| Both sides previous revision Previous revision Next revision | Previous revision |
| millennium:start [2016/11/13 18:41] – martin | millennium:start [2024/01/28 14:39] (current) – martin |
|---|
| | ====== The Nortel Millennium Payphone Repository ====== |
| | |
| {{ https://raw.githubusercontent.com/muccc/millennium/master/pics/devices/phones_white_bg.jpg}} | {{ https://raw.githubusercontent.com/muccc/millennium/master/pics/devices/phones_white_bg.jpg}} |
| This namespace is dedicated to document the infamous Millennium payphones which can be found all around North-America. | This namespace is dedicated to document the infamous Millennium payphones which can be found all around North-America. |
| |
| ====== History ====== | ====== History ====== |
| Initially produced by Northern Telecom (better known as "Nortel"), all Millennium-related assets had been bought by Quortech in March 2000(([[http://www.thefreelibrary.com/QUORTECH+ACQUIRES+NORTEL+NETWORKS'+MILLENIUM+BUSINESS+ASSETS.-a061565798]])) which continued to produce, sell and service the phones. As of 2012, Quortech has disappeared from the public(([[https://web.archive.org/web/20120515000000*/http://www.quortech.com]])) and seems only to continue to produce said phones while all customer-facing operations are carried [[http://www.wimactel.com/|WiMacTel]] - which also happens to own and operate since March 2014 all of Canadas payphones(([[http://www.wimactel.com/wimactel-finishes-the-play-and-is-now-canadas-only-nationwide-provider-of-pay-phones/]])). | Initially produced by Northern Telecom (better known as "Nortel"), all Millennium-related assets had been bought by Quortech in March 2000(([[http://www.thefreelibrary.com/QUORTECH+ACQUIRES+NORTEL+NETWORKS'+MILLENIUM+BUSINESS+ASSETS.-a061565798]])) which continued to produce, sell and service the phones. As of 2012, Quortech has disappeared from the public(([[https://web.archive.org/web/20120515000000*/http://www.quortech.com]])) and seems only to continue to produce said phones while all customer-facing operations are carried [[http://www.wimactel.com/|WiMacTel]] - which also happens to own and operate since March 2014 all of Canada's payphones(([[http://www.wimactel.com/wimactel-finishes-the-play-and-is-now-canadas-only-nationwide-provider-of-pay-phones/]])). |
| |
| ===== Why? ===== | ===== Why? ===== |
| There is plenty of information floating around the internet regarding the Millennium-payphones - but most websites only offer a small piece of the available information. As the whole phreaking-scene is quite old, too, websites tend to go offline and with it some files and information missing. We'll try to provide you with a complete rundown of information and files. | There is plenty of information floating around the internet regarding Millennium payphones, but most websites only offer a small piece of the available information. As the whole phreaking-scene is quite old, too, websites tend to go offline and with it some files and information missing. We'll try to provide you with a complete rundown of information and files. |
| |
| Please note, that information and files provided in the repository - [[https://github.com/muccc/millennium]] are generally provided "as is" and not checked for facts. | Please note, that information and files provided in the repository - [[https://github.com/muccc/millennium]] are generally provided "as is" and not checked for facts. |
| A list of devices in the Millennium-range can be found [[millennium:devices|here]]. | A list of devices in the Millennium-range can be found [[millennium:devices|here]]. |
| |
| A list of boards/PCBs, that have been taken out of one phone and analyzed, can be found [[millennium:boards|here]]. | A list of boards/PCBs, that have been taken out of one phone and analysed, can be found [[millennium:boards|here]]. |
| |
| ===== Inner workings ===== | ===== Inner workings ===== |
| ==== Regular usage ==== | ==== Regular usage ==== |
| Contrary to many - if not pretty much all - payphones (either COCOT((Company Owned Coin Operated Telephone)) or BOCOT((Bell Owned Coin Operated Telephone))), the Millennium phones don't just work out of the box. While other telephones may be configured on site with help of an On-Screen-menue, voiceprompts or even remote-telemetry, the Millennium phones can only be operated<sup>That is not 100% correct - keep reading...</sup> when beeing able to make a connection to the so called [[millennium:devices#millenium_manager|Millennium Manager]]. This backend provides the phone with configuration and rates and also receives feedback from the phone like alarms or maintenance-requests. | Contrary to many - if not pretty much all - payphones (either COCOT((Company Owned Coin Operated Telephone)) or BOCOT((Bell Owned Coin Operated Telephone))), the Millennium phones don't just work out of the box. While other telephones may be configured on site with help of an On-Screen-menu, voice prompts or even remote-telemetry, the Millennium phones can only be operated<sup>That is not 100% correct - keep reading...</sup> when being able to make a connection to the so called [[millennium:devices#millenium_manager|Millennium Manager]]. This backend provides the phone with configuration and rates and also receives feedback from the phone like alarms or maintenance-requests. |
| Phone, meet Millennium Manager | Phone, meet Millennium Manager |
| The Millennium Manager is said to cost around 1 Million US-Dollars if to be bought and there are not many know running instances of it - one is at WiMacTel/Quortech. Price aside, another reason for this might be, that the software only runs on [[wp>Tandem_Computers|HP Tandem]]-servers | The Millennium Manager is said to cost around 1 Million US Dollars if to be bought and there are not many known running instances of it - one is at WiMacTel/Quortech. Price aside, another reason for this might be, that the software only runs on [[wp>Tandem_Computers|HP Tandem]]-servers |
| |
| In order to connect to the Millennium Manager, the phones use their built-in modem, which connects at 1200 Baud using an unknown protocol. Marketing-material suggests, that this connection might indeed be done using X.25/Frame Relay (FIXME unverified). It is also rumored, that the connection doesn't use 8n1 but 5n1 instead (Baucode) (FIXME unverified). | The payphones connect to the Millennium Manager (also referred to as the Network Control Centre or NCC) via a built-in modem. The normal data connection speed is 1200 baud using 8 data bits, 1 start bit and no parity (8N1), via a standard Bell (V.22) handshake. |
| |
| ==== Stand-alone / Demonstration Units ==== | ==== Stand-alone / Demonstration Units ==== |
| After having a call with one of the former Nortel-engineers((Paul Pandel, with Nortel since 1986)) it is confirmed, that there is no such thing as "On-Site programming". <del>The Millennium Maximizer is an application, that runs on the Tandem-server.</del> While the Tandem-servers run the Millennium Manager, the "backend" where the phones connect to, all operations are done on regular workstations using the Millennium Maximizer application (Version 4.1 running on upto Windows NT4.0). You could think of the Maximizer as a frontend to the backend-server. | After having a call with one of the former Nortel-engineers((Paul Pandel, with Nortel since 1986)) it is confirmed, that there is no such thing as "On-Site programming". <del>The Millennium Maximizer is an application, that runs on the Tandem-server.</del> While the Tandem-servers run the Millennium Manager, the "backend" where the phones connect to, all operations are done on regular workstations using the Millennium Maximizer application (Version 4.1 running on upto Windows NT4.0). You could think of the Maximizer as a frontend to the backend-server. |
| |
| ===== Access-Numbers ===== | ===== Craft Access ===== |
| The leaked [[https://github.com/muccc/millennium/raw/master/manuals/nortel_millennium_text.pdf|manual]] - supposedly stolen from a Telus-Facility - offers a comprehensive, but probably not complete list of so OP-codes that can be entered directly on the device to access certain test and/or functions (chapter 4 and 5). | In the telecommunications industry, "craft" refers to "a craftsman of telephony" and is usually used informally to identify telephone technicians. For this reason, the default access code to access maintenance functions on the Millennium payphone is CRASERV (2727378), short for "Craft Service". In order to access this menu, a PIN is also needed. Note that this access code can be changed if desired via Millennium Manager. The subsequent menu options allow the technician to perform an install, tests and other maintenance-related tasks. A list of all allowed PIN-codes is provided to the phone by the Millennium Manager when downloading its configuration. While CRASERV may still have been used around November 2014 by Telus, it has been heard that Bell Canada changed it to GODOPIT around December 2004. In any event, these codes are changed often to protect company-owned assets. |
| |
| In order to access this menu, a password and a PIN is needed. The default password - if not changed in the Millennium Manager - is CRASERV (2727378). This default code used to initiate the installation-routine, if the phone never had a connection to the Millennium Manager (or forgot all its settings). Additionally, a PIN-code is needed. A list of all allowed PIN-codes is provided to the phone by the Millennium Manager when downloading its configuration. While CRASERV is still used nowadays (November 2014) by Telus-operated phones, Bell is said to have changed it sometime to GODOPIT and again to a now unknown code in december 2004. | ===== OP Codes ===== |
| | Op Codes or (operational codes) are used to provide extra flexibility for maintenance and field testing. Contrary to popular belief, op codes are NOT universal in function and are company-specific. In other words, op codes will only perform a specific task within an administering company's programmed parameters. A telco can choose to assign an op code as either a notification, a request or test initiator. As the technician enters op codes via the payphone's keypad, these are then sent to the telco staff via Millennium Manager's database. The payphones, at that point, do not do anything else, other than transmit the inputted numbers. Once received and depending on how the op codes are defined, certain tasks are then performed or initiated. As an example, a telco might choose to define op code 344 to be a notification that the payphone's booth requires cleaning. When the technician enters this opcode as part of his or her routine visit (for example, to collect deposited coins) the telco will receive this message and send a cleaner out to do the cleaning. Similarly, an op code can be defined to flag a certain repair to be made. If the op code is defined as a test initiator, for example code 431, then the Millennium Manager will perform the specifically programmed task, for example, a call back test. |
| |
| | A leaked [[https://github.com/muccc/millennium/raw/master/manuals/nortel_millennium_text.pdf|manual]], supposedly stolen from a Telus-Facility, offers a list of some Telus Op Codes that can be entered directly on their payphones to access certain test and/or functions (chapter 4 and 5); these codes are specific to Telus. |
| ===== Projects ===== | ===== Projects ===== |
| - Extracting the standalone-firmware of a demonstration unit and make it available to other phones | - Extracting the standalone-firmware of a demonstration unit and make it available to other phones |
| - Done - We have a number of "demo-code"-firmwares at our disposal. Those can however not be made available to the public | - Done - We have a number of "demo-code"-firmwares at our disposal. Those can however not be made available to the public |
| - Verify rumor, that someone already recreated a Millennium Manager | - Verify rumour, that someone already recreated a Millennium Manager |
| - Verified! Ecuadorian Telco "ETAPA EP" has their own fake Millennium Manager, which is the result of a Thesis written by RODAS RODRIGUEZ FERNANDO ANDRES and ZEA GARCIA SANTIAGO XAVIER. | - Verified! Ecuadorian Telco "ETAPA EP" has their own fake Millennium Manager, which is the result of a Thesis written by RODAS RODRIGUEZ FERNANDO ANDRES and ZEA GARCIA SANTIAGO XAVIER. |
| | - Further verified: Howard Harte has made an open source one [[https://github.com/hharte/mm_manager|here]]. |
| - Recreate our very own Millennium Manager | - Recreate our very own Millennium Manager |
| - In Progress - We have a working (but serving static data) proof of concept (first successful provisioning happened on November, 13th 2016. [[https://twitter.com/boscop/status/797863014569562112|Proof]]) | - In Progress - We have a working (but serving static data) proof of concept (first successful provisioning happened on November, 13th 2016. [[https://twitter.com/boscop/status/797863014569562112|Proof]]) |
| - Create our own coinsets for the coinvalidators | - Create our own coinsets for the coin validators |
| - Done - See [[millennium:coinvalidator]] for a description how to do it. | - Done - See [[millennium:coinvalidator]] for a description of how to do it. |
| - Hardware and Software for easier use needs to be done | - Hardware and Software for easier use needs to be done |