[home] [<-back] [index] [next->]
____________________________________________________________________ [ 2:. [Guide to Elcotel Payphones ] [The Clone] :. ] [webmaster@nettwerk.hypermart.net] :. ] ____________________________________________________________________ _________________ Table of Contents _________________ * Introduction * Elcotel's International Corporate Customers * Elcotel Payphone Investment [Canada] * Hardware Details [9520C] * Components Catalog * Physical Administration * Elcotel 9520C Phone Seizing Problems * Remote Administration * Central Administration Computer(s) [9520C] * Web-site References * Payphone News: GrapeVine in Canada * Upcoming Projects * Credits * Conclusion _ -_- - Introduction - It's the year 2000 and I can say that without a doubt we are finally in the midst of a payphone revolution. For a greater majority of the 90's, there have been dozens of so-called "break-throughs" in the tele-communications industry's payphone sector. Some of these breakthroughs helped to shape the way we live by finding simple solutions to our complex problems by making the way we communicate convenient, easier, and more efficient. One key player in the innovation of the international payphone market is a company by the name of Elcotel Corporation (NASDAQ: ECTL). Elcotel, based in Sarasota Florida, has rewired the Digital Age and the rules of marketing by creating one-on-one relationships between businesses and the consumers they are trying to reach. In this document I will be lecturing on a wide variety of subjects concerning Elcotel's products, ranging from the basics to the more advanced information. All the information contained in this document has been either researched and/or discovered by myself or my associate, RT. Please Note: I've made every attempt possible to be accurate, so if for some reason I made an error please let me know by e-mailing me the details - I'll try to take every e-mail into consideration. -- - Elcotel's International Corporate Customers - Elcotel has a wide variety of Corporate Customers it deals with on a regular basis, and not a hell of a lot of people are really aware of who these customers are. In this section I've listed off every Corporation that currently has an account with Elcotel, including their account numbers all in alphabetical order. Use this information in any way you wish, but use it responsibly and legally. -------------------------------------------------------------------- --------- Account Account # ....... ....... ADITEL 1570101 AEC SAUDI 1671701 AFRIC MOROCCO 1500701 AMERICAN SAMOA 1682001 BARAINVER S.A. 1753001 BELIZE TELECOM 1505301 BERMUDA 1437501 CANADA PAYPHONE 1557701 CIMEX 1729501 COMTEL 1469701 CONECELL 1748801 DAEBONG 1760101 DATELCO 1738401 ENTEL 1682201 ERICSSON 1771701 GENESIS 1675601 ITG GROUP (IRELAND) 1739001 MKTC 1765801 MULTI-LINE 1612701 PALMETTO 1751101 PHILCOM 1628301 P T & T 1623601 QUADRUM 1246302 TELCEL 1751701 TELECTRONIC 1557401 TELEFONICA (MYSTIC) 1689401 TORTEL 1778001 TELEFONICA DEL SUR 1580301 TPPR 1729401 TRANSDATA 1520701 WCVC (Telefectivo) 1626301 [TOTAL = 31 International Corporate Customers (ICC)] --- - Elcotel Payphone Investment [Canada] - So you want to invest in an Elcotel payphone -- well you've came to the right place. In my humble opinion, Northern Telecom has somewhat of a monopoly on payphones/data terminals throughout Canada and I'd like to see some more competition from Canada Payphone Corporation. Available on Canada Payphones' web-site is a form that anyone (company) interested in purchasing an Elcotel series phone can do so by correctly filling it out. The form makes an inquiry about the following information: First Name: ____________________ Last Name: ____________________ Employer Name: ____________________ Employer Address: Street: ____________________ City: ____________________ Postal: __________ Province: ____________________ How did you hear of us? +*******************+ * Magazine * * Newspaper * * Television * * Referral * * URL/Search Engine * * Viewed product * +*******************+ How would you like us to contact you? +********+ * E-mail * * Phone * * Fax * * Mail * +********+ Please indicate telephone number where we can reach you: ____________________ At what time of day should we call you? +***********+ * Morning * * Afternoon * * Evening * +***********+ If you prefer to be contacted by fax, please indicate the number: ____________________ If you prefer e-mail correspondence, please provide your e-mail address: ____________________ Site Description: __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ # of payphones required: ______ When do you require these to be installed? ____________________ How many payphones are currently at your location? ______ Would you like information on our Public Internet Terminals? ( )Yes (*)No Are you presently in a contract with your payphone provider? ( )Yes ( )No (*)Unsure Please list any specific questions or comments below: __________________________________________________ __________________________________________________ __________________________________________________ __________________________________________________ A CPC representative will respond to your request within 72 hours. NOTE: Required fields are followed by a check mark. Reset Send This form can be accessed at the following URL: http://www.canadapayphone.com/contact/request.htm - Hardware Details [9520C] - [_ Full Size Image: http://home.edmc.net/~theclone/Elcotel/attsilver.jpg _] 9520C Features: Stand-alone operation, no expensive platform fees Line-powered High speed modem decreases transmission time, thereby reducing polling and programming costs Supported by Elcotel's state-of-the-art, PNM Plus (Default software; PollQuest) LCD (line-powered) display augments audible (bi-lingual) instructions Speed dial buttons offer convenience and additional revenues when prompted to service providers Multiple payment methods accept coin, credit card, debit card, prepaid card and coinless transactions Digitally recorded, bi-lingual voice prompts provide user- friendly instructions in culturally diverse locations such as airports Standard integrated volume control button ensures ADA compliance Remotely downloadable operating system and site operational files Call diagnostic events recorder enable remote diagnostics and troubleshooting Flexible call routing One year warranty Handles unique call situations using priority parsing Internal Alarm reports (coin jam, vandalism, handset, inactivity, cash box level, etc.) Detailed call records management Full spectrum of answer supervision Modem telemetry for programming and cash box/alarm monitoring via computer Voice telemetry for programming and monitoring through the phone's keypad Specifications: --------------- Power: Telephone line-powered; 48 VDC line voltage (on hook), 23 mA loop current (off hook) FCC Registered Ringer Equivalency: 0.7B Chassis Weight: 2 lbs. Phone Weight: 49 lbs. 14.4 modem Handset: Hearing aid compatible Nine Button "Matrix" speed dial keypad Japanese Model Chips Motherboard Protected by Cash Box IDE Interface ABA magnetic Strip Card Reader Miscellaneous Hardware Information: ----------------------------------- Component Movement ------------------ Q: "What's that crazy noise I hear when I hang up the 9520C?" A: That noise you hear when you hang up the phone, is simply the Physical Component Switch (PCS) resetting the line after recognizing a dialtone. In addition, if you were to open up a 9520C model Elcotel and look inside, you would see a button which operates the Physical Component Switch labeled 'do not press'. Hmm... I've always wondered what would happen if I were to press it. ;-p Ring Back --------- All Elcotel 9520C payphones have a built in ringer though only approximately 10% of them actually ring when you call them up. A simple way to test if the 9520C phone you're using is part of the "10% ringing bracket" is to call it (number located on the phone) from another payphone next to it. If there isn't another payphone close to the Elcotel, which is not uncommon (marketing reasons), just use your cell phone and call the line up to test if the 9520C phones nearest YOU can ring! How many Nortel Millenniums do you know of that ring, let alone answer with a modem carrier when you call them up? NONE. .. For a description of the Elcotel Eclipse, read the 'Product Speculation' section on my document: 'CPC; Elcotel Eclipse Smart Phone' at: http://home.edmc.net/~theclone/Elcotel/cpc_eclipse.txt - Components Catalog - Below is a list of the payphone components you can purchase from Elcotel Corporation. I've listed off the URL's rather than the actual parts, because the web-site is constantly changing and new parts are being added almost daily. At the present time, on-line ordering isn't available from Elcotel's web-site. How to place an order: E-mail lperez@elcotel.com with your first and last name, your address, and the part number(s) of the products you wish to purchase. You will receive an e-mail back from her requesting credit card information. (So much for secure transactions, eh?) Kits ---- Kits of Parts - http://www.elcotel.com/Parts/product.asp?id=11 Loud Button Retrofit Kits - http://www.elcotel.com/Parts/product.asp?id=12 _-_ Major Subassemblies ------------------- 70C Dial - http://www.elcotel.com/Parts/product.asp?id=5 Coin Cover Units - http://www.elcotel.com/Parts/product.asp?id=4 Coin Dial Units - http://www.elcotel.com/Parts/product.asp?id=6 Coin Path - http://www.elcotel.com/Parts/product.asp?id=2 Control and Signaling - http://www.elcotel.com/Parts/product.asp?id=3 Handsets - http://www.elcotel.com/Parts/product.asp?id=7 Hopper Coin Assembly - http://www.elcotel.com/Parts/product.asp?id=1 _-_ Replacement Parts & Accessories ------------------------------- Parts & Accessories - http://www.elcotel.com/Parts/product.asp?id=9 _-_ Security Devices ---------------- Doors, Locks & Other Phone Security Devices - http://www.elcotel.com/Parts/product.asp?id=9 _-_ Tools ----- Tools, Gauges & Materials - http://www.elcotel.com/Parts/product.asp?id=10 _-_ - Physical Administration - Physical Administration of the Elcotel Payphone has got to be the most exhilarating experiences in the Research and Development of the Elcotel Payphone. Using this brand new hi-tech equipment, learning the ins and outs, hacking it, and documenting it all as a pioneer explorer is absolutely incredible. As noted in the 'Hardware Details' section above, the Elcotel 9520C contains two alarms to help detect vandalism and to help discourage theft of the equipment. The main alarm is within the actual phone itself, and if set off for a various reason will send a distress message to the central NCC computer at Canada Payphone Corporation. Canada Payphone if you don't know, is our country's lovely distributors of Elcotel Payphones. Canada Payphone, located in Burnaby British Columbia, will receive this distress message on their computers which then automatically register everything about the phone (including the location). Canada Payphone will then contact either a security company which was contracted by them, or AT&T security who run their data/voice lines. Several minutes later, either the contracted security company or AT&T will take a stroll on by to the premises and investigate the matter. Big trouble for the guy who set that alarm off! :-/ -- Hired contractors for Canada Payphone routinely do physical administration on the phones - installing, programming them, collecting the money, and everything and anything that they are required to do in their job description. Because these contractors are usually lonely guys who have to run around all the time working with machines, they long for human interaction. That is how my associate RT was able to snag some useful information. All he did was walk up to the guy fixing the phone and started a conversation with him. In a calm manner, RT asked several questions about the phones which the contractor was glad to share with him. The information he gave RT has been added to various sections of this document, and for that we THANK HIM. :) -- Alarm PIN Information --------------------- Disabling the alarm on the Elcotel series phones, is relatively simple. What you're required to enter is a three digit PIN, which if correctly entered, will turn off the local alarm in the phone. This means that the static connection from the phone to Canada Payphone's NCC computer in Burnaby BC will be cut off. However, if you enter an incorrect PIN you'll get an error message on the display. (1) How do I disable the alarm? - By picking up the receiver on the phone, pressing #, and entering the three digit PIN. (2) How do I know I'm doing it correctly? - You'll know you're doing it correctly when you see ### on the display... the ### represent the PIN. If you entered the right PIN, the display message will say "OK". (3) What is the PIN? - Canada Payphone, (being the obvious guys that they are) decided to choose a PIN code that would be easy to remember so they picked 'CPC' as the PIN code. CPC standing for Canada Payphone Corporation, wh00p. (4) How do I enable the alarm again? - Pick up the receiver (if it was hung up) and type #CPC. - Then hang up the receiver and try to wait for at least twenty seconds before using the phone again. Why? You have to give the phone some time to reconfigure itself. - You'll know you can use the phone again when you hear the components in the Elcotel shifting. -- Administration PIN Information ------------------------------ The benefit of Physical Administration over Remote Administration is that you're not required to enter an ID of some sort before entering the PIN. What you're required to enter is an eight digit PIN, which if correctly entered, will allow you to open the phones' case granting you full access to the Elcotel's administration system. Giving you the ability to: - empty out the cash box - change screen messages - administrate rate tables - see how many calls were made with the phone in a given time period - see how many days the phone has not been in use - debit card information - several security parameters - etcetera -- - Elcotel 9520C Phone Seizing Problems - 9520C Phone Seizing Problem #1 ------------------------------ - On the Elcotel 9520C model phones which haven't been upgraded with the the new "fool-proof chip" have a severe flaw; Recently Canada Payphone decided that it would have its calls routed through AT&T's switching system instead of their own. The reason for this may be due to AT&T's size and ability to handle several calls without getting the 'bottle-neck' problem like Canada Payphone may have had. Now due to this change-over, a problem occurred with the 9520C model Elcotel's causing a line-seizing problem. Essentially this problem would allow a phreaker to exploit it to make as many free local phone calls as they wished. This is how it's done: - Pick up the receiver - Enter 25¢ for the call - Call someone, and be sure they hang up the telephone after the call is completed. - The line will not be seized at this time, the mouthpiece will not be muted, but the keypad will be disabled. - With the receiver still in your hand, place your tone dialer on the mouth piece and begin to punch in a phone number or play the pre- programmed DTMF tones. Either way should work successfully. Remember that this trick will not work on ALL 9520C series Elcotel payphones. ONLY the 9520C's that haven't had their chip upgraded to prevent this type of fraud will work. ++ Note: Sometimes when dialing a number with the 9520C phone you will get a number that is either 'Not In Service' or 'Cannot Be Completed', the line might not hang itself up. In this case, you could use the same techniques documented above to exploit the seizing problem and make free local calls. ++ 9520C Phone Seizing Problem #2 ------------------------------ - On the Elcotel 9520C model phones which have been upgraded with the the new "fool-proof chip" have a severe flaw; The new chips in the Elcotel 9520C's apparently fixed 30% of the phones in Canada which allow the use of a tone-dialer to make "free local calls" when a line doesn't seize properly. The newer chips apparently do not allow the use of a keypad or DTMF tones in the chance that the line does not seize after a call is completed, thus securing the flaw. However, there is a way around the newer chips' "security features". If done correctly, the trick will allow a phreaker to exploit a different type of line seizing problem unknown by the Telco and unrecognized by the newer 9520C chips. This is how it's done: - Pick up the receiver - Dial '611' (don't worry it's toll-free) - Immediately after, press the bi-lingual button (English to French) located next to the phones' keypad. If done correctly, the payphone will reset causing the connection through AT&T's (the CO) SS7 based switching to end. - At this point you can use the keypad to dial any local number you wish. - Or use a tone-dialer by placing it on the mouth piece of the receiver and begin to punch in a local phone number, or simply play the pre-programmed DTMF tones. The only explanation I have for why the Elcotel 9520C resets the line causing a seizing problem, is due to Elcotel's inability to develop a chip that prevents various types of payphone fraud. If Elcotel can simply keep its promise of developing so-called "fraud resistant" payphones by having regular security audits before they ship their products to their corporate customers, then they wouldn't have to worry about lost revenue caused by phreakers who abuse these vulnerabilities. It's only common sense, RIGHT PEOPLE?! :) - Remote Administration - In my previous document titled 'CPC; Elcotel Eclipse Smart Phone' I gave mention about how one could remotely administer a payphone as long as they had the proper knowledge to do so. I briefly explained that you'd be required to have the payphones' uniquely assigned number, the software to administer it and the ID/PIN to do so. In the document I mentioned that once inside the system you'd have the ability to change rate tables, change scrolling messages, turn the payphone on, etc. It's been five months since that document was written, and the information that I gave was only general and didn't give specific system details. What have I discovered/accomplished since then? ----------------------------------------------- %% Payphone Numbers %% - I now have a list of several Elcotel 9520C payphone numbers which several people have helped me compile. At the moment I have Canadian payphone numbers from Calgary, Edmonton, Vancouver, and Victoria. The number of payphones listed so far is in the twenties, and it keeps on growing. The document (Elcotel CPC 9520C; National COCOT Number Compilation) can be seen by visiting: http://home.edmc.net/~theclone/Elcotel/elcotel_compilation.txt %% Software %% In December of 1999, I started to get into the software side of it all and posted several different Remote Administration programs on Nettwerked for download. The programs made it easier for the phreak and hacker to get into the core of the Elcotel system without worrying about having to search for them. PNM Plus is a simple stripped down Administration Tool which can be used on the Elcotel. The minimum requirement however is that you have Windows 3.11. Download: http://thehomeworkpage.tripod.com/pnmdemo.tar.gz - PollQuest Version 1.6.0 (Commercial Release) or 'International Payphone Network Management System' is a nice full software package (beta) used for administering the Elcotel, and is the default program used on the 9520C models. Download: ftp://www.elcotel.com/beta/190_158991 - Other software packages to look for: * Coin Net - http://www.elcotel.com/Products/software_detail.asp?id=8 * Expressnet - http://www.protelinc.com * PNMPLUS Lite - http://www.elcotel.com/Products/software_detail.asp?id=7 * Pronet - http://www.protelinc.com/PROTELInt/pronet/fpronet.htm * Telelink - available for download at http://www.ernesttelecom.com %% Remote Administration %% ID -- When connected to the Elcotel Payphone remotely, you'll be prompted for an Identification number. Now from what we're aware of, the ID numbers are assigned differently in accordance to the location of the payphone. Also, from what we were told by Elcotel installers (they're great for insider information) the Elcotel Remote Identification numbers range from 8000 and up. Knowing this, we can presumably say that all ID's are programmed to be four digits - or at least four digits by default. PIN -- One hunch I have is that the PIN alpha-numeric codes used for Remotely Administering the Elcotel payphones are exactly the same number of digits (8) one would be required to enter if they wanted to carry out Physical Administration. Remote Administration PIN codes using a Canada wide default, are programmed into all Elcotel Payphones? Perhaps, and the assumption isn't too broad either if we consider there is a default PIN used for physically disabling the Elcotel alarm (see Physical Administration). %% Software Options %% Previously I gave reference to Rate Tables, but the information given was a tad too general and didn't talk in enough detail to help the reader clearly understand what they'd be in for once they connected to the payphone remotely. Below is the actual table options from one of the many Remote Admin Software C programs accessible and fully available on my preliminary archive: http://home.edmc.net/~theclone/2nd_gen/c_files/c_scripts.html [!-- Cut phong1.scn --!] Option info OPTION FILE ........=############ (####) Next Date Phone Call In =!%%/%%/%%! RATE FILE ..........=############ (####) Next Time Phone Call In =!%%:%%! EXCEPTION TABLE .....=############ (####) No. Days Bump Call In =## LOOKUP TABLE .......=############ (####) POLL INTERRUPT DISABLE ..[-]#### DIAL STRINGS .......=############ (####) Enable History logging ..[-]#### RATE OVERRIDE ......=############ (####) Enable CDR [UP+CLEAR] ...[-]#### CCR TABLE ..........=############ (####) Cash Box records to save ..=## VOICE FILE .........=############ (####) Days for no activity ......=## IPIN TABLE .........=############ (####) Nickel equiv. for full CB =## SECURITY PARAMETERS =############ (####) DEBIT CARD TABLE ...=############ (####) DISPLAY option on ph.....[-]#### [/Cut phong1.scn] Browsing over this table, we see there are so many different options. Not only that, but the options available are surely useful for anyone wishing to collect information on Canada Payphone customers. - Central Administration Computer(s) [9520C] - All Elcotel 9520C series phones are pre-programmed to collect statistics about the amount of money they made, how many calls were placed (and for how long), how many days the phone has gone without use, and so on. You'd wonder how Canada Payphone would get this information, right? What they have done is programmed all the 9520C Elcotel's to directly send all its statistical information to the headquarters of Canada Payphone via modem - 14.4 data-transmission twice or more a month. The headquarters, in Burnaby British Columbia, have a central administration computer (or computers) which store the history every 9520C payphone statistic ever generated within Canada. If you were wondering what specific number the payphone calls in order to send the statistics, the carrier number is (604)-717-6532. When you call that number up with the Elcotel 9520C phone, you are given a credit of between 5-20 cents - on the display timer which usually counts the number of minutes a user is on the phone was instead counting down from 40 minutes. Which brings me to the assumption that the maximum amount of time it takes for the 9520C to send all of its statistical information to the HQ is approximately 40 minutes in length. - Web-site References - Useful Sites: Canada Payphone Corporation: http://www.canadapayphone.com/ Elcotel Coinless Services: http://ecs.elcotel.com/ Elcotel Coinless Services Overview: http://ecs.elcotel.com/overview/index.htm Elcotel Telecommunications: http://www.elcotel.com/ Hack Canada (Our Local Telco): http://www.hackcanada.com/telco/index.html Nettwerked (Elcotel Research [and Development]): http://nettwerk.hypermart.net/files/index.html#Elcotel_Research - Payphone News: GrapeVine in Canada - Press Release: http://www.elcotel.com/ectl/GrapevinePressReleases/BassPressRelease. htm Contacts: Michael Boyle Elcotel, Inc. (941) 758-0389 George Stolpe GWS & Company, Inc. (941) 925-0418 ELCOTEL, INC. TO PROVIDE NEW GRAPEVINETM NETWORK TERMINALS TO ALL BASS HOTELS & RESORTS PROPERTIES IN CANADA Through Agreement With Canada Payphone Corporation, Elcotel To Deploy Up To 10 Interactive Terminals In Each of 230 Bass Hotels and Resorts Properties SARASOTA, FL, January 20, 2000 Elcotel, Inc. (NASDAQ: ECTL) announced today it will deploy its interactive GrapevineTM network terminals in all 230 Bass Hotels & Resorts Properties in Canada, including Inter-Continental, Crowne Plaza, Holiday Inn, Holiday Inn Express and Staybridge Suites by Holiday Inn properties. Each hotel and resort will have up to 10 state-of-the-art GrapevineTM terminals installed. The contract is the latest development in Elcotels previously announced agreement with Canada Payphone Corporation (CPC) to purchase 45,000 GrapevineTM network terminals and services valued in excess of $125 million over five years. CPC has the exclusive rights to deploy and market the GrapevineTM network terminals in the Canadian market in an Alliance Partnership with AT&T Canada. CPCs agreement with Bass Hotels & Resorts Properties is a major step forward in the acceptance of GrapevineTM as the public communications portal of the 21st century, said Michael Boyle, president and chief executive officer of Elcotel. Over the coming months, the Canadian market will be among the first to access the power of personalized content, information services and e-commerce capabilities from a public phone. We are pleased to partner with both Bass Hotels & Resorts and CPC in this major evolution of how, when and why consumers use public communications to make their lives easier. Bass Hotels & Resorts is pleased to offer its customers state-of-the-art public communications, said Les Gable, senior manager, hotel telecommunications, for Bass Hotels & Resorts. We believe this will greatly enhance our guests experience and further position Bass Hotels & Resorts as the premier choice for travelers and business professionals alike. GrapevineTM combines traditional payphone capabilities with sponsor-paid advertising and content, e-commerce and personalized information services from the Internet in a public access setting. The GrapevineTM terminal network is powered by e-PrismTM, Elcotels comprehensive system for back office support and content management. This proprietary system manages the terminals and is designed to tailor advertising messages and future sponsor-paid content for each individual terminal Elcotel, Inc., based in Sarasota, Florida, is a leader in providing public access telecommunications networks and management services for both domestic and international wireline and wireless communication networks. Visit Elcotels corporate website at www.elcotel.com. With over 2,800 hotels and 450,000 guest rooms in more than 90 countries and territories, Bass Hotels & Resorts has an established, international brand-name property to suit every guests service, amenity and lodging needs. Each year, more than 150 million people stay at a hotel or resort bearing one of the Bass Hotels & Resorts lodging brands. Bass Hotels & Resorts is the hotel business of U.K.-based Bass PLC. Bass PLC American Depository Receipts trade on the New York Stock Exchange under the symbol BAS. The following are some of the service marks owned by Bass Hotels & Resorts, Inc., its subsidiaries or affiliates: Holiday Inn®, Crown Plaza®, Holiday Inn Select®, Holiday Inn Garden CourtSM, Holiday Inn SunSpree® Resorts, Staybridge SuitesSM, Holidex®, Priority Club® Worldwide, Inter-Continental®, Forum®, and Six Continents Club®. Bass Hotels & Resorts Inc. offers information and reservations capability on its pages on the World Wide Web www.holidayinn.com for Holiday Inn hotels www.hiexpress.com for Holiday Inn Express hotels, www.crowneplaza.com for Crowne Plaza Hotels and Resorts, www.staybridge.com for Staybridge Suites, and www.interconti.com for Inter-Continental Hotels and Resorts. Canada Payphone Corporation is the leading national competitive pay telephone service provider (CPTSP) and the exclusive provider installing AT&T Canada branded payphones and interactive public Internet kiosks across Canada. CPC along with its Alliance Partner AT&T Canada provides new and innovative high quality payphone products and services. Canada Payphone Corporation with offices located in Toronto and Vancouver is a public company traded on the CDNX symbol CPY. For more information, visit CPCs web site at www.Canadapayphone.com. Statements contained in this release may contain forward-looking information regarding the Companys plans, projections, or future performance, which involve certain risks and uncertainties that could cause the Companys actual results to differ materially from those expected by the Company. These risks and uncertainties include the risk of adverse regulatory action affecting the Company and the Companys customers, risk of competition, risk of obsolescence of the Companys products, and other uncertainties detailed in the Companys filings with the Securities and Exchange Commission. - Upcoming Projects - In the upcoming months you can expect me to be involved in several Elcotel projects, which for the most part will coincide with topics or past projects written in this documentation. The upcoming projects in this section are only a general idea of what is to come in the near future. My ideas and plans change without warning, meaning that I cannot guarantee anything that I boast about in this section. ` Audio samples to be added to Nettwerked [The Clone] ` Elcotel Central Administration datatapping (A "how to" manual) [The Clone] ` Miscellaneous Elcotel information to be added to this document [RT/The Clone] ` "PROJECT: Elcotel 9520C skan of (780)-420-9XXX" [The Clone] ` + much more! - Credits - I'd like to personally thank my associate 'RT' for working with me to learn everything there is to know about the Elcotel series phones, and of course for his contributions to this file. - Conclusion - In conclusion, I'd just like to note that this document will be updated periodically as I learn more about the Elcotel payphones' architecture and its security parameters. As Elcotel Telecommunications develops more technically advanced communication devices (ie. GrapeVine - 05/00), you can be damn sure I'll be the one hacking it and writing another document to share with the rest of the phreaking community. A N E T T W E R K E D P R O D U C T b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@! b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@! b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@! b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@! b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@!b0g!#@! _____ _____________ _+_/ | //` | __________ ((*,*)) | | | '.=.' | | gr1d is | _)_(_ | | a twat | /' :/ ' | | ,.,., | / (_ | _) | |__________| / / )_o_( | O / / / | /_) (_/ _|__|~|_________ | | |________________ | | , ||, |_______| || , ScS | / || ,