BEATING PROTEL'S PROGRAMMING SECURITY CODE Written by: MaNiAK Credit: A very large majority of this information has been given to me thanks to El Jefe. I am solely the bearer on information as far as this text file goes. Also, thanks to Cyb0rg/ASM for the tips and suggestions. ***************************************************************************** DISCLAIMER: I nor anyone else mentioned in this file is responsible for your actions. This information is being released for educational purposes only. You are responsible for what you do with this information! ***************************************************************************** Protel pay phones were founded in 1983 in Lakeland, Florida. Since then they have been a world leader as a supplier of pay phone equipment in more than 60 countries worldwide. To my knowledge, Protel is the only pay phone manufacturer that has not filed for bankruptcy. Protel makes many different models of pay phones, many of which are programmable from remote locations using their Expressnet software. Knowing how to detect a Protel can sometimes be difficult as they look physically similar to many other brand of pay phones. Sometimes it might say Protel somewhere on the instruction card. The best way to determine if you are using a Protel is to actually use the phone and look for the following features: - Collects money at the end of the call - *#6x codes can used to obtain bits of info about the phone* * - Companies can program the phones so *#6x codes are disabled, if they want to, however it doesn't appear possible or common in Canada and USA. Most of their models look physically similar to each other with minor differences, like card readers and such. Also, all Protel phones to my knowledge are line powered. A few of the newer models like the XP 1230 and the Ascension have a more updated look. A mostly complete list of their models follow: - Protel 1000 Express (Seen in Mexico) (http://payphonepictures.imess.net/mex1.jpg) - Protel 2000 (Seen in the USA) (http://www.payphone-directory.org/protel.jpg) - Protel 4000 (Seen in the USA and Canada) (http://payphonepictures.imess.net/protel.jpg) - Protel 7000 (Seen in the USA) (http://www.aicphone.com/catalog/ghousings/AC-2100P.jpg) - Protel 8000 (Seen in the USA, has been discontinued) (http://www.payphoneproducts.com/img/products/product_wm_west_large.gif) - Protel 1230XP (Seen in Canada and Australia, has been discontinued) (http://payphonepictures.imess.net/paytelpro.jpg) - Protel Ascension (Seen in the USA) (http://www.protelinc.com/main/images/ascension_series.jpg) Strangely, Protel doesn't have the most intelligent security system in place as far as programming their phones go. All that is required once one has the proper software is a 4 digit Security Code. Sometimes these codes can be guessed, but why guess when you don't have to. All one needs to do is to capture the data from a certain companies Protel by calling it. You can then use the captured data and pretend to be a payphone when you call the phone company's computer number. (*Hint: The company computer number can be obtained by pressing *#65 while using a Protel*). Anyhow, the company’s computer will think that one of their Protels is calling and will send you the Security Code. Of course it will be encoded; usually in easily read ASCII text or Binary Coded Decimal (BCD). From here, you're off to the races as far as programming goes. Have fun. Below is a list of companies in the Pacific Northwest and their respective Protel computer numbers and 4 digit Security Code. Now, I'd like to bring the attention of the class towards the Telus security code, that’s right it's 0000. Or in other words, they didn't even bother to set it. You could input any code for a Telus phone and it would be accepted. That's sad huh? Company Name Computer Security Comment Phone code Mountain Paytel 406-777-4688 0697 Computer number disconnected Qwest 800-525-0385 9347 Verizon/GTE 800-483-6599 4004 Verizon/PTM 800-860-7798 8383 NSC 866-479-2730 9347 Western Comm. 425-338-9517 8811 Integrity Cointel 406-777-0105 ???? person answers phone TELUS/Landline 800-465-0615 0000 Security by Obscurity TELUS/Cellular 604-293-1374 0000 Security by Obscurity Paytel Canada 604-821-1374 5474 OUT OF BUSINESS CoinOp Management 604-872-0595 5474 KTS 253-472-3910 3910 Paycom 425-392-9395 1974 CostTel 253-639-0394 2463 Northwest Paytele 800-978-7483 4321 OUT OF BUSINESS America West 866-305-5075 1454 Telcorp USA 206-275-0476 4321 TelService NW 253-630-1770 1770 Paytel Communic. 425-455-1341 4055 CMS 503-643-0915 9753 NCF 425-821-2634 5474 MetroPhone 800-959-2643 0977 OUT OF BUSINESS PhoneTel 800-999-1479 7723 WestTel 425-254-0949 9486 Smoke Signal Tel. 509-585-7937 4444 Sprint 800-788-1692 4956 Smartstop 503-276-5106 3865 The Expressnet software can be difficult to obtain. You could buy it from Protel or if you're lucky, maybe you could get it from someone who already has it. There are free upgrades available at http://www.protelinc.com. If one knows what they are doing, they could download the free upgrade only version and they could get around the "Upgrade Only" restriction to obtain a full version of the Expressnet software. Research and/or pictures courtesy of the following sites: http://www.protelinc.com http://www.hackcanada.com http://www.nettwerked.net http://www.payphone-directory.org http://payphonepictures.imess.net Copyright 10/03 - MaNiAK 2003-10-24 Updated 2003-12-30