30 BOCOTS could be Red Boxed (utilize inband ACTS tones to signal coin insertion) It s probably still possible in certain regions of the US but most RBOCs have outsourced to private companies.
31 COCOT Payphones can not be Red Boxed without Operator Intervention (as far as *I* know) because they don t use ACTS
32 With Smart Payphones all of the call regulation, coin counting and management, etc, is done inside the payphone. Telco payphones do all the magic at the Central Office.
33 Telling the difference? Most (All?) BOCOT Payphones use the General Electric style housing
34 Coin Return is on the Left and the armored cable connects to the front of the housing.
35 COCOTS often use the GTE style housing with the coin return slot on the right and the armored cable connects on the side. This is definitely not always the case, though.
36 This Payphone. Elcotel Series 5 Line-Powered Payphone Internal Battery, trickle charges from voltage on the telephone line Smart Phone, Programming/Rates are handled internal to the Payphone
37 Elcotel used to be prolific with the private coin phone market Now they re all but gone from most places
38 Now that I have one
39 Problem? No keys. No battery. No documentation. Phone was from different area code.
40 How to do? Get the phone open Replace the battery Reprogram for free calls.
41 Opening the phone
48 Preserving the tomb. No destructive entry, wanted to keep the phone as intact as possible.
50 Three types of Keys Upper Housing Lower housing (coin vault) T wrench for torque. You need all three.
51 Upper Housing Lock 3 pins, no security Pins. Easy enough to pick in a short period of time. Anti-impressioning divots. Note: These locks tend to only rotate a quarter of a turn or less. Check, you may have already picked it.
52 Coin Vault Lock? Not so much. 4 Pins, several spool pins. Medeco Locks, though not biaxial At that time, I was unable to pick it.
53 Hacker Con Took the phone to Bay Threat in Mountain View 30 people tried, failed.
54 Except one guy. Dude picked this lock in 10 seconds, by accident. Fuuuuuuuuuuu.
55 Opening the housing Didn t have a T wrench, time to hack harder.
56 Opening the housing Vyrus001 and I were able to hack something together. Badge clip, wrench, faith.
57 Opening the housing
59 Dead battery.
61 u mad bro?
62 Now that it is alive How do I use it?
63 How to do? Different area code means local (to me) calls were $$$$$$$ Unacceptable.
64 GOALS: The goals: Zero out the rates tables to make free calls Find vulnerabilities in payphone software... Profit?
65 First Hack: Payphone -> ATA -> Asterisk -> 911 Payphones are legally required to make 911 a free call. Dial plan magic allowed me to get a usable dial tone if I first dialed 911. Neat hack, but sloppy.
66 Documentation? Nearly non-existent. Archive.org was helpful, to an extent. I learned how to reset phone to default, but that s pretty much it.
70 Incomplete. Was only able to find part 2 of a 3 part series of manuals. Basically, this was the rosetta stone.
71 Part 2 was useful, but I still didn t have the software to reprogram it.
72 3 Ways to Program: 1. Software based reprogramming 2. Local telemetry 3. Remote Telemetry
73 Software Ideal solution, but requires the software and a license from a dead company.
74 Local Telemetry Open the Phone (which WILL set off alarms and call the phone owner if you try this in the field) Default the Phone Listen to voice prompts and dial to set values.
75 Remote Telemetry Can allegedly reprogram remotely? (More on this later)
76 Software based programming Eventually I was able to acquire a demo through alternative means. Time to try and crack the software.
77 Cracking 10 year old software is actually pretty hard. 16-bit Windows NE Binary Even IDA Pro was all WTF Mate?
78 I had a lot of help. And by help, I mean that someone did it for me. Eventually able to hook the installer, jump the serial number check, uncompress the installer archives. Thanks to Vyrus001, int0x80, Frank^2
80 Phone has onboard modem called a PCM (Payphone Control Module) Need to be able to dial it though. Ironically, I don t have a landline.
81 Voice over IP Unlocked Linksys Analog Telephone Adapter (ATA) USB Modem
82 Voip Settings Dial up modem over VoIP is a pain in the ass. Ulaw or Alaw, accept no substitions. Disable Noise Cancellation + Echo suppression Really slow, ~ 9600 baud
83 A HUGE Thanks! to the Telephreak guys (Hi Beave!) and the Oldskoolphreak.com guys for helping me get this sorted out.
84 Default the phone Press and hold the button inside the phone. Flash the hook. Listen to onboard prompts
85 Local Telemetry Press the button, flash the hook, enter the code, follow the voice prompts. Super easy, but requires you to physically open the phone. If the phone is not yours, this is dubious.
86 Now we can connect.
87 Once you are able to connect, the rest is pretty easy. But this talk is also about hacks, not using software.
89 Elcotel Engineers? Not total idiots. Anti-fraud Mechanisms: Secondary Dialtone Detection Red box detection Chassis Alarms Brute Force Protection
90 Need to build a harness to fuzz the phone. Intercept modem audio? Easy enough with SIP, but then what?
91 FSK Demodulation is crazy hard.
92 Blackbox RE of Protocol If I could intercept and analyze how the software does it, I can do it myself. How do I hook a USB Modem?
93 Advanced Serial Port Monitor Pro Able to treat USB Modem as virtual serial port Spy Mode allows you to pass through and watch Displays output in either Hex or ASCII
94 Password? Default password for software reprogramming is Default password for local and remote telemetry is
95 Performing actions using the PNM Plus Elcotel application enabled me to see what actions look like in Hexadecimal From there I was able to make *some* sense of how the handshake worked Phone ID is usually the last 4 digits of the phone number. Passwords are almost never changed from defaults.
97 Demo Oh dear $deity please work.
98 Auth Protocol Breakdown
99 Success vs. Fail When authentication fails, the Phone sends a hexadecimal NAK (Negative Acknowledgement) 0x15 When authentication is successful, Phone sends hexadecimal ACK (Acknowledge) 0x06
100 Problem. After 3 invalid attempts, the phone drops the call. However, the PNM software is responsible for interpreting the disconnect message. If we use our own code we can ignore that and keep trying until we get the right PIN.
102 Pseudo Code: PIN = 0000 send $PIN while ($auth_response!= 0x06) $PIN++ send $PIN if $auth_response = 0x06, print GREAT SUCCESS!
103 Python has a good serial interaction library, but I don t code because I m an idiot.
104 So Gene Erik jumped in. Man I love having smart friends. https://github.com/savantdc949/ Code will be online some time after Defcon hangover clears.
105 User ID? Check. Pin? Check.... Proft?
106 Enter: Remote Telemetry Call payphone from any landline phone Wait 30 seconds for Modem to stop screaming at you Have 10 seconds to enter telemetry password Listen to voice prompts
107 Reprogramming using DTMF (Remote Telemetry) Registers = Strings Options = On or Off Reg = Antifraud. Set to 0 to disable. Reg , 412, and 414 = Disable alarms
108 More registers 404 = Phone number 402 = Phone ID# 403 = PNM Plus Password 400 = Telemetry Password 116 = Disable battery (DoS) 338 = Number for service desk
109 Service Desk Sudo/Operator status for Payphones Apply credit Issue refunds Dump the coin escrow ($$$$) If you divert this number to yourself, you can do cool stuff. Force phone to dial number for free
110 We can set the coin escrow to $5. As people use the phone, up to $5 in coins collect in the escrow hopper. Service desk can cause hopper to empty into coin return slot.
112 Now what? How can we use this information in a novel way?
113 ProjectMF Blue Box simulation of Inband signalling over TDM trunks.
114 Red Boxing Use sox and Asterisk EAGI to record and analyze inbound audio. Filter out all frequencies that are not 1700 Hz and 2200 Hz tones together If not null, incremend $coin_value If $coin_value >= $.25, make call
115 Now what? How can we use this information in a malicious ways?
116 Unlocked Linksys PAP2 ATA + PwnPlug + Alfa Wireless USB wireless = PayPwn! Asterisk system() command lets us pass OS calls from DTMF Macro the most popular pentesting tools Cepstral/Festival TTS to receive responses
117 Nmap by Phone Demo!
118 PwnPlug has built in support for slimmed down Asterisk. Use Alfa to hook into a wireless network DTMF to initiate scans, cracking, etc etc
120 There *are* easier ways to do this, but what the hell? This is fun.
121 Be honest with me. If you saw a Payphone, would you expect it to be a covert adventurer/badass?
122 Call Interception Using the Asterisk ChanSpy() application we can monitor *all* voice traffic that goes through PBX. Roll payphone into a Casino. Wait for people to use the phone. Listen. Magic.
123 Demo. Volunteer?
124 In summary Using this information we can utilize Remote Telemetry to own any Elcotel Payphone Like any archaeological dig, we can learn a lot about the way developers used to think We can then apply this logic to other legacy systems still in the field (SCADA, etc) PayPwn = Only limited by your imagination
125 If I have my way, they will live forever.
126 More information (Hack Canada Elcotel Archive) (some Elcotel docs) https://github.com/innismir/asterisk-scripts (nmap by phone) https://github.com/savantdc949/ Payphone.com (thieving bastards)
128 Thanks! Defcon Tiffany and Gene Erik (for the payphone and code) docwho76 for the title image Hack Canada for the docs DC949 Innismir, BlackRatchet, DaBeave, Strom Carlson, Binrev.com hackers, oldskoolphreak.com You!
Linksys PAP2T Configuration with VirtualPBX The Linksys PAP2T is an inexpensive ATA device that connects to the internet and registers with your Virtual PBX extension, allowing you to use any analog phone
X100P.com s STOC-FX World s First Professional Grade VoIP FXS to FXO Converter Compatible with All FXS Ports of Digium Asterisk VoIP PBX Copyright (c) 2006 by X100P.com All rights reserved including the
Inter-Tel 3000 IP Phone Quick Reference Guide Introduction to your IP Phone The Inter-Tel 3000 IP Phone provides the same functionality as the Inter-Tel 3000 digital telephone sets. It can be connected
Connecting Sipura ATAs to a legacy PBX System. The FXO port (line port) of a Sipura SPA 3000 can be connected up to an analogue extension port of a PBX system in just the same way it is connected to an
2100 Series VoIP Phone Installation and Operations Manual Made in the USA 3 Year Warranty N56 W24720 N. Corporate Circle Sussex, WI 53089 RP8500SIP 800-451-1460 262-246-4828 (fax) Ver. 4 www.rathmicrotech.com
Firmware version: 1.10 Issue: 7 AUTODIALER GD30.2 Instruction Manual Firmware version: 2.0.1 Issue: 0.6 Version of the GPRS transmitters configurator: 220.127.116.11 Date of issue: 07.03.2012 TABLE OF CONTENTS
Digital Phone - User Manual The following are simple instructions and suggestions on how to better utilize your Digital Phone service from Micrologic. Should you need further assistance, do not hesitate
12-36-1000 Autodialler and Relay Telephone Interface 1.0 INTRODUCTION 12-36-1000 I/O Telephone Interface with AutoDialer The 12-36-1000 is a autodialer and telephone interface that can be used autonomously
From 8 to 32 channels Integrated LCR / Router Voice Call Back SMS Server VOIP RACK 3U SMS PRESENTATION Specially designed for big companies, call-centres and companies whom GSM traffic is high, PRImaGate
Product: 930A L3 Communications Test Set 935AT Communications Test Set APPLICATION NOTE # Using Sage SMOS for VoIP Testing, IP Phone to IP Phone TABLE OF CONTENTS Introduction... 2 Configuring 935AT #1
Thank you for choosing NEC SL1100 Distributors! This Installation Packet is Organized into Five Chapters: BLUE: Hardware Installation Overview (Block Wiring, Music On-Hold, Paging, Door Box & Relays) GREEN:
User Manual Welcome Unleash Your Phone For assistance with installation or troubleshooting common problems, please refer to this User Manual or Quick Installation Guide. Please visit www.vonage.com/vta
61200796L1-29.1G March 2013 Configuration Guide Configuring Shared Line Appearances over Analog Trunks This configuration guide explains how to configure shared line appearances (SLAs) on AOS voice products
1 2 This slide shows the areas where TCG is developing standards. Each image corresponds to a TCG work group. In order to understand Trusted Network Connect, it s best to look at it in context with the
Intermedia Cloud Softphone User Guide FOR MORE INFO VISIT: CALL US EMAIL US intermedia.net +1.800.379.7729 firstname.lastname@example.org 1 Contents 1 Introduction... 3 1.1 Cloud Softphone Features... 3 2 Installation...
Record of Revision Release Date Version Supersedes Description March 2008 Initial Release Initial Release Copyright 2006 We reserves the right to make changes in specifications at any time without notice.
Table of Contents Device SIP Trunking Administrator Manual Version 20090401 Table of Contents... 1 Your SIP Trunking Service... 2 Terminology and Definitions... 2 PBX, IP-PBX or Key System... 2 Multi-port
By James Thomas DTEC 6823 Summer 2004 What is a firewall? Firewalls for small business A firewall is either hardware, software or a combination of both that is used to prevent, block or should I say try
The 21 st Century Business Telephone System VOIP PBX Telephone System Develop with open standard PLATON is an all-in-one IP-PBX solution for your business operation. It s a PBX system which connect all
IVR Security:- Internal A3acks Via Phone Line Who am I? Rahul Sasi Security Researcher @ isight Partners. Member Garage4Hackers. Garage 4 Hackers InformaGon Security professionals from Fortune 500, Security
Cisco Unified IP Phone 8961, page 1 Cisco Unified IP Phone 9951, page 9 Cisco Unified IP Phone 9971, page 18 General Phone Information, page 27 Cisco Unified IP Phone 8961 The following sections describe
Memcom Emergency Telephone Installation Guide Ref No. 450 900 (GB) Version 2 + + Simple wiring for quick installation + + Integrated LCD display shows you what you have programmed + + All code based programming
Wireless Encryption Protection We re going to jump around a little here and go to something that I really find interesting, how do you secure yourself when you connect to a router. Now first and foremost
AA9604 Auto Attendant Operation Manual 10AA96V4M.2.13.EN1 DSG, DSG logo, AA9604, VL880, VL880L, IM1200, IM2400, IL1000 and IL5000 are trademarks of DSG Technology. Windows and Outlook Express are trademarks
Voice Call Addon for Ozeki NG SMS Gateway Document version v.18.104.22.168 Copyright 2000-2011 Ozeki Informatics Ltd. All rights reserved 1 Table of Contents Voice Call Addon for Ozeki NG SMS Gateway Introduction
Cisco Linksys SPA 2102 Phone adapter with Router for your Internet calling 1 www.joip.com Home Phone Adapter 1. Introduction... 3 2. Signup... 4 3. Using the Linksys Phone Adapter as an ATA... 6 3. Using
CHAPTER 3 This chapter includes the following topics, which help you install the Cisco Unified IP Phone on an IP telephony network: Before You Begin, page 3-1 Understanding the Cisco Unified IP Phone 7962G
epbx-100 User s Manual V.1.1 1. OVERVIEW...4 1.1 SPECIFICATIONS...4 1.2 HARDWARE OVERVIEW...6 1.2.1 Front Panel and LED Indication...6 1.2.2 Back Panel...7 2. START TO CONFIGURE EPBX-100...8 2.1 STEP 1...8
system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped
Model PBX816ex Programming & User Guide 1 Introduction... 5 Installation hints... 5 Expanding Your System 5 System programming... 6 System password... 6 Changing the password... 6 Exchange line set up...
WiFly Evaluation Kit 2012 Roving Networks. All rights reserved. Version 1.32r 10/9/2012 USER MANUAL OVERVIEW This document describes the hardware and software setup for Roving Networks evaluation kits,
3CX + Solicall PBXMate by Roshen Singh (May 2011) Page 1 3CX + PBXMate Set up guide After having various issues reported with call quality, I began looking for a solution that would fix, monitor or improve
DC-8706K Auto Dial Alarm System User Guide Basic Contents: 1x the host unit; 1x wireless door (window) magnet; 1x wireless infrared detector; 2x remote control; 1x siren; 1x phone core; 1x AC to DC power
GSM VOIP GATEWAY GB 400 010 with GSM module Two-way converter between VoIP and GSM User Guide LEVEL 2 Dear customers, Congratulations on purchasing our product - GSM Gateway GB 400 010. You have acquired
Security Art August 2011 Sounds Like Botnet Itzik Kotler, Chief Technology Officer Iftach Ian Amit, VP Consulting www.security-art.com Intro to VoIP It s everywhere Home (Vonage, Skype, TeamSpeak, Comcast,
Single-User VoIP Service User Manual Version 20080501 Revised 20110202 Table of Contents Table of Contents... 2 Your VoIP Service... 2 Who Should Read this Manual... 2 Basic Features... 2 Optional Features...
Small & Medium Office Business IP PBX UTT-500 series Quick Details Place of Origin: Guangdong, China (Mainland) Brand Name: Ultrative or OEM Model Number: UTT-500 series Type: VoIP PBX Processor: DualCore
The 21 st Century Business Telephone System VOIP PBX Telephone System Develop with open standard PLATON is an all-in-one IP-PBX solution for your business operation. It s a PBX system which connect all
HPUG_1014 Shaw Home Phone. User Guide Hello. Welcome to the wonderful world of Shaw Home Phone. This tiny book tells you every detail you need to know to use all of your new phone features like a superstar.
Avaya Solution & Interoperability Test Lab Application Notes for Configuring Cablevision Optimum Voice SIP Trunking with Avaya IP Office - Issue 1.1 Abstract These Application Notes describe the procedures
INSTRUCTION MANUAL All-In-One GSM Home Alarm System SB-SP7200-GSM Revised: August 28, 2014 PRODUCT REFERENCE MOUNTING ACCESSORIES PIR / MOTION DETECTION UNIT MAIN UNIT POWER ADAPTER MOUNTING ACCESSORIES
User Manual Names of Parts Record Button Mic Status Indicator Micro SD Card Slot Speaker Micro USB Port Strap Hook Video Mode Photo Mode Local Mode Cloud Mode Mode Button Power Button Tripod Mount Clip
Breathe. Relax. Here Are the Most Commonly Asked Questions and Concerns About Setting Up and Programming the SurroundBar 3000. Our Customer Service Department has compiled the most commonly asked questions
Medical Alarm Unit Instruction Manual Power Light Normally STEADY GREEN Blinks SLOWLY when back-up battery is charging Blinks QUICKLY if AC is absent (Console is on battery power) TEST Your Medical Button
Mediatrix 4400 Digital Gateway VoIP Trunking with a Legacy PBX June 21, 2011 Proprietary 2011 Media5 Corporation Table of Contents Table of Contents... 2 Introduction... 3 Mediatrix 4400 Digital Gateway
Cisco Unified IP Phone User Guide for Cisco Unified Communications Manager 8.5 (SCCP and SIP) For Cisco Unified IP Phone 8941 and 8945 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San
Configuration Guide for connecting the Eircom Advantage 4800/1500/1200 PBXs to the Eircom SIP Voice platform. 1 Contents Introduction.... 3 Installing the Applications Module... 4 Ordering a Licence for
Work Off-Line Set up a new database or modify a previously saved database (without being connected to the telephone system). This helps minimize on-site programming time. Work On-Line (connected directly
SECURITY SYSTEM MANAGEMENT SOFTWARE FOR WINDOWS WINLOAD MODEM SETUP The modem setup is a very important step in the connection process. If the modem setup is not properly completed communication between
eircom advantage 4800 System Introduction Specifications subject to change without notice. Facilities described may or may not be supported by your network. eircom advantage is the registered trademark
UNIFIED MEETING 5 SECURITY WHITEPAPER INFO@INTERCALL.COM INTERCALL.COM 800.820.5855 1 As organizations unlock the true potential of meeting over the web as an alternative to costly and timeconsuming travel,
V o I P G S M G A T E BlueGate SIP 1 Installation and setup guide V 1.0 1. General description 1.1 Technical parametres Dimensions 100 x 130 x 37 mm Weight 850 g Operating position various Operating condition
Personal USB VoIP Gateway User s Guide Contents Contents... 2 Welcome... 3 Package Contents...4 Requirements... 5 USB Gateway Installation... 6 Enabling USB GATEWAY... 18 USB GATEWAY States... 20 USB Gateway
Jtech engineering ltd J - Te c h E n g i n e e ring, L t d. 11080 Bond Boulevard Delta BC V4E 1M7 Canada Tel: 604 543 6272 Fax: 604 543 6476 http://www.jtecheng.com AUTODIALER USER S MANUAL REVISION HISTORY
OWNERS MANUAL Status Monitor for Windows 95, 98, ME, NT 4, 2000 & XP SIGNALCRAFTERS TECH, INC. www.signalcrafters.com 57 Eagle Rock Avenue, East Hanover, NJ 07936 Tel: 973-781-0880 or 800-523-5815 Fax:
Using Asterisk with Odin s OTX Boards Table of Contents: Abstract...1 Overview...1 Features...2 Conclusion...5 About Odin TeleSystems Inc...5 HeadQuarters:...6 Abstract Odin TeleSystems supports corporate
1 Hiro H50113 System Requirements Hiro H50113 Computer with Pentium 200 MMX or higher processor. Windows 2000, Windows XP Home / Professional, XP Professional x64 Edition, Vista 32 / 64 Families, Windows
Quick Start Guide Introduction Installation Overview Setting up the Ooma Office system in your business is easy. You should have your first extensions up and running in about 20 minutes. Ooma Office blends
Network Control Protocol Important notes Binary Code The strings shown on the next pages are in binary coded format. Please be aware that any terminal program you may use to control a Network unit from
System Administration Guide Model KS 832 Expandable up to 1664 Introduction 4 Installation Hints 4 System Programming 5 - System Password 5 - Changing Password 5 Exchange Line Set up 6 - Caller Display
COMSPHERE 6700 SERIES NETWORK MANAGEMENT SYSTEM SECURITY MANAGER FEATURE SUPPLEMENT Document No. 6700-A2-GB41-30 February 1998 Copyright 1998 Paradyne Corporation. All rights reserved. Printed in U.S.A.
VoIP Telephone Adapter User s Manual Last Update: 2008/10/10 1 Introduction...3 1.1 Product Overview (Single Phone Port Model)...3 1.2 Product Overview (Dual Phone Port Model)...4 2 IVR Interface for TA...6
LINKSYS / SIPURA SPA-1xxx/2xxx/3xxx CONFIGURATION GUIDE Minimum Requirements Active Freshtel Internet Phone account o http://www.freshtel.net Broadband Internet Connection o 256/64 kbps minimum Broadband
G DATA Software 1. Introduction G DATA INTERNET SECURITY FOR ANDROID offers comprehensive protection against malware, intrusive apps and phishing attacks. Locate lost devices or wipe their content remotely
KD-204 Telephone Remote Switch Operating Instructions 1. GENERAL DESCRIPTION The telephone remote switch consists of three parts, which are the telephone modem that can be connected to the landline telephone
Adapter GL386 User Manual is available in other languages at www.glipfone.com GL386 User Manual Contents: Chapter 1 Introduction ---------------------------------------------------------------- 1 Chapter
Expert Reference Series of White Papers Avaya Aura Communication Manager System Class of Service (COS) 1-800-COURSES www.globalknowledge.com Avaya Aura Communication Manager System Class of Service (COS)
X3 Micro FAQ X3 Micro General 1. What is the main difference between the X3 micro and other Bluetooth headsets? 2. What is included in the X3 micro package? 3. How does the X3 micro use the Bluetooth technology?
Cisco Unified IP Phone 8961, 9951, and 9971 User Guide for Cisco Unified Communications Manager 8.6 (SIP) Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com
GUIDE TO SYSTEM DOCUMENTATION 2 Get Started Guide 2 Phone Quick Reference Guide 2 Detailed User Manual 2 Detailed Broadband Module Manual 2 BT VERSATILITY WIZARD User Manual 2 SYSTEM DESCRIPTION 3 System
POS 208 / 808 DISTRIBUTED BY INTELLIGENT CASH DRAWER WEDGES MADE IN CANADA USER S MANUAL 2 Table of Contents Introduction............................................... 3 POS 208 Installation........................................
M-Digital Installation Guide O V E R V I E W What is M-Digital? The M-Digital enables you to make low cost calls through your internet connection using a normal telephone, by using the Linksys Phone Adapter.
UniCom Enterprise Phone (Polycom CX600) User Guide 1 6 What is UniCom Enterprise?...1 Frequently Used Make a Call...6 What is Microsoft Lync?...1 Call Functions Use Call Controls...7 Who can use UniCom
ZyXEL IP PBX (X2002) VoIP Support Notes Version 1.00 October 2008 1 Contents Overview ZyXEL IP PBX Support Note 1. How to manage and maintain your IPPBX?...3 1.1 Firmware Upgrade..3 1.2 Backing up your
Analog Telephone Adapter Network settings via Keypad commands: The ATA series phone adapters (VIP-156/VIP-156PE/VIP-157/VIP-157S) support telephone keypad configurations, please connect analog telephone