Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Phreaking Public Phones :: paytel~1.txt

The Comprehensive Guide to Paytel Canada Payphones

    'The Comprehensive Guide to Paytel Canada payphones'

Written by: The Clone
On Friday July 14, 2000

  `            `

.; Disclaimer

.; PayTel Canada offices 

.; Protel Model Phones

.; Intellicall Model Phones

.; Resources 

.; Conclusion

.; Contact

.; Shouts

   Disclaimer --

Within the pages of this document is information pertaining to the
technological ins and outs of a huge chunk of the payphone market in Canada. 

I am by no way responsible for any damage someone or somebody causes by reading
this document. If you want to break something and risk a fine or prison time,
by all means leave me the hell out of it. In other words, if I in some way AM
contributing to that slight increase in Canadian youth crime, I don't take 
responsibility for it. So please, use this information to learn and grow and 
not to piss off your phone company, the police department, or national defense.


	                'PayTel Canada offices'

  Several months ago, in my document titled 'The Complete Guide to the 
Elcotel Payphone' I listed off every Corporation that currently has an
account with Elcotel; this included specific account information in 
alphabetical order. From what I assume, that information was deemed useful 
by my readers so for that I've taken a similar approach with this section.

For now, here is a list of every PayTel office in Canada in order from west to 
north - just a good resource for Canadian phreakers who may be interested in 
this company.


Paytel's national head office is located in Surrey, British Columbia, 

with the following branch offices in: 

Alberta (Calgary), Ontario (Toronto, Markham), Quebec (Mirabel), 
New Brunswick (Moncton) and Nova Scotia (Dartmouth).

   Western Canada (Head Office)
       2428 King George Hwy
        Surrey, BC V4P 1H5
       Tel: (604) 542-2010
       Fax: (604) 542-2011
    Toll-free: 1-877-542-2010

	  Ontario Region
       6 Adelaide Street East
	     Suite 500    
	Toronto, ON M5C 1H6
       Tel: (416) 504-7400
       Fax: (416) 504-7211
  Customer Service: 1-800-265-2953

          Quebec Region
       17,000, rue Charles
           bureau 100
        Mirabel, PQ J7J 1X9
       Tel: (405) 433-0001
       Fax: (405) 433-1303
     Toll-free: 1-877-433-3553

	 Eastern Region
      201 Brownlow Avenue 
            Unit 57
     Dartmouth, NS B3B 1W2
       Tel: (902) 468-1716
       Fax: (902) 468-1717
    Toll-free: 1-877-575-7555


		   'Protel Model Phones'

Protel, Inc. of Lakeland, Florida is North Americas leading manufacturer
of smart public payphones. In 1984 Protel introduced the first line-powered
smart payphone in the USA. Protel were one of the first key-players in the 
development of the first Customer Owned Customer Operated Telephones (COCOT) 
in the early 1990's, and have strived to bring quality yet cost effective 
phones to millions of people around the globe.

Protel develops several payphones, though only having slight differences
between them, which are unique and interesting to mess around with for 
a couple of obvious reasons; interaction with the phones' diagnostic -
statistical information is possible by using a series of secret codes,
and physical/remote security is fairly weak. This is just the type of
thing any telephone enthusiast loves to read.


I haven't personally found an abundant amount of these payphones within
Edmonton in comparison to the Intellicall model phones, but keep in mind, 
the telecommunications industry is an ever-changing one so who knows what
to expect in the next six months or so. Keep your eyes peeled and lemme
know if you find any Protel Model payphones in your area.

PayTel Canada's Protel Phone

This is one of the few widely distributed Protel phones in Canada:

Payphones and Accessories

Protel Locations

    Restaurants - Truck Stops - Schools - Service Stations - Churches -
    Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts -
   Low-income Housing - Convenience Stores - Apartments - Bars - Lounges
                             - Hotels - Motels 


- When dialing a call on a Protel phone, the phone slowly dials each digit
  while it waits for you to finish dialing or finish paying. You'll be able
  to hear this in the background, but it is often quiet so open your damn ears!

- Leaving a Protel receiver off the hook for too long will cause the phone
  to produce an interesting beeping sound.

- Credit Card slots; some of these phones DO have credit card slots which 
  accept many major credit cards (ie. Visa, Mastercard, e.t.c).

- Internal Alarms; can be disabled by entering *# and the correct two to four
  digit pin code, most likely in default mode and easily bruteforceable.

- Ringers; Protel model phones will most often ring when called. 
  After five rings a modem carrier will pick up which is sometimes
  followed by an automated voice that reads off how much money is in the
  phone including the date/time.

Special Features

- A particularly special feature about the Protel model payphones are the 
  unique Protel-only *# options that allow any phreaker to learn about the
  phones' internal information simply by entering a few codes.
  Here are the *#6X codes I'm aware of at this present time:
     ` *#61 should give you ANI information

     ` *#62 will ID the software version the phone is utilizing

     ` *#65 sometimes discloses the phones company's HQ modem number 
       - in Canada the modem carrier number would belong to PayTel Canada.
     ` *#68 disables the phone all together

! Tip: by hand-scanning other *# codes (ie. *#0X, *#1X, *#2X, e.t.c.) 
       you may find more neat options like the ones noted above.

Remote Administration Software

* Expressnet - - (official Protel software)
      - ""

* Panorama -
* Pronet -

Security Issues

'Physical Administration' 

To my knowledge there are two ways to gain physical administrative powers
on a Protel model payphone, the first way is somewhat easier. 

Here's what you do;

` Enter *# and then the correct four digit admin PIN code which are most likely
  defaults such as: *#1234, *#5555, *#9999, and so on. Once you enter the
  correct PIN code you will have total access to all menus, rate tables,
  and will have the ability to alter restrictions on what phone numbers
  can be dialed.

` The second way is quite a bit more difficult but is successful nonetheless.
  After entering the correct two to four digit *# alarm code, and opening
  the phone with the proper keys, you will notice a 'setup' button on the
  printed circuit board.

Press the button and immediately you'll be prompted for the correct PIN code.

` Enter *#000000 (6 digits) - at this point you will have total access to
  all menus, rate tables, including the ability to alter restrictions on
  what phone numbers can be dialed.   

'Remote Administration'

Remote Administration of the Protel phone can be both enjoyable and 
profitable, if done correctly. In this section, I'll be explaining step by
step on how to successfully take over a payphone or many payphones by
using just a computer with a modem and the proper software.

The first thing you'll need in order to successfully take over a Protel 
payphone remotely is the particular payphone's phone number. This can be
accomplished by either writing down the phone number listed on the phone,
or by entering *#61 with the receiver off the hook.

Secondly, you're going to need the right payphone administration software.
Remember; some software which might work for administering one payphone may
not necessarily work for another. The reason for this is that some
software just isn't compatible with the payphones' chip, making it impossible 
to even connect to the phone correctly. 

Another reason may be that the software you're using doesn't allow you to 
enter the necessary number of digits that would be required of you when
prompted for the PIN code. In this case, you'll need software that allows
you to enter a 6-8 digit payphone admin PIN.

The PIN code; because of the fact that most payphone administration PIN codes 
(by default) are a series of numbers with only one number and 6-8 digits,
and if we remember that the internal physical administration PIN for the
Protel is *#000000, I would say that the default PIN for all Protel phones
is likely an easy guess.

'Audio File coin return exploit'

Many of the Protel payphones throughout eastern Canada and parts of the
United States which are owned and operated by Bell (called BOCUT's) are
vulnerable to a particularly interesting form of phone fraud. 
This vulnerability will allow anyone on one of these phones to make a
local call and then get their money spit back into the coin return.

Now as some of you may already know, as a service provided to ensure customers 
aren't being ripped off when they insert that 25/35 for a call, phone 
companies have what they call a "coin return policy". 

This policy states that if a customer inserts his/her money for the call
but are unable to complete the call due to technical problems on the part of 
the CO, then the operator must empty out the appropriate change. Now adays
with the advent of new telecom based technologies, all an operator would
be required to do is play a specific frequency into the receiver to 
subsequently cause the phone to empty.

What I'm getting to is this; if anyone on a regular quality land-line was to 
be called by someone on a Protel model BOCUT, and then the person on the
land-line was to play the coin-return frequency, they could quite possibly
automate what any operator has the power to do. This little exploit is
known as the 'Green Box', but alt.phreaking's 'Cyber Thief' coined this the
'Protel-Box' for the obvious reason that it only works on Protel model phones.

DIY, baby:

==>									<==
The frequency in '.WAV' format:
==>									<==

	      Canadian Distributors

            C. G. Industries Limited
                30 Shields Court
               Markham, Ont. L3R8V2
               Phone: 905-475-5093
                Fax: 905-475-5389

       International Connectors & Cable, Inc. (ICC)
                16918 Edwards Rd.
            Cerritos, CA 90703-2400
               Phone: 562-926-0734
                Fax: 562-926-5290       
            Toll Free: 1-800-333-7776

               Palco Telecom, Inc.
               7825 Flint Road S.E.
             Calgary, Alberta T2H 1G3
                  (800) 661-1886
                  (403) 255-4481
             Fax: (403) 259-0101

             Pay Phone Technologies
            80D Centurian Drive Unit 8
                Markham, ON L3R 8C1
               Fax: 905-947-8209
             Toll Free: 1-877-488-0041              

                  'Intellicall Model Phones'

     `` Using advanced technology and the experience of over
 12 years in the industry, Intellicall produces two payphone models
  that may both be customized with a variety of options to meet the
   demands of your locations. The UltraTel payphone is the economical 
  workhorse of the industry for those installations that use AC power. 
The AstraTel payphone is the proven answer where line power is preferred. 
Both are highly robust systems that deliver the long term reliability 
           required in any successful payphone network. ''

Paytel Canada's Intellicall Phone

Paytel Canada distributes this model of payphone by Intellicall called
the AstraTel 2:

Intellicall: 'AstraTel & Ultratel' Audio Samples

Payphones and Accessories

Intellicall Locations

 Restaurants - Truck Stops - Schools - Service Stations - Churches -
    Airports - Bowling Alleys - Night Clubs - Bingo Parlors - Resorts -
   Low-income Housing - Convenience Stores - Apartments - Bars - Lounges
                             - Hotels - Motels 


[On UltraTel Models]

- After Approximately five rings, a modem carrier will pick up

- Some models of this phone have a scrambled keypad, that is, 
  when you dial a number, the tones you hear don't match the 
  numbers you push. After a call is completed, the scrambling ends.

- This phone requires an AC power source to function properly.

- During a call, it will take your money as soon as it thinks
  the call is answered. If it is left off the hook too long it will say:
  "Please hang up and try again."

[On AstraTel Models]

- After Approximately five rings, a modem carrier will pick up

- It has a 14,400 baud modem, which is very fast for a pay phone. 
  It runs only on phone line power. If you don't deposit enough for a call,
  you will be told to just deposit the difference.

- if you leave this phone off hook too long it will generate a fake fast 
  busy signal.

Special Features

Toll Fraud Prevention --

The fraud prevention is this: if you call your friend on an Intellicall
phone (UltraTel & AstraTel models) and your friend answers, the phone will 
automatically dial '111'. If you were to call this phone from either the 
payphone next to it or from a cellphone; have it ring once, pick it up and 
then hang up, and pick it up again you'd get an unrestricted dial tone which 
would allow you to use a tone dialer (since the keypad is temporarly disabled)
to make free local calls.

The auto-111 DTMF tones override the dialtone, thus preventing toll-fraud.

Security Issues

- Internal Alarm Bruteforcing -

Internal Alarm Bruteforcing can be done by firstly entering pound then
a four digit PIN. Because of previous problems involving the disclosure 
of alarm codes, I will not be posting it on this article. 

Too many people were abusing the #CPC code that was mentioned on the 
'Complete Guide to the Elcotel Payphone', and because of that Canada Payphone
changed the PIN and set up a trap (at least in Edmonton) which automatically 
caused the phone to dial out for help. 

If you wish to bruteforce the PIN then all the power to you. 

'Phone Seizing Problems - will give free phone calls'

Well whaddya know, the very same exploit I discovered on the Elcotel 9520C 
model payphones works on the Intellicall model payphones as well. 
When will these payphone developers and their distributors ever take their
security seriously? The answer is; until the specific fraud being committed 
has reached such prevalent levels that the chance of a yearly revenue is slim 
to none.

Using a twenty dollar Genexxa 33-Number Memory Pocket Tone Dialer from Radio 
Shack, one can easily take advantage of Paytel's incompetence in relation
to call seizing.

 -- Typical Scenario --


Operator: Paytel Canada, how may I help you?
Phantom Phreak: Yes, may I have the number for directory assistance?
Operator: Just a moment...
Phantom Phreak: Thank-you.
Operator: 1-877-542-2010
Phantom Phreak: No no no, thank-you!
* Operator Hangs Up *
* Phantom Phreak is dropped to an unrestricted line, and then proceeds to
  play his pre-programmed 7 digit DTMF tones into the receiver allowing him
  a free local call. *

Useful Numbers:

The keypad isn't disabled when using these local numbers, 
meaning you will not need to go through the trouble of using a tone-dialer:

** 0 
** 411 
** 611 
** 811
** 911 (?)

| see: 'SKANNING' at for a listing of thousands of these: |

* Blocked From Area - Will eventually drop you to an unrestricted line
* Call Cannot Be Completed - Will eventually drop you to an unrestricted line
* Disconnected - Will eventually drop you to an unrestricted line
* Not In Service - Will eventually drop you to an unrestricted line
* Unsuccessful VMB Login Attempts - will usually drop you to an unrestricted 
  line after several unsuccessful login attempts (not recommended)

Modem Carrier Numbers (AstraTel 2):

519-576-0354 - Kitchener, Ontario, Canada
780-483-9783 - Edmonton, Alberta, Canada
780-456-9983 - 127St/139Ave: Edmonton, Alberta, Canada
905-453-9794 - Halifax, Nova Scotia, Canada (corner of Robie and Young streets)


Resources list - 

URL's of web-sites that helped me with the R&D for this document:

-+ GHU - The Grasshopper Unit:
-+ Intellicall Inc:
-+ Pay Phone Directory:
-+ PayTel Canada: 
-+ Protel Inc:
-+ Protel Inc (ftp): 
-+ Tatung Telecom: 


I'd firstly like to thank some people who helped directly and indirectly
with the creation of this document: Cyber Thief, Magma, Miklos, and RT.


Oh you big scary Telecom companies popping up everywhere trying to make
a buck (or should I say 'quarter') off the slowly dying payphone industry
in Canada, without ever paying attention to security. I'm not going to
chant about how you guys should INCREASE your security. See that's just
something honest 'white hat' folks do. The more you make it easier for the
Canadian phreakers to exploit you physically and remotely, the better.
Although I don't mind a challenge every now and again... or do I? 
All this STUFF just comes so easily to me... tee-hee.

Def Con 8:

 YES! Hack Canada and several of their Canadian friends will be attending
Def Con 8 this year for some good 'ol fashion fun! This will be Hack Canada's
second year attending this crazy Las Vegas conference, and we plan on having 
a few surprises for all you people. Look for a lot more pictures and
reviews this year - hell just look for us and share your beer, eh. 

PeAcE OuT...

_ Contact me _

ICQ: 79198218
IRC: [#haxordogs]
URL -	


Hack Canada & Haxordogs

			 P R E - D E F C O N 
			       2 0 0 0
			     R E L E A S E

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2019 AOH