[VoIP] Nortel/Ambit ATA

[Keelan Lightfoot]

I thought I'd take a minute to share some information on what seems  
to be a unknown brand of ATA.

I happened across a couple Nortel single port ATAs (re-badged Ambit  
ATAs) a while back. Like Vonage ATAs, they were locked up. The only  
access I had was to a useless client-side interface where I could  
change their network port settings. I popped the case open, and there  
was a well-labeled serial port header on the board. With a RS-232- 
 >3.3v level convertor I was able to access the serial console  
interface, but it unfortunately was also limited without the correct  
password.

The good news is that if I rebooted it and hit ctrl-c during the boot  
sequence, it would dump to a very simple boot monitor (commands:  
help, exit, boot, memdump). I searched the resulting dump for the  
password for the area that I had access to. About 2 lines of garbage  
above my password was the supervisor password that gave me access to  
the entire system.

The interesting thing is that my two ATAs both had the same 6  
character password -- It makes me think twice about the security of  
some VOIP providers.

Anyway, if you have access to one of these things, finding the  
password is not too difficult given time and the motivation to do it.  
They support pulse dialing, and have a fairly competent web based  
management interface, and they play well with Asterisk.

- Keelan