On Sunday, 25 June 2017 12:36:27 UTC+1, Graham. wrote:
On Sat, 24 Jun 2017 10:18:34 +0100, "dennis@home"
wrote:

Well BT didn't use their knowledge well, as people were making such
calls without the operators catching on from what I remember

SteveW

It wasn't BT's problem, they just billed the calls to the line renter.
The renter could have incoming calls blocked if it was a problem.

That's correct, BT had no incentive not to bill the user for these
calls, remember when implemented, the payphone itself generated the
cuckoo tones when any of the allowed operator codes 1xx was dialled.

I actually discovered an exploit on the Landis+Gyr Agifon 50, and I
even brought it to the attention of the manufactures.
It had to have the original old firmware
The phone had to be set up for LD dialling

As I recall it went like this, the hookswitch was reasonably protected
with a delay so you couldn't "tap-dial" but in some exchanges with a
little practice you could use the hookswitch to dial a single "1"
you then dialled 0072 on the keypad normally.

The *exchange* would see 10072 which would of course connect you with
the operator (the 72 would be ignored of course).
The *phone* however would think 0072 had been dialled and that was at
one time a prefix for a toll free radipaging service, and the phones
firmware treated it the same as 0800 0500 0808, so no cuckoo tone!

Payphone security in the 80s was hopeless. If the internet had existed BT would have had to shut the whole payphone network down.


NT