbers %% - I now have a list of several Elcotel 9520C payphone numbers which several people have helped me compile. At the moment I have Canadian payphone numbers from Calgary, Edmonton, Vancouver, and Victoria. The number of payphones listed so far is in the twenties, and it keeps on growing. The document (Elcotel CPC 9520C; National COCOT Number Compilation) can be seen by visiting: http://home.edmc.net/~theclone/Elcotel/elcotel_compilation.txt %% Software %% In December of 1999, I started to get into the software side of it all and posted several different Remote Administration programs on Nettwerked for download. The programs made it easier for the phreak and hacker to get into the core of the Elcotel system without worrying about having to search for them. PNM Plus is a simple stripped down Administration Tool which can be used on the Elcotel. The minimum requirement however is that you have Windows 3.11. Download: http://thehomeworkpage.tripod.com/pnmdemo.tar.gz - PollQuest Version 1.6.0 (Commercial Release) or 'International Payphone Network Management System' is a nice full software package (beta) used for administering the Elcotel, and is the default program used on the 9520C models. Download: ftp://www.elcotel.com/beta/190_158991 - Other software packages to look for: * Coin Net - http://www.elcotel.com/Products/software_detail.asp?id=8 * Expressnet - http://www.protelinc.com * PNMPLUS Lite - http://www.elcotel.com/Products/software_detail.asp?id=7 * Pronet - http://www.protelinc.com/PROTELInt/pronet/fpronet.htm * Telelink - available for download at http://www.ernesttelecom.com %% Remote Administration %% ID -- When connected to the Elcotel Payphone remotely, you'll be prompted for an Identification number. Now from what we're aware of, the ID numbers are assigned differently in accordance to the location of the payphone. Also, from what we were told by Elcotel installers (they're great for insider information) the Elcotel Remote Identification numbers range from 8000 and up. Knowing this, we can presumably say that all ID's are programmed to be four digits - or at least four digits by default. PIN -- One hunch I have is that the PIN alpha-numeric codes used for Remotely Administering the Elcotel payphones are exactly the same number of digits (8) one would be required to enter if they wanted to carry out Physical Administration. Remote Administration PIN codes using a Canada wide default, are programmed into all Elcotel Payphones? Perhaps, and the assumption isn't too broad either if we consider there is a default PIN used for physically disabling the Elcotel alarm (see Physical Administration). %% Software Options %% Previously I gave reference to Rate Tables, but the information given was a tad too general and didn't talk in enough detail to help the reader clearly understand what they'd be in for once they connected to the payphone remotely. Below is the actual table options from one of the many Remote Admin Software C programs accessible and fully available on my preliminary archive: http://home.edmc.net/~theclone/2nd_gen/c_files/c_scripts.html Option info OPTION FILE ........=############ (####) Next Date Phone Call In =!%%/%%/%%! RATE FILE ..........=############ (####) Next Time Phone Call In =!%%:%%! EXCEPTION TABLE .....=############ (####) No. Days Bump Call In =## LOOKUP TABLE .......=############ (####) POLL INTERRUPT DISABLE ..<->#### DIAL STRINGS .......=############ (####) Enable History logging ..<->#### RATE OVERRIDE ......=############ (####) Enable CDR [UP+CLEAR] ...<->#### CCR TABLE ..........=############ (####) Cash Box records to save ..=## VOICE FILE .........=############ (####) Days for no activity ......=## IPIN TABLE .........=############ (####) Nickel equiv. for full CB =## SECURITY PARAMETERS =############ (####) DEBIT CARD TABLE ...=############ (####) DISPLAY option on ph.....<->#### Browsing over this table, we see there are so many different options. Not only that, but the options available are surely useful for anyone wishing to collect information on Canada Payphone customers. - Central Administration Computer(s) [9520C] - All Elcotel 9520C series phones are pre-programmed to collect statistics about the amount of money they made, how many calls were placed (and for how long), how many days the phone has gone without use, and so on. You'd wonder how Canada Payphone would get this information, right? What they have done is programmed all the 9520C Elcotel's to directly send all its statistical information to the headquarters of Canada Payphone via modem - 14.4 data-transmission twice or more a month. The headquarters, in Burnaby British Columbia, have a central administration computer (or computers) which store the history every 9520C payphone statistic ever generated within Canada. If you were wondering what specific number the payphone calls in order to send the statistics, the carrier number is (604)-717-6532. When you call that number up with the Elcotel 9520C phone, you are given a credit of between 5-20 cents - on the display timer which usually counts the number of minutes a user is on the phone was instead counting down from 40 minutes. Which brings me to the assumption that the maximum amount of time it takes for the 9520C to send all of its statistical information to the HQ is approximately 40 minutes in length. - Web-site References - Useful Sites: Canada Payphone Corporation: http://www.canadapayphone.com/ Elcotel Coinless Services: http://ecs.elcotel.com/ Elcotel Coinless Services Overview: http://ecs.elcotel.com/overview/index.htm Elcotel Telecommunications: http://www.elcotel.com/ Hack Canada (Our Local Telco): http://www.hackcanada.com/telco/index.html Nettwerked (Elcotel Research [and Development]): http://nettwerk.hypermart.net/files/index.html#Elcotel_Research - Payphone News: GrapeVine in Canada - Press Release: http://www.elcotel.com/ectl/GrapevinePressReleases/BassPressRelease.htm Contacts: Michael Boyle Elcotel, Inc. (941) 758-0389 George Stolpe GWS & Company, Inc. (941) 925-0418 ELCOTEL, INC. TO PROVIDE NEW GRAPEVINETM NETWORK TERMINALS TO ALL BASS HOTELS & RESORTS PROPERTIES IN CANADA Through Agreement With Canada Payphone Corporation, Elcotel To Deploy Up To 10 Interactive Terminals In Each of 230 Bass Hotels and Resorts Properties SARASOTA, FL, January 20, 2000 Elcotel, Inc. (NASDAQ: ECTL) announced today it will deploy its interactive GrapevineTM network terminals in all 230 Bass Hotels & Resorts Properties in Canada, including Inter-Continental, Crowne Plaza, Holiday Inn, Holiday Inn Express and Staybridge Suites by Holiday Inn properties. Each hotel and resort will have up to 10 state-of-the-art GrapevineTM terminals installed. The contract is the latest development in Elcotels previously announced agreement with Canada Payphone Corporation (CPC) to purchase 45,000 GrapevineTM network terminals and services valued in excess of $125 million over five years. CPC has the exclusive rights to deploy and market the GrapevineTM network terminals in the Canadian market in an Alliance Partnership with AT&T Canada. CPCs agreement with Bass Hotels & Resorts Properties is a major step forward in the acceptance of GrapevineTM as the public communications portal of the 21st century, said Michael Boyle, president and chief executive officer of Elcotel. Over the coming months, the Canadian market will be among the first to access the power of personalized content, information services and e-commerce capabilities from a public phone. We are pleased to partner with both Bass Hotels & Resorts and CPC in this major evolution of how, when and why consumers use public communications to make their lives easier. Bass Hotels & Resorts is pleased to offer its customers state-of-the-art public communications, said Les Gable, senior manager, hotel telecommunications, for Bass Hotels & Resorts. We believe this will greatly enhance our guests experience and further position Bass Hotels & Resorts as the premier choice for travelers and business professionals alike. GrapevineTM combines traditional payphone capabilities with sponsor-paid advertising and content, e-commerce and personalized information services from the Internet in a public access setting. The GrapevineTM terminal network is powered by e-PrismTM, Elcotels comprehensive system for back office support and content management. This proprietary system manages the terminals and is designed to tailor advertising messages and future sponsor-paid content for each individual terminal Elcotel, Inc., based in Sarasota, Florida, is a leader in providing public access telecommunications networks and management services for both domestic and international wireline and wireless communication networks. Visit Elcotels corporate website at www.elcotel.com. With over 2,800 hotels and 450,000 guest rooms in more than 90 countries and territories, Bass Hotels & Resorts has an established, international brand-name property to suit every guests service, amenity and lodging needs. Each year, more than 150 million people stay at a hotel or resort bearing one of the Bass Hotels & Resorts lodging brands. Bass Hotels & Resorts is the hotel business of U.K.-based Bass PLC. Bass PLC American Depository Receipts trade on the New York Stock Exchange under the symbol BAS. The following are some of the service marks owned by Bass Hotels & Resorts, Inc., its subsidiaries or affiliates: Holiday Inn®, Crown Plaza®, Holiday Inn Select®, Holiday Inn Garden CourtSM, Holiday Inn SunSpree® Resorts, Staybridge SuitesSM, Holidex®, Priority Club® Worldwide, Inter-Continental®, Forum®, and Six Continents Club®. Bass Hotels & Resorts Inc. offers information and reservations capability on its pages on the World Wide Web www.holidayinn.com for Holiday Inn hotels www.hiexpress.com for Holiday Inn Express hotels, www.crowneplaza.com for Crowne Plaza Hotels and Resorts, www.staybridge.com for Staybridge Suites, and www.interconti.com for Inter-Continental Hotels and Resorts. Canada Payphone Corporation is the leading national competitive pay telephone service provider (CPTSP) and the exclusive provider installing AT&T Canada branded payphones and interactive public Internet kiosks across Canada. CPC along with its Alliance Partner AT&T Canada provides new and innovative high quality payphone products and services. Canada Payphone Corporation with offices located in Toronto and Vancouver is a public company traded on the CDNX symbol CPY. For more information, visit CPCs web site at www.Canadapayphone.com. Statements contained in this release may contain forward-looking information regarding the Companys plans, projections, or future performance, which involve certain risks and uncertainties that could cause the Company's actual results to differ materially from those expected by the Company. These risks and uncertainties include the risk of adverse regulatory action affecting the Company and the Company's customers, risk of competition, risk of obsolescence of the Company's products, and other uncertainties detailed in the Company's filings with the Securities and Exchange Commission. - Upcoming Projects - In the upcoming months you can expect me to be involved in several Elcotel projects, which for the most part will coincide with topics or past projects written in this documentation. The upcoming projects in this section are only a general idea of what is to come in the near future. My ideas and plans change without warning, meaning that I cannot guarantee anything that I boast about in this section. ` Audio samples to be added to Nettwerked [The Clone] ` Elcotel Central Administration datatapping (A "how to" manual) [The Clone] ` Miscellaneous Elcotel information to be added to this document [RT/The Clone] ` "PROJECT: Elcotel 9520C skan of (780)-420-9XXX" [The Clone] ` + much more! - Credits - I'd like to personally thank my associate 'RT' for working with me to learn everything there is to know about the Elcotel series phones, and of course for his contributions to this file. - Conclusion - In conclusion, I'd just like to note that this document will be updated periodically as I learn more about the Elcotel payphones' architecture and its security parameters. As Elcotel Telecommunications develops more technically advanced communication devices (ie. GrapeVine - 05/00), you can be damn sure I'll be the one hacking it and writing another document to share with the rest of the phreaking community. A N E T T W E R K E D P R O D U C T &&_&&&&_&&&&&_&&& Conclusion -- Another Zine successfully completed... though what really is success? Is success mearly in the eyes of the successor, or is it something deeper than that? I mean, at first I'm always satisfied with the way my document or zine looks but months later I look back at it and the feeling of "success" quickly disappears - it's sad really. After I edit this zine, I'm never reading it again... THE END (yeah yeah there will be another K-1ine issue (#4) coming whenever; so until then... don't play with your food or your wiener.)