My wife was telling me she thought you could hear conversations from 
cordless phones over a police scanner.  A friend of her mother has a 
scanner and sometimes hears phone conversations.  Is this a problem just 
with older cordless phones, or is it still possible with 900 MHz and 2.4 
GHz phones?

Thanks!

28 responses total.

I know that I could hear 3 radio stations on my regular phone depending on
where I was living.  I don't pick anything up on my cordless, and I don't have
a scanner, but it might depend on what kinds of antennas are around the
property to broadcast long range.

Any phone that doesn't encrypt the signal can be overheard... if you're truly
concerned, I've heard that the digital cordless phones with "spread spectrum"
technology are the ones to have.  Some will encrypt the signal between the
cordless unit and the base, as well.

  My understanding is that a few years ago Congress became concerned about
  privacy violations after several congressmen's presumed-private cordless
  phone conversations were revealed by folks who had taped them off of their
  scanners, so they "fixed" the problem by forbidding the sale of new scanners
  able to receive the cordless phone frequencies and by making it a punishable
  offense to listen in on someone's conversation.  Which basically means with
  an old-style phone your privacy depends on (a) most people not having access
  to an older scanner or a new scanner modified to allow reception of the 
  forbidden frequencies, and (b) the good will of those who do have older
  scanners and/or electronics knowledge.  In short, conversations are not 
  particularly private on such phones..

  Many newer phones are digital and quite a few use spread-spectrum schemes
  to make it more difficult to eavesdrop.  Listening in on those phones is
  far more difficult than eavesdropping on the old-style analog phones but
  it should probably still be considered possible for a determined attacker
  with sufficient resources.  In short, casual conversations are probably
  sufficiently private but you ought to be careful discussing sensitive
  matters over any sort of radio communications device (if you're truly
  paranoid or the information is valuable enough, you should probably even
  avoid discussing highly confidential matters over an ordinary land-line
  phone..)

Now linked to cyberpunk, the conf of electronics hacking, privacy concerns,
communications secuity, etc.

Cellular phones are the ones they've banned scanners that can listen to.  I
don't think the same is true of cordless phones.  For cordless phones,
spread spectrum is the way to go, as they're nearly impossible to eavesdrop
on with current equipment.  Ordinary 900 MHz phone can be picked up by recent
scanners, and the 2.4 GHz ones probably aren't far behind.

For cell phones, you don't have any real guarantee, though the digital ones
are better.  Encrypted phones would be best, but I don't know if they're
available in the US.  (Cell phone companies figure it's easier to buy
anti-scanner legislation than it is to build encryption into the phones.)
The analog ones are trivially easy to listen to, even with the scanner ban. 
If you have an older TV with knobs, try tuning it up around the high part of
the UHF band, and fiddling with the fine tuning -- the old UHF band from
channel 70 to channel 82 was re-purposed as a cellular band.  Consider then
that no one has yet successfully banned old televisions.

Let me preface this with the implied disclaimer "today".

Just about any cordless phone conversation can be intercepted
via radio.  The only exception would be a phone which
a.) encrypts the link between the base and portable (both ways)
b.) using a strong encryption algorithm of adequate key length and
c.) keys which are truly randomly chosen and
d.) changed frequently enough to frustrate known-plaintext attacks.

That said, there's a huge change in difficulty in reading cordless
phones depending on the generation.  The first generation of cordless
units used a 1.6 MHz signal from the base to the handset, and 49 MHz
from handset to the base.  Some units even broadcast on 1.6 MHz all
the time, even when the cordless unit was "on hook"!  These units
allowed all conversations on the line to be heard by anyone with a
shortwave receiver.  (These units should not have been legal to sell,
IMHO.)  Many scanners, as well as toy walkie-talkies and baby monitors,
can pick up 49 MHz signals.  If they couldn't get the signals as-is,
they could easily be modified to do so.  The 49 MHz link is FM, the
1.6 MHz signal I believe is AM.

The second generation of handset phones used 49 MHz FM exclusively.
The same scanners and such can listen to them.  It's not even a challenge.

The third generation of handset phones moved to 900 MHz, where there
is more available spectrum space.  Those phones transmitting using FM
are no more difficult to intercept than a 49 MHz phone, but the gear
to receive in this region isn't quite as common.  A determined listener,
even an amateur, will have few difficulties.

The fourth generation of phones moved to digital signals and sometimes
spread-spectrum (frequency hopping).  The digital technology adds a large
amount of difficulty to the job of interception, because few scanners
have the hardware to demodulate the digital signal (I've heard of none).  
Frequency-hopping adds further difficulties, though it would take a
military-grade random number generator to make a hop schedule that a
capable listener couldn't follow.  The average scanner is well beyond
its capabilities at this point, and amateurs will not be listening.

The best of the current generation is running digital signals on 2.4 Ghz
and using spread-spectrum technology.  Scanners won't get anywhere with
them either.  The military, the FBI, and others have no trouble, you can
bet.  Those phones using FM instead of digital are still scanner-bait.

That's today.  Tomorrow everyone will have more capable receivers, which
use digital signal processors (DSP's) and can be re-defined in software.
Most people will just use them for listening to the radio, but others will
patch the code to add new functions.  If a phone manufacturer has used a
weak random-number generator, too short or predictable of a hopping schedule
or an easily-cracked cipher, some hacker's downloadable module will be able
to zero right in on your digital spread-spectrum phone's output and give
the pimply teen up the street an earful of you talking dirty to your lover...
or give a crook your access codes to your brokerage account as you execute
a trade.  You could be embarrassed, ripped off or both.

One thing hasn't changed:  don't say anything over a cordless phone that
you wouldn't want on the front page of the newspaper, or on a hacker BBS.
That probably won't change until real crypto in well-tested implementations
has made it to phone handsets.  Don't bet on seeing that for quite a while.

And if the FBI is after you, you have worse problems than worrying about
your cordless phone. ;)

Seems to me that much of Russ' comments apply to current wireless computer
networking technology, too.

Thanks, Russ.  It was more comprehensive than the other comments, 
anyway!

Do all 2.4 GHz phones have spread spectrum technology and digital 
signals?

I don't think we're concerned about the FBI spying on our private phone 
conversations.  If they want to do that, they'll just enter the house 
when we aren't around, and will bug everything said in the house by 
anyone.  We'd only find out by bad planning on their part, and good 
fortune on ours.  They're professionals, and we aren't.

However, having the neighbors using their police scanners to casually 
(and inadvertently on their part) listen in on our daily phone 
conversations is another matter.  2.4 GHz phones are supposed to allow 
you to use them over a longer range.  Clearly that would mean they'd be 
interceptable at a longer range, too, if there's nothing built in to 
prevent that.  So that's what I'm asking about.

My scanner only goes up to about 956 MHz.  I don't know if there are 
scanners readily available for the 2.4 GHz range.

I know my police scanner will sometimes pick up on phone conversations.

        heh.

My scanner picks up alot of phone calls! One channel I listen to alot is 46.67
MHz. Try it its fun to listen to people phone calls. And if you do not get
anything tap there phone line! I tapped my neigbors!

I think I found listening to cellular conversations on my TV amusing for all
of five minutes.  I just don't care about listening to people who are, on
the whole, even more boring than I am.  I have a scanner, but I use it
mostly for listening to police, fire, and road commission frequencies when
the weather is bad.  If I ever picked up someone's phone with it I'd
probably lock out that frequency to avoid the chatter.


Amusing story in the same vein, related by my boss at the railroad I
interned at this summer:

Railroads have what they call "PBX frequencies".  These are literally
extensions of the corporate phone system onto radio channels, so signal
maintainers and other people can do things like call the dispatchers from
their trucks.  (For those of you who are hams, this is pretty much exactly
like an autopatch.) One afternoon a gentleman happened to have taken a short
personal call from his wife on a PBX frequency.  Apparently they forgot they
were on a radio channel, because towards the end of the call there was this
exchange:

Gentleman: "Love you, honey."
Wife: "I love you too."
Someone else on the frequency: "We all love you, too!"

The call was abruptly ended at that point. ;)

If you have a good scanner, you can pick up a lot of things.  There was a
database for things like drive thru window frequencies (for the headsets) and
things like that.  You can also pick up CB cahnnels, and television stations.

Be careful because some of the Panasonic DSS 2.4GHz phones only used
DSS/2.4GHz for your side of the conversation, and comventional 900MHz for the
other side of the conversation so you could still monitor both sides with a
scanner that rec'd the 900MHz band.

My wife's is a model GH2405 "Freedom Phone" from Southwestern Bell.  
Does that tell anyone anything about it?

I'm pretty impressed by the level of interest and knowledge people have 
about cordless phones.  I appreciate you sharing it with me!

I got a 900 MHz DSS phone, since I've heard some reports of the 2.4 GHz phones
interfering with wireless ethernet (which is also 2.4 GHz).  A scanner that
knows the spread spectrum algorythms can presumably listen in on it.  The
right scanner can also listen in on the 2.4 GHz phones.  Even if they're
illegal, scanners presumably exist that can listen to my cell phone as well.

My phone conversations tend to be of the sort that would be pretty boring for
anybody not directly involved.  If anybody does listen to them, I doubt very
much that they'll get much out of it.  

The good general rule is to not say anything that you really don't want
eavesdropped on over any sort of non-encrypted wireless phone.  For that
matter, saying such things in unencrypted e-mail is probably a bad idea as
well.  If I'm on my cordless or cell phone and passwords or credit card
numbers are oging to be said, I switch to a land line phone.  On the other
hand, if somebody is really that desperate to know about my personal life,
I'm not going to go to great lengths to try to stop them.

As a minor scanner listener it is my understanding that with off the shelf
equipment available to consumers at even more than moderate cost it is not
possible to monitor DSS phones.  I'm not saying it can't ever be done, but
your above average scanner enthusiest is not going to be doing it.
Digital cell phones are also pretty much unscannable by the general public.
Analogue cell phones are scannable by scanners that were built before 1993
or have been modified to listen to the cell phone band.

Digital scanners will be available in the next several years as lots of
public service agencies are switching to digital systems and the public
is demanding a products which will allow listening to these systems.  I'd
expect that at some point these will be modified to listen in on digital cell
conversations.

Check out rec.radio.scanner or alt.radio.scanner on USENET.

Ken Ascher was carrying a scanner on the Grex Walks a few years ago that could
listen to the AAPD DSS system.

AAPD is not a DSS system, it's a trunked analog system.  Totally different.
Trunked systems have a control channel that keeps track of what's going on.
That channel is digital, but the spec is public and now easily "decoded".

I've got one of those scanners too.  UM uses a similar system.

Yep, they;re becoming quite popular.  Metro Airport and Wayne County also use
these kinds of systems.

The Michigan State Police are in the process of converting over to an all
digital trunking system, the largest of it's kind in fact.  This system uses
the APCO-25 standard, of which the specs are public, but to get a radio
capable of decodeing this you;re looking at $2500-$3000.  In a few years I'm
sure it will be a lot more reasonable.

manthax how do u tap your neighbors phone?

If you can't figure it out, he has no business explaining it to you.

youre a bunch of fucking blow hards

When taken literally that's quite a nice compliment, actually.
Thanks!

Ean ros
We live very close together and they use a old cordless phone that is almost
always on the 46.67 Mhz channel. So I mostly listen on my Scanner. But I also
fucked around in there box and got a line  running to my house, so I can
listen when there on the corded phone. 

Response not possible - You must register and login before posting.

- Backtalk version 1.3.30 - Copyright 1996-2006, Jan Wolter and Steve Weiss