cordless phone security

Dec 27 17:36 UTC 2000

My wife was telling me she thought you could hear conversations from 
cordless phones over a police scanner.  A friend of her mother has a 
scanner and sometimes hears phone conversations.  Is this a problem just 
with older cordless phones, or is it still possible with 900 MHz and 2.4 
GHz phones?

Thanks!

response 2 of 28:

Dec 27 17:53 UTC 2000

Any phone that doesn't encrypt the signal can be overheard... if you're truly
concerned, I've heard that the digital cordless phones with "spread spectrum"
technology are the ones to have.  Some will encrypt the signal between the
cordless unit and the base, as well.

response 4 of 28:

Dec 27 23:22 UTC 2000

Now linked to cyberpunk, the conf of electronics hacking, privacy concerns,
communications secuity, etc.

response 6 of 28:

Dec 28 02:12 UTC 2000

Let me preface this with the implied disclaimer "today".

Just about any cordless phone conversation can be intercepted
via radio.  The only exception would be a phone which
a.) encrypts the link between the base and portable (both ways)
b.) using a strong encryption algorithm of adequate key length and
c.) keys which are truly randomly chosen and
d.) changed frequently enough to frustrate known-plaintext attacks.

That said, there's a huge change in difficulty in reading cordless
phones depending on the generation.  The first generation of cordless
units used a 1.6 MHz signal from the base to the handset, and 49 MHz
from handset to the base.  Some units even broadcast on 1.6 MHz all
the time, even when the cordless unit was "on hook"!  These units
allowed all conversations on the line to be heard by anyone with a
shortwave receiver.  (These units should not have been legal to sell,
IMHO.)  Many scanners, as well as toy walkie-talkies and baby monitors,
can pick up 49 MHz signals.  If they couldn't get the signals as-is,
they could easily be modified to do so.  The 49 MHz link is FM, the
1.6 MHz signal I believe is AM.

The second generation of handset phones used 49 MHz FM exclusively.
The same scanners and such can listen to them.  It's not even a challenge.

The third generation of handset phones moved to 900 MHz, where there
is more available spectrum space.  Those phones transmitting using FM
are no more difficult to intercept than a 49 MHz phone, but the gear
to receive in this region isn't quite as common.  A determined listener,
even an amateur, will have few difficulties.

The fourth generation of phones moved to digital signals and sometimes
spread-spectrum (frequency hopping).  The digital technology adds a large
amount of difficulty to the job of interception, because few scanners
have the hardware to demodulate the digital signal (I've heard of none).  
Frequency-hopping adds further difficulties, though it would take a
military-grade random number generator to make a hop schedule that a
capable listener couldn't follow.  The average scanner is well beyond
its capabilities at this point, and amateurs will not be listening.

The best of the current generation is running digital signals on 2.4 Ghz
and using spread-spectrum technology.  Scanners won't get anywhere with
them either.  The military, the FBI, and others have no trouble, you can
bet.  Those phones using FM instead of digital are still scanner-bait.

That's today.  Tomorrow everyone will have more capable receivers, which
use digital signal processors (DSP's) and can be re-defined in software.
Most people will just use them for listening to the radio, but others will
patch the code to add new functions.  If a phone manufacturer has used a
weak random-number generator, too short or predictable of a hopping schedule
or an easily-cracked cipher, some hacker's downloadable module will be able
to zero right in on your digital spread-spectrum phone's output and give
the pimply teen up the street an earful of you talking dirty to your lover...
or give a crook your access codes to your brokerage account as you execute
a trade.  You could be embarrassed, ripped off or both.

One thing hasn't changed:  don't say anything over a cordless phone that
you wouldn't want on the front page of the newspaper, or on a hacker BBS.
That probably won't change until real crypto in well-tested implementations
has made it to phone handsets.  Don't bet on seeing that for quite a while.

response 8 of 28:

Dec 28 06:00 UTC 2000

Seems to me that much of Russ' comments apply to current wireless computer
networking technology, too.

response 10 of 28:

Dec 28 16:43 UTC 2000

My scanner only goes up to about 956 MHz.  I don't know if there are 
scanners readily available for the 2.4 GHz range.

response 12 of 28:

Dec 29 00:51 UTC 2000

        heh.

response 14 of 28:

Dec 30 01:43 UTC 2000

I think I found listening to cellular conversations on my TV amusing for all
of five minutes.  I just don't care about listening to people who are, on
the whole, even more boring than I am.  I have a scanner, but I use it
mostly for listening to police, fire, and road commission frequencies when
the weather is bad.  If I ever picked up someone's phone with it I'd
probably lock out that frequency to avoid the chatter.


Amusing story in the same vein, related by my boss at the railroad I
interned at this summer:

Railroads have what they call "PBX frequencies".  These are literally
extensions of the corporate phone system onto radio channels, so signal
maintainers and other people can do things like call the dispatchers from
their trucks.  (For those of you who are hams, this is pretty much exactly
like an autopatch.) One afternoon a gentleman happened to have taken a short
personal call from his wife on a PBX frequency.  Apparently they forgot they
were on a radio channel, because towards the end of the call there was this
exchange:

Gentleman: "Love you, honey."
Wife: "I love you too."
Someone else on the frequency: "We all love you, too!"

The call was abruptly ended at that point. ;)

response 16 of 28:

Dec 30 23:20 UTC 2000

Be careful because some of the Panasonic DSS 2.4GHz phones only used
DSS/2.4GHz for your side of the conversation, and comventional 900MHz for the
other side of the conversation so you could still monitor both sides with a
scanner that rec'd the 900MHz band.

response 18 of 28:

Jan 3 21:17 UTC 2001

I got a 900 MHz DSS phone, since I've heard some reports of the 2.4 GHz phones
interfering with wireless ethernet (which is also 2.4 GHz).  A scanner that
knows the spread spectrum algorythms can presumably listen in on it.  The
right scanner can also listen in on the 2.4 GHz phones.  Even if they're
illegal, scanners presumably exist that can listen to my cell phone as well.

My phone conversations tend to be of the sort that would be pretty boring for
anybody not directly involved.  If anybody does listen to them, I doubt very
much that they'll get much out of it.  

The good general rule is to not say anything that you really don't want
eavesdropped on over any sort of non-encrypted wireless phone.  For that
matter, saying such things in unencrypted e-mail is probably a bad idea as
well.  If I'm on my cordless or cell phone and passwords or credit card
numbers are oging to be said, I switch to a land line phone.  On the other
hand, if somebody is really that desperate to know about my personal life,
I'm not going to go to great lengths to try to stop them.

response 20 of 28:

Jan 4 18:43 UTC 2001

Ken Ascher was carrying a scanner on the Grex Walks a few years ago that could
listen to the AAPD DSS system.

response 22 of 28:

Jan 5 00:58 UTC 2001

I've got one of those scanners too.  UM uses a similar system.

response 24 of 28:

Jan 6 22:17 UTC 2001

manthax how do u tap your neighbors phone?