The Nortel Millennium Payphone Repository

raw.githubusercontent.com_muccc_millennium_master_pics_devices_phones_white_bg.jpg This namespace is dedicated to document the infamous Millennium payphones which can be found all around North-America.

Table of contents/pages

History

Initially produced by Northern Telecom (better known as “Nortel”), all Millennium-related assets had been bought by Quortech in March 20001) which continued to produce, sell and service the phones. As of 2012, Quortech has disappeared from the public2) and seems only to continue to produce said phones while all customer-facing operations are carried WiMacTel - which also happens to own and operate since March 2014 all of Canada's payphones3).

There is plenty of information floating around the internet regarding Millennium payphones, but most websites only offer a small piece of the available information. As the whole phreaking-scene is quite old, too, websites tend to go offline and with it some files and information missing. We'll try to provide you with a complete rundown of information and files.

Please note, that information and files provided in the repository - https://github.com/muccc/millennium are generally provided “as is” and not checked for facts.

Information that can be found here on the Wiki should ⚠ be correct - but please feel free to correct any errors you may encounter.

A list of devices in the Millennium-range can be found here.

A list of boards/PCBs, that have been taken out of one phone and analysed, can be found here.

Contrary to many - if not pretty much all - payphones (either COCOT4) or BOCOT5)), the Millennium phones don't just work out of the box. While other telephones may be configured on site with help of an On-Screen-menu, voice prompts or even remote-telemetry, the Millennium phones can only be operatedThat is not 100% correct - keep reading… when being able to make a connection to the so called Millennium Manager. This backend provides the phone with configuration and rates and also receives feedback from the phone like alarms or maintenance-requests.
Phone, meet Millennium Manager
The Millennium Manager is said to cost around 1 Million US Dollars if to be bought and there are not many known running instances of it - one is at WiMacTel/Quortech. Price aside, another reason for this might be, that the software only runs on HP Tandem-servers

The payphones connect to the Millennium Manager (also referred to as the Network Control Centre or NCC) via a built-in modem. The normal data connection speed is 1200 baud using 8 data bits, 1 start bit and no parity (8N1), via a standard Bell (V.22) handshake.

As mentioned before, there is an exception to the rule: Nortel produced a few so called “Demonstration Units” (also marked as such on the sticker on the rear) which are indeed capable of working without a connection to the Millennium Manager. Whether is achieved by providing the phones in question with a custom firmware or introducing an additional control-PCB is unknown and subject of current investigation. According to a former Nortel engineer, “demo code” still needs to be loaded on each device, as even on demonstration units the configuration is stored in RAM which is kept alive by a super-capacitor. However, we have found that this information is not true. Demo-Code is a special version of the Firmware (residing in the main-firmware-chip U2), which is quite similar to a regular Firmware - except that it features a few more service-menus (for example to for setting the time). Additionally, the whole configuration-tables, that would normally be downloaded from the NCC are stored in the secondary firmware-chip (X1) and copied to RAM at runtime.

Those phones accept either money or special encoded magstripe cards. It is highly probable, that the phones reading the cards are only looking for a pre-programmed verification-string on the card in order to deem them “valid” - phones connected to a Millennium Manager can also be programmed to do this as a preliminary verification before calling the backend to validate the card.

There are mentions of a tool called the Millennium Maximizer - a handheld device that plugs into the phone and allows on-site programming of the features like the advertising-texts or quick-dial-buttons.

There are no known images or details of this device. After having a call with one of the former Nortel-engineers6) it is confirmed, that there is no such thing as “On-Site programming”. The Millennium Maximizer is an application, that runs on the Tandem-server. While the Tandem-servers run the Millennium Manager, the “backend” where the phones connect to, all operations are done on regular workstations using the Millennium Maximizer application (Version 4.1 running on upto Windows NT4.0). You could think of the Maximizer as a frontend to the backend-server.

In the telecommunications industry, “craft” refers to “a craftsman of telephony” and is usually used informally to identify telephone technicians. For this reason, the default access code to access maintenance functions on the Millennium payphone is CRASERV (2727378), short for “Craft Service”. In order to access this menu, a PIN is also needed. Note that this access code can be changed if desired via Millennium Manager. The subsequent menu options allow the technician to perform an install, tests and other maintenance-related tasks. A list of all allowed PIN-codes is provided to the phone by the Millennium Manager when downloading its configuration. While CRASERV may still have been used around November 2014 by Telus, it has been heard that Bell Canada changed it to GODOPIT around December 2004. In any event, these codes are changed often to protect company-owned assets.

Op Codes or (operational codes) are used to provide extra flexibility for maintenance and field testing. Contrary to popular belief, op codes are NOT universal in function and are company-specific. In other words, op codes will only perform a specific task within an administering company's programmed parameters. A telco can choose to assign an op code as either a notification, a request or test initiator. As the technician enters op codes via the payphone's keypad, these are then sent to the telco staff via Millennium Manager's database. The payphones, at that point, do not do anything else, other than transmit the inputted numbers. Once received and depending on how the op codes are defined, certain tasks are then performed or initiated. As an example, a telco might choose to define op code 344 to be a notification that the payphone's booth requires cleaning. When the technician enters this opcode as part of his or her routine visit (for example, to collect deposited coins) the telco will receive this message and send a cleaner out to do the cleaning. Similarly, an op code can be defined to flag a certain repair to be made. If the op code is defined as a test initiator, for example code 431, then the Millennium Manager will perform the specifically programmed task, for example, a call back test.

A leaked manual, supposedly stolen from a Telus-Facility, offers a list of some Telus Op Codes that can be entered directly on their payphones to access certain test and/or functions (chapter 4 and 5); these codes are specific to Telus.

  1. Extracting the standalone-firmware of a demonstration unit and make it available to other phones
    1. Done - We have a number of “demo-code”-firmwares at our disposal. Those can however not be made available to the public
  2. Verify rumour, that someone already recreated a Millennium Manager
    1. Verified! Ecuadorian Telco “ETAPA EP” has their own fake Millennium Manager, which is the result of a Thesis written by RODAS RODRIGUEZ FERNANDO ANDRES and ZEA GARCIA SANTIAGO XAVIER.
    2. Further verified: Howard Harte has made an open source one here.
  3. Recreate our very own Millennium Manager
    1. In Progress - We have a working (but serving static data) proof of concept (first successful provisioning happened on November, 13th 2016. Proof)
  4. Create our own coinsets for the coin validators
    1. Done - See Coin Validator for a description of how to do it.
    2. Hardware and Software for easier use needs to be done

  • millennium/start.txt
  • Last modified: 2024/01/28 14:39
  • by martin