Telephone Eavesdropping

[SL4P]

I'm afraid of trivialising the OPs concerns, but in today's world, there are twenty more effective ways of audio bugging a room than hot-wiring a legitimate handset.  And there are other bugging opportunities... video, IR etc.

e.g if you have windows, check for lasers being reflected off the glass... and so many more.

p.s. It can't be that 'high security', if they let staff walk in and out with personal electronic test gear tagged across installed assets!

[Towger]

Whats the fuss, is you work for the government then just assume all calls are monitored and live with it.
I know someone who worked in security for a large UK defence manufacturer, during the old war years. They knew their phones were being bugged, not by the Russians or Americans but by the organisation when did more of their work for, the UK's MOD.  In their opinion the MOD leaked like a sieve and you don't want your customer knowing your costs and other issues etc.

[kjs]

Can someone tell me why the phone doesn't work when I connect the scope to the line? The telephone won't ring. If I lift up the headset and listen there is no dial tone only a sort of hissing sound.

Because your scope probe has ground on one side and the phone line is balanced. You short one side to ground with your probe. You would need a differential probe for that.

[Erica]

Because your scope probe has ground on one side and the phone line is balanced. You short one side to ground with your probe. You would need a differential probe for that.

Thanks!!
Can you post a link to the sort of probe I need?

[smjcuk]

Whats the fuss, is you work for the government then just assume all calls are monitored and live with it.
I know someone who worked in security for a large UK defence manufacturer, during the old war years. They knew their phones were being bugged, not by the Russians or Americans but by the organisation when did more of their work for, the UK's MOD.  In their opinion the MOD leaked like a sieve and you don't want your customer knowing your costs and other issues etc.

Definitely. There was a whole international uppityness that went on between a couple of large European defence company subsidiaries in the 1980s and 1990s. They weren't even sly about it. They parked fuck off great big green MoD SIGINT trucks outside the facility on the public roads around it who responded by erecting a 20 foot high solid metal fence and foiling all the windows. I worked over the road at another company then but we ate and drank in the same pub at lunch times and they were all thoroughly fed up with it all by then. Both sides of the fence that was. The pub was the neutral zone

[LabSpokane]

If you do find something that you feel proves your line is being tapped, what exactly will your response be? If nothing, then why bother to do the tests in the first place?

However establishing cause for suspicion is step one. If you're in Belarus or certain Russian states and dissing the government, I'd be concerned for example. If you're here in the UK and are spending your spare time buying 50kg bags of industrial fertilizer and you're not a farmer, I'd be concerned. But Joe average, forget it; you're just nuts. If you've done something naughty, you probably shouldn't have done it or probably should have escaped somewhere where it isn't naughty first if you want to save yourself. If you're planning something naughty, think first.

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.

*That* was important information. They're using the speakerphone capability. The mic on a office phone can be activated even while the phone is on the hook. Just disconnect your phone from the wall jack and your conversations will now be private unless another monitoring device is used. This is a very well-known capability of modern office phones and is frequently used.

If you need to prove the assertion, you just need to get a copy of the manual for the PBX system. The capability is listed sometimes as "on-hook" answering or similar weasel words.

Another solution for privacy I saw used to good effect was sticking a piece of gum over the microphone. 

For those that doubt the capability, just ask Ed Snowden.

ETA: An office PBX phone is very different from a home phone. That phone is essentially always live. And activating the microphone versus the light that tells one the mic is hot are separate functions.  Sadly, the surveillance functions are a key selling point to the managers who purchase the systems.

The other obvious surveillance vector is malware installed on PCs that perform the same function of activating cameras and microphones surreptitiously. Taping over the camera fixes that, and you're back to gum, or physical disconnection of the internal mic on the PC.

[tggzzz]

If you do find something that you feel proves your line is being tapped, what exactly will your response be? If nothing, then why bother to do the tests in the first place?

However establishing cause for suspicion is step one. If you're in Belarus or certain Russian states and dissing the government, I'd be concerned for example. If you're here in the UK and are spending your spare time buying 50kg bags of industrial fertilizer and you're not a farmer, I'd be concerned. But Joe average, forget it; you're just nuts. If you've done something naughty, you probably shouldn't have done it or probably should have escaped somewhere where it isn't naughty first if you want to save yourself. If you're planning something naughty, think first.

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.

Ah, at last the important information arises. Fundamentally, you just have to be joking.

This is above you pay grade. Your only rational course of action is to report your suspicions, in writing, to the relevant people - which are likely to include you line manager and the security service.

if you conduct your own investigation and are discovered (e.g. by someone wondering why you are using your personal scope) modifying and investigating "highly secure" comms equipment, you will have a lot of explaining to do. At the very least they will seriously question your judgement.

[Erica]

.

[LabSpokane]

If you do find something that you feel proves your line is being tapped, what exactly will your response be? If nothing, then why bother to do the tests in the first place?

However establishing cause for suspicion is step one. If you're in Belarus or certain Russian states and dissing the government, I'd be concerned for example. If you're here in the UK and are spending your spare time buying 50kg bags of industrial fertilizer and you're not a farmer, I'd be concerned. But Joe average, forget it; you're just nuts. If you've done something naughty, you probably shouldn't have done it or probably should have escaped somewhere where it isn't naughty first if you want to save yourself. If you're planning something naughty, think first.

I work for a high security government facility. This is were these phones are being used. I am not in the US.
These phones are being used to monitor what the employees are saying in the offices. I believe its being done by a malicious source and is not known by executive management.

Ah, at last the important information arises. Fundamentally, you just have to be joking.

I'm not so sure this a joke. What I'm surprised about is that anyone managing a secure facility is not aware of this capability.

[Erica]

.

[LabSpokane]

There is no speakerphone capability.

A private PBX can still be used to listen to telephone conversations. They are designed this way.

And is it telephone conversations that are overheard or general office conversations? Depending on the phone design, the handset mic can still be hot while the phone is on the hook.

[LabSpokane]

I'm not so sure this a joke. What I'm surprised about is that anyone managing a secure facility is not aware of this capability.

Thank you. This is certainly not a joke.
Do you have any experience with this eavesdropping technique?

Only from the side of the "eavesdroppee" as it were. From the reading I've done, I would assume that no PBX phone of any variety is secure. If you want to have a private conversation, never use that phone and keep it unplugged from the wall until you need it.

As for management being unwary of the phone as a surveillance device, they would have to be pretty daft to not know about it.

[Erica]

.

[LabSpokane]

And is it telephone conversations that are overheard or general office conversations? Depending on the phone design, the handset mic can still be hot while the phone is on the hook.

General office conversations. I don't think its the mic on the headset being used. I suspect the ringer.

It's *possible* but I'm not sure how good the audio would be.  My first suspicion would always start with a microphone.  It's just tough to know how this handset operates without physical access to it. I would start by talking to who manages the telephone systems and see if you can get a copy of the manual. If the phone person is friendly or sympathetic, they may even tell you how the capability works. That will be quicker than reverse-engineering the telephone.

[Fungus]

Could some tell me how to test the telephone line for very high impedance audio using the oscilloscope?

That's what I want to do.

Why?

a) What would a signal on the line prove? It doesn't prove somebody is listening or not, just that there's a signal there.

b) If they are listening and you disable the phone, they'll just switch to a much harder to detect method. Plus you just let them know that you suspect they're listening - bad move!

The very best thing to do if you're under surveillance is to give them no useful information.

The absolute best position to be in is that you know you're being spied on but they don't know that you know. Instead of messing with the phone you can maybe set a trap to find out if they're listening or not. Do something so you can know if somebody went somewhere or opened something based on something you said recently.

[tggzzz]

I'm not so sure this a joke. What I'm surprised about is that anyone managing a secure facility is not aware of this capability.

That's only one of the possible jokes here!

Others include an anateur being able to take their own scope into a secure facility. And then use it.

Or considering that if you "blow" a legitimate security service operation, they won't be best pleased.

[David_AVD]

The phone in the photos appears to be a simple 2-wire unit, not the type (typically 4-wire) ones that have the ability to control the audio paths.

It has a bog standard hook switch and what appears to be a ringer chip, DTMF chip and a handful of support parts.

I seriously doubt that phone is the source of any leaked conversations.

[Fungus]

I seriously doubt that phone is the source of any leaked conversations.

Not unless it's been tampered with.

[David_AVD]

I seriously doubt that phone is the source of any leaked conversations.

Not unless it's been tampered with.

I assumed the pictures posted were of the phone in question?  Maybe that's not the case?

[Fungus]

I seriously doubt that phone is the source of any leaked conversations.

Not unless it's been tampered with.

I assumed the pictures posted were of the phone in question?  Maybe that's not the case?

I haven't seen the pictures but maybe the DTMF chip is a fake or something. This isn't the 1980s where you'd be able to see a bunch of wires and batteries in a tampered-with phone.

I'm thinking erica got the wrong oscilloscope. The MSO1104Z would have been better. The built-in logic analyzer would have been able to look at that chip. It's a bit more expensive but worth it for the peace of mind.

[SL4P]

All indications are that this us a troll, but a fun one to engage!

All the OP posts suggest an employee in a modest role, with little or no access to anything more secure than their work locker.

His employers are not interested in scanning his workplace unless he's making these posts during office hours.

The phone is an analogue phone for use on a POTS style circuit - very unusual in any structured organisation that I've dealt with in the last ten years.

Taking a scope or anything else to work suggests they don't have their own, or OP has no access to them.  Take from that what you may.
If they're in a clerical role (documentation, accounts etc) then they seriously should look for a job with less 'intrigue'!

2c worth.

[xrunner]

Hello

I suspect my telephone is being used for eavesdropping.
The ringer is a perfect microphone, I verified this myself.

Just pick up the phone and say this -

"Hey Frankie I'm dropping off the bag of money at 3 PM today over at the _______ store on (pick a nearby location). You can pick it up there!"

Then go there and see who shows up.

[Towger]

Definitely. There was a whole international uppityness that went on between a couple of large European defence company subsidiaries in the 1980s and 1990s. They weren't even sly about it

There solution to the tapping went as follows:
Normal phone call: Used a normal phone line.
Normal phone call were you wanted to feed the MoD information or did not care if over heard: Used scrambling system over normal phone line.
Top Secret phone call: They installed a phone line in a farm several miles a way from the site and ran their own copper through the fields. Calls were made in the clear, as a scrambled call would be picked up in the exchange and investigated. He was a strong believe there is no such thing a secure scrambling system.

[LaserSteve]

Monitoring of Employees is very, very, very, real in large corporations.

Two employers ago, The lady in the cubical next to me spent way too many hours with a headset on when her principal job was training. So one day she left the desk with a certain screen up.  We took a look. Very interesting software running.

This was of course, at a corporation where people were afraid to make friends in the cafeteria, and this Dutch multinational had one hundred years of experience in manipulating staff.   

What they were doing is very much  LEGAL in the USA.

However these days the "bug" is a tap  at the PBX switch or IN the multiplex card, not at the desk, unless a co-worker has done something very crude and unauthorized.

On a 2 wire POTS phone, in the US, its a simple matter of paralleling two wires down stream to another device.  Electronically Virtually invisible to a novice, unless you do TSM for living.

Where I work now, some technicians with private offices  have wired a DPDT on the ISDN lines to disconnect the phone when talking in their office.   

Steve

[smjcuk]

Yes. Microsoft even promote it with Lync for example. Total bastards.

Definitely. There was a whole international uppityness that went on between a couple of large European defence company subsidiaries in the 1980s and 1990s. They weren't even sly about it

There solution to the tapping went as follows:
Normal phone call: Used a normal phone line.
Normal phone call were you wanted to feed the MoD information or did not care if over heard: Used scrambling system over normal phone line.
Top Secret phone call: They installed a phone line in a farm several miles a way from the site and ran their own copper through the fields. Calls were made in the clear, as a scrambled call would be picked up in the exchange and investigated.

That's about right.

I have some even worse stories but I'm not allowed to tell anyone until 2048...