MMM MM MERIDIAN
MMMMM MMMMM
MMMMMM MMMMMM
MMM MMM MMM MMM MMM MM MAIL
MMM MMMMM MMM MMMMM MMMMM
MMM MMM MMM MMMMMM MMMMMM
MMM MMM MMM MMM MMM MMM
MMM MMM MMM MMMMM MMM
MMM MMM MMM MMM MMM
MMM MMM MMM MMM
MMM MMM MMM MMM
MMM MMM MMM MMM
MMM MMM MMM MMM
MMM MMM MMM MMM
Copyright (c) Northern Telecom, 1993
Introduction To The Meridian Mail Voice Mail System
©1995 Cold Fire
I've just read the distinctly un-Complete Guide to Hacking Meridian Voice
Mail by Substance in issue #47 of Phrack. Now that I've managed to stop
laughing I've written this file to explain more fully the characteristics
and use of the Meridian Mail syste.
This file is not intended as a guide to hacking the system, any fool can
do that, but to explain the workings of the system, as far as I've
managed to work out anyway. While Substance might have little more on his
tiny mind that how to abuse the system, most phreaks are more interested
in understanding the workings of the system, then abusing it. I wouldn't
mind so much if Substance was good at fraud, but he isn't, for example in
his explanation of the mailbox options menu:
>Mailbox options 0 (Changes operator code (not useful)
Lets see, an option that allows us to change the number that callers are
put through to when they hit zero for assistance. Could this be useful to
someone looking to abuse the system? Perhaps this could be changed to an
external number? Maybe this method of dialling out can sometimes be used
when normal methods are blocked? But no, Substance in his wisdom decides
to dismiss it as "not useful", rather than trying to find out what it does
as any true phreak would have done. Maybe you'd better stick to your
3l33t code lines.
All I can say is Erik Bloodaxe must have been pretty desperate for stuff
to put in this issue. And to Substance, this isn't meant to be a personal
attack, but it's people like you who give hacking a bad name.
Now that I've finished slagging off Substance, on with the rest of the
file. This is in no way a complete guide to the system, concentration
mostly on the user interface. Many of the details in here may be
incorrect, they've mostly being worked out throuh personal experience and
knowledge of how other Voice Mail systems work. Feel free to correct me if
I've got anything wrong. Also this files is only based on Meridian's in
the UK, while there are probably no real differences between the UK
Meridian's and US ones, there are slight differences in the set-up and
defaults.
THE MERIDIAN RANGE
To start with Meridian Mail is an add-on for the Meridian range of
switches made by Northern Telecom.
Meridian switches are marketed and sold in the United Kingdom by British Telecom.
The Meridian range consists of at least the Meridian Compact, Modular and
Option models. The Meridian 1 Option system comes in various size
11/21//51/61 and 71. The Meridian Mail voice-mail option is for the
Option models and so it is the Option models I will concentrate on here.
Option11 will refer to all the Option models a I don't think there's any
real software differences other than size between them.
The Meridian range is not cheap, the price of a Meridian Compact CPU is
about 2000 UK Pounds from BT, however they can be got second hand for
about 200 Pounds.
Because of its price the Meridian 1 Option 11 and Meridian Mail
voice-mail option is only used by reasonably large companies. Also
because the Meridian Mail system is an add-on for the main switch rather
than a stand alone voice-mail system it is rarely used by companies
rentingout mailboxes. There are far more suitable systems for this sort of
use.
The Meridian Option PABX is supposedly difficult to program, It uses an
OS called X11, so system administrators have can buy software for various
platforms which can then be used to program the PABX through it's
programming serial port. For example Switchview comes with its own
database and runs under UNIX. It consists of modules, e.g. System Admin.,
Directory, Cable management, etc.
There is also the Meridian Administrator Tool, made by NT and available
from BT, this runs under Windows on a 286+. This includes a terminal
emulation facility for programming the parts of the system that MAT
doesn't reach. The Meridian Communications Adapter with Visit software
allows management of Voice-mail via Windows too.
Many company's use call loggers which record every call made through the
system, including calls made through dial out facilities in voice-mail.
This includes recording of the extension the call is made from. It is
likely that where Calling Line Identifiation is available this information
can be recorded too.
CALLER ID AND MERIDIANS
Note: this is all specific to UK Caller ID
Option 11's connected via ISDN have CLI capabilities, and in theory will
feed the information directly through to 2616 Digital Feature Phones and
2008 Phones equipped with display modules. However in practise this is
not always the case, while the remote caller's number is displayed
correctly on the Attendant console it is not passed through to the display
handsets on DDI calls. BT suspect that this is a bug in the NT code.
However they may have fixed this problem by now. I think that it's the
same with LI on analogue lines, but I couldn't say for sure, most large
Meridian systems are connected via ISDN30 anyway. As far as I know the
Meridian Compact and Modular systems will not support CLI at all.
MERIDIAN MAIL
The Meridian Mail Voice Mail system is one of the most sophisticated, as
well as answering calls it can handle intelligent call routing,
distribution groups, out-dialling, dialling the sender of the message,
etc.
Because the versatility of the Meridian Mail system it can be difficult
to spot one. There are four main set-ups you might come across.
1) Log-In Box
This is the rarest set-up you're likely to come across, however it is
instantly recognisable. Basically this is where an DDI number has been
set up just to receive calls from people calling to collect messages.
Obviously small companies do not want to pay for an extra line just for
people collecting messages, especially if the volume of mail is low, so
this is only likely to be on a DDI or 0800 line on a very large system.
If you do find one of these you'll here a digitised women's voice say
"Meridian Mail" followed by the normal login prompt: "Mail Box" if you
don't enter a number you'll here "Please enter your mailbox number
followed by square sign, For more information press star". Once you've
entered a number followed by # you'll here "Password". For example try
0800 318409.
2) DDI Numbers
This will act just like an answer phone, e.g.: "Hi you've reached Mark
Richardson at ABC Inc, unfortunately I'm away from the phone at the
moment so please leave a message after the beep". If the outgoing message
has not been recorded you might get "The person at extension XXXX is not
available to take your call" or if they've recorded their personal
verification "xxxxxxx is not available to take your call". Some times a
company will not have used the more advanced features and the main number
also be set up in this way. To access a mailbox from this set-up, while
the outgoing message is playing press star. Once the beep has sounded just
press # to stop recording. Once you've done this you'll get a menu giving
you various options for recording a message. To get a list of all the
options available press *. * is the help key in Meridian Mail if you get
stuck at any time just press *. This menu is just a cut down version of
the main mailbox menu. At this point to log in to a box press 81 you'll
then get the log in prompt described above. A good example can be found on
0800 622581.
3) Call Routing
This is one of the most advanced features of Meridian Mail, and it allows
the caller to decide where he wants be routed to, e.g. "Press One for
Sales, Two for Technical Support", it can also be used to allow the
caller to enter the extension number they want, e.g. "Enter the extension
number and press square". If you get this sort of message just get to a
mail box then follow the instructions as if you'd got through to a DDI
box. You may also come across set ups where pressing * or # re-starts the
message and pressing any other key gives a error message, and at the end
of the message you get transferred to a mail box. In this case you must
wait until you've been transferred into a mailbox then break in. An
example of call distribution is on 0800 136214.
4) Outgoing Message Only
In this case there's nothing much you can do. Pressing * or # will just
restart the message and any other key gives a "beep! That selection is
not recognised, please make another choice" the outgoing message may
replay a couple of times and will then disconnect you. This type of set-up
is usually found on systems that have been abused or are owned by
companies that don't want you to leave them a message, e.g. Banks who
don't want to take responsibility for net getting messages. If you find
one of these your best bet is to call during office hours and try and
talk a DDI number for some dept out of the receptionist.
DIFFERENT TYPES OF MAIL BOX
Unlike many Voice Mail systems Meridian Mail has no Administrators Box.
The Administrators box is usually a box that has special options, such as
the ability to add new mail boxes, remove old boxes, change passwords
etc. Unfortunately there isn't one on meridian Mail. When the
administrator add mail boxes though they do have several classes of
service they can use for boxes, e.g.:
- Login Box
- Callers dialling this ext. number will get a "Meridian
Mail, Mailbox" prompt.
- Distribution List
- This is simply a box set-up so that a message
send to it will be distributed to every on else on this list. This is so that individual users don't have to maintain their own personnel distribution lists.
- Express Messaging
- People calling this mailbox no, will get a
prompt: "Express Messaging, Mail Box Number" This is to save people having to call your ext. no and wait for it to ring out before leaving a message.
- Prompt Maintenance
- Dialling this extension will give you a
"Prompt Maintenance, menu ID" this allows you to change the prompts in menus
There's also a box that allows you to change peoples outgoing
message and verification remotely, i.e. without logging in to their
mailbox and changing them.
There are probably others but those are the most common.
MAILBOX NUMBERS AND PASSWORDS
There is no set length for mail box numbers and they range from 2 - 6
digits depending on the size and set up of the system. 4 digits is almost
always the length though.
There is also no default mailboxes as there are on other systems, however
3000 is usually a good bet in the UK.
The default password on Meridian Mail systems is the message number. If
this doesn't work try the mailbox number backwards, passwords can be from
4 - 16 digits long, and you can't use recently used password. You only
have 3 tries to get the mailbox number right before it disconnects you. If
the wrong password is entered too many times then the mail box will lock
and even the real owner will not be able to get in. The number of tries
necessary depends on the system in the UK its usually 9, you can tell a
box has been locked if you enter the mailbox number and a password and it
tells you to contact your system administrator after only one try instead
of three.
DIAL IN PORT
Meridian Mail dial in ports are rarely found on DDI lines, but can be
found by scanning extensions within the company, many other interesting
things can be found this way too. They are always, in my experience 2400
baud modems and give no prompts. To get a prompt you need to press CTRL W
this will give you a menu with two options. CONSOLE and MMI, select MMI
(Man Machine Interface) and you'll get that nice Meridian Mail logo.
From there press F1 to logon. After that you're on your own.
USING YOUR MAILBOX
When you login to your mailbox there are several greetings you may
hear:
"your mail box is empty, to compose a message press 75, for mailbox
commands press 8*"
"You have X new messages, message X from "
"You have no new messages, message one from "
0 - Zero on its own will transfer you to the operator assistance number. 011 will let you look up names in the directory. 0XXXX will dial that number, assuming its passes the call blocking mask.
1 - Rewinds the current message about 10 seconds
2 - Play message
3 - Fast Forwards the current message by 10 seconds
4 - Previous Message
5 - Record, used when composing or forwarding a message.
6 - Next Message
7 - Message Commands(Sub Menu)
0 - Message Options (Sub Menu, can only be used on outgoing messages)
1 - Urgent, tag a message for urgent delivery.
2 - Standard, tag a message for standard delivery.
3 - Economy, tag a message for economy deliver.
4 - Private, tag a message private (private messages cannot be forwarded to other users)
5 - Acknowledgement, tag a message for acknowledgement, you'll be send an acknowledgement message when the message is received.
6 - Timed Delivers, specify a time and date for delivery.
1 - Reply, sends a message to the sender of the message. Can only be used on incoming messages from mailboxes on the same system.
2 - Play envelope - Gives all the details of the messages, such as who its from, time, if it was urgent, attached messages etc., etc.
3 - Forward, forward the message to another user.
4 - Reply All, record a message to all the senders of the messages in your mailbox.
5 - Compose, compose a message to other users, either just one, a distribution list, or several boxes.
6 - Delete, deletes message, or if used on an deleted message restores it.
9 - Sends a message you've just recorded.
8 - Mail Box Commands (Sub Menu)
0 - Mailbox Options (Sub Menu) (Not always available on earlier versions of the software)
1 - Change Operator Assistance Number
1 - Login, enters the login process.
2 - Greeting (Sub Menu)
1 - External, record a greeting to be played to external callers.
2 - Internal, record a greeting to be played to internal callers.
3 - Log-off
4 - Password Change, change your password, enter your new password twice and your old password.
5 - Distribution Lists, create distribution lists.
6 - Goto, goto a message number in your mailbox.
9 - Personal Verification, record a personal verification which will be played instead of your mail box number to message recipients.
9 - Call Sender, when used on an incoming message will dial the extension of the sender, if the number is known.
Notes on the outdial features:
The dial through feature on Meridian Mail is relatively advanced allowing
the system administrator to build sophisticated blocking masks. However
this is not usually done. Most systems will either allow all numbers,
just ones to their range of extensions or none at all. This means that if
a company has extensions ranging from in the 2XXX range then Meridian Mail
can be set up to disallow all numbers other than those starting with 2.
However if the system has been set up badly then it may disallow all
numbers, even those stored in the directory, so even dialling by name will
be disallowed. As with most UK PABX systems the prefix for an outside line
is 9, so from the mail box menu dialling 0+9+ACN will, if no call blocking
is in place dial the given number If this does work it will almost
certainly work for all UK Inland numbers. Most will also
allowinternational calls.
Notes on distribution lists:
Users can have up to nine personal distribution lists, numbered
surprisingly from 1-9, each distribution list can have from one to about
one hundred mailbox numbers in it. To create a distribution list press
85, enter the number of the distribution list and press #; Press 75 to
enter the mailbox numbers, 76 to delete an existing lists;2 to listen to a
list or 4 to return to the main menu.
That just about covers all the basic facilities of the Meridian Mail
system, if anyone has any questions on anything I've covered or failed to
cover. Or any corrections to make I can be reached at ColdFire@paranoia.com