Gentner GSC3000 for Total Morons
by blakmac (page33@mail.com)
As you know, radio stations use transmitters to relay signal from the towers to receiving antennas, whether they are other towers or the old bent-up clothes hangers that are taped to the back of your radio.
One of the more popular transmitter companies is Gentner. Gentner manufactures various equipment, ranging from FM transmitters to hearing assistance equipment.
In this article, we will look at some of the features of the Gentner GSC3000 Remote Facilities Management device as used by one of our local radio stations. Of course, this is for educational purposes only. Besides, if you are stupid enough to tamper with one of these pieces of equipment, you deserve the trouble you will receive.
The Equipment
While I have never seen one of these transmitters in person, I did interact with it on a regular basis while working at a local radio station.
At least once per shift, we were required by the FCC to check the transmitter voltage, plate current, and forward power that the transmitter was operating at. We did this by dialing up the Gentner GSC3000 and feeding it commands via the telephone keypad. We will get to the commands shortly.
The location of the transmitter was actually about 15 miles from the station. I'm sure you have seen radio towers; the transmitters for the towers are usually kept in a little hut at the base of the tower. If anyone has been inside one of these and has pictures/information about them, please e-mail me.
There are two ways to communicate with one of these devices: via modem dial-in or via telephone with the voice module installed. At the station, we always used the voice module access, probably because the "network admin" was quite incompetent when it came to computers. We will be focusing on this method of communication between the user and the hardware.
Dialing In
Usually the telephone numbers for these machines are not listed anywhere, therefore only a privileged few can access the machine.
There are very good reasons for the security of this access. For example, you can change the broadcast voltage of the transmitter, which can cause lots of unmarked vans to appear in your location. You don't want that.
In our small town, the transmitter number was at one time published in the local telephone book! However it has since been removed. When you dial the number, if the voice module is installed, you will hear a robotic voice saying something like, "Hello, this is the KXXX transmitter site, please enter access code."
It's always a good idea to have difficult passwords, but as we know given that there are only ten numbers on a telephone, they can easily be guessed. The GSC3000 has two passwords for the system, a 5-digit general access password and a 7-digit system access password (root!).
The default password is the telephone keypad equivalent of the word PASSWORD (72779673). Press # after entering the access code. You can end your call anytime by entering 999.
When you enter the general access password, you will hear a message saying that there are either alarms pending or no alarms pending. Basically, these alarms are for signal status.
For example, if there is dead air being passed over the transmitter, an alarm would be issued and, in our case, the phone would ring at the station on a special line, as well as at the station owner's house, and a signal would be sent to the program computer at the station to begin playing music. Once you are past the alarm message, you can enter codes to access the various features of the GSC3000.
Here are the available options:
For Checking Meters:
- 501# - Sequence One Enabled Runs through the meters and gives you the stats.
- 601# - Transmitter Voltage
- 602# - Plate Current
- 603# - Forward Power
- 604# - Reflected Power
- 607# - Microwave Power (Studio-to-Transmitter Link)
- 701# - Signal Status
- 050# - Monitor On
- 050* - Monitor Off
- 000 - Report Alarms
- 010 - Clear Alarms
- 030 - Master Alarm Override
Other Commands:
- 201# - Main Transmitter Power On
- 201* - Main Transmitter Power Off
- 202# - Increase Transmitter Power
- 202* - Decrease Transmitter Power
- 203# - Transmitter Reset
- 999 - Disconnect
For our local transmitter, there is another telephone number that you dial to get the status on the AC power going into the transmitter. For example, you dial the number and enter a 5-digit password, then enter 704* to get the power status report.
Passwords
As with any sensitive equipment, passwords should be chosen carefully and not carelessly.
By looking at the commands available for remote use, you can see what kind of power lies in the ability to access one of these machines.
At the local station, the password for general access was 11111 and for total system access it was 9999999. It's rather sad to think that these are very easily guessed passwords that can have quite dramatic consequences.
Let's imagine that Evil Joe wants to get back at the radio station for something. Joe calls up the GSC3000, guesses the password, then kicks the power up on the transmitter. The station is then subject to severe fines and penalties if the FCC finds out (and they will).
This isn't a pretty picture, especially if and when it can be proven that Joe doesn't work for the station and he's the one that tampered with the equipment. Just imagine the penalties for that. However, I feel that the station is partially to blame in this scenario due to a lack of diligence in setting up their passwords. These machines aren't very secure to begin with, considering the password scheme that they use.
If you run a station, be smarter than our local station, please.
Conclusion
The Gentner GSC3000 is a very useful tool for monitoring radio equipment, however it is insecure.
The password schemes should be redesigned, although I realize that it is limited to the ten keys on the telephone keypad. Possibly incorporating a longer password would be a viable solution to this problem.
I have listed some resources for more information below, and if anyone has more on these devices, feel free to e-mail me with any information, corrections, etc. that you may have.
Please, use this information responsibly.
References
Gentner Technical Support - 800-283-5936
Genter GSC3000 Remote Facilities Management Installation & Operations Manual Gentner Part No. 800-085-100 (1998)
Burk Technology GSC3000/VRC2500 Broadcast Facility Control Systems Installation & Operations Manual (2006)
Genter GSC3000 Voice Interface Installation and Operations Manual Gentner Part No. 800-085-130 (1999)
Burk Technology VRC2500 Remote Facilities Management Installation & Operations Manual (2002)
Greetings to diversereality, krypt0n0mic0n, Horathgar42, WarHwk1974, the imposter.