[VoIP] Nortel/Ambit ATA

[Steph Kerman]

Hi Keelan,

I just inspected inside a Linksys RTP300.  It has an unmarked row of 5 
pins on 0.1" centers and an umnarked and unpopulated 2x7" header 
location.  Both have a few pins with +3.3V on them and ample number of 
obvious grounds.  I'm going to inspect the pins with a scope during 
power up to see whether any of them wiggle in any rhythmic way.  If they 
do I'll find an RS232 driver chip.

Was there just the basic RXD, TXD and ground on the Ambit/Nortel or were 
there flow control lines too?

Steph

Keelan Lightfoot wrote:
> I thought I'd take a minute to share some information on what seems  
> to be a unknown brand of ATA.
>
> I happened across a couple Nortel single port ATAs (re-badged Ambit  
> ATAs) a while back. Like Vonage ATAs, they were locked up. The only  
> access I had was to a useless client-side interface where I could  
> change their network port settings. I popped the case open, and there  
> was a well-labeled serial port header on the board. With a RS-232- 
>  >3.3v level convertor I was able to access the serial console  
> interface, but it unfortunately was also limited without the correct  
> password.
>
> The good news is that if I rebooted it and hit ctrl-c during the boot  
> sequence, it would dump to a very simple boot monitor (commands:  
> help, exit, boot, memdump). I searched the resulting dump for the  
> password for the area that I had access to. About 2 lines of garbage  
> above my password was the supervisor password that gave me access to  
> the entire system.
>
> The interesting thing is that my two ATAs both had the same 6  
> character password -- It makes me think twice about the security of  
> some VOIP providers.
>
> Anyway, if you have access to one of these things, finding the  
> password is not too difficult given time and the motivation to do it.  
> They support pulse dialing, and have a fairly competent web based  
> management interface, and they play well with Asterisk.
>
> - Keelan
>
>
>