Article View: sci.crypt
Article #3808Re: Secrecy Shibboleth
From: Larry Lippman
Date: Mon, 19 Oct 1987 15:51
Date: Mon, 19 Oct 1987 15:51
102 lines
6652 bytes
6652 bytes
In article <5515@jade.BERKELEY.EDU>, adamj@thoth8.berkeley.edu.BERKELEY.EDU writes:
> Being bugged: I understand that there are numbers that
> you can call that will give you a rising tone that either stays high or
> drops low and starts rising again depending upon whether there are
> any extra listeners. I've tried the numbers with different, but consistent,
> results from different a variety of places.
> I used to have a list of four such numbers and I used to know
> which response meant the line was "bugged" and which one meant not.
While this may not be the most appropriate newsgroup for this
discussion, I feel obligated to respond to what appears to be the
propagation of an "urban legend".
There is no way in which any telephone company central office
apparatus can know if your line is "bugged". Most "real bugs" (which
are few and far between) today are inductively coupled to a telephone
pair, draw no current, present no bridged capacitance or inductance,
inject no signal into the telephone line, and are virtually undetectable
even with a balanced-pair time domain reflectometer (an instrument which
requires that the telephone line in question be disconnected both from
central office apparatus and any telephone instruments before a measurement
can be made).
Less "sophisticated bugs", which make direct two-wire connection
to a telephone pair are either capacitively-coupled and/or connected
with a series resistance >> 100K ohms. The effective bridged capacitance
or bridged resistance (i.e., current "leak") of even these "bugs" is only
a miniscule fraction of the normal capacitance of the telephone line and
its normal leakage resistance, and for all intents and purposes presents
an immeasureable condition from the telephone central office; it definitely
presents an immeasureable condition if a telephone is off-hook at the time
and is used to dial a test number!
And let's say this alleged "bug test" number just measured the
current draw of the connected subscriber instrument, and reported the
results by means of a tone. How should this test device know the "normal"
current draw of your telephone instrument? Current draw will vary all
over the map (typically 25 to 100 mA), depending upon distance from the
central office and the type of subscriber instrument you are using (i.e.,
a 500-type "traditional" telephone set with a passive network will behave
MUCH differently than say, one of the newer electronic telephone sets).
In addition, some telephones which have memory dialers and clocks
draw a few mA from the telephone in an ON-HOOK condition, with this current
being used to trickle-charge the dialer memory battery and power the clock.
How is any telephone central office apparatus to know if say, a 2 mA leak is
the result of an electronic telephone or the result of a "bug"?
An operating telephone company simply has NO REASON to install any
"bug test" line. Actual inspections of telephone lines conducted by an
operating telephone company (which are also few and far beween), start out
by "cording" the subscriber pair in the telephone central office - which
is a procedure that isolates the pair from central office switching
apparatus and connects the pair to a "test board" where appropriate
resistance, capacitance, balance, current leak, and foreign potential
measurements can be conducted.
Ah, but you say you dialed numbers which responded! Well, what
did you dial? Probably one or more of the following:
1. A milliwatt or CLA (Combined Loop-Around) test line which provides
a 1,000 (or 1,004) Hz tone at 0 dBm. This is either a steady tone,
or one which is 9 seconds on, and 1 second off. This test line is
used for transmission measurement.
2. A "loop checker" test line, which consists of a tone of slowly rising
frequency which then abruptly falls in frequency and restarts the
cycle; the cycle period is typically 20 seconds. This test line is
for "simplified" transmission measurements of subscriber telephone
loops.
3. A "105-type" ATMS Responder test line, which sounds something like a
modem line answer. This line is used for automated testing of
interoffice trunks (i.e., the test line gets dialed by other automatic
equipment).
4. A "touch-tone station test line", which is used to verify that a
touch-tone telephone set is sending the correct frequency tone pairs
for each digit. In operation, the line returns dial tone; you
then dial 1234567890, which is followed by "two beeps" if the
digits are okay, or by "one beep" if the digits are not okay.
5. A "ringback station test line" (sometimes combined with (4) above),
which often returns either "high tone" (600 Hz), or dial tone
followed by the entry of a ringing party code number. This test
line is used to test ringers.
6. A "continuity test line", which generally returns a tone interrupted
once per second, and is used for testing within the central office.
7. A "delayed charging test line", which returns a variety of clicks
(as answer supervision is returned and released), usually followed
by a tone interrupted once per second.
8. A "coin station test line", which is probably the most complex dial
test line to be found, and which returns the greatest variety of
tones (interruped dial tone, high tone beeps, ringback tones, etc.).
This is a specialized test line used to test the coin collection
and return functions of coin telephones. It's operating procedure
is complex, and applies only to coin telephones; dialing this line
from a regular telephone can produce a variety of results.
I suspect that you have probably dialed a coin station test line.
<> Larry Lippman @ Recognition Research Corp., Clarence, New York
<> UUCP: {allegra|ames|boulder|decvax|rutgers|watmath}!sunybcs!kitty!larry
<> VOICE: 716/688-1231 {hplabs|ihnp4|mtune|seismo|utzoo}!/
<> FAX: 716/741-9635 {G1,G2,G3 modes} "Have you hugged your cat today?"
Technical Details
Message-ID:
<2129@kitty.UUCP>Path:
arc1-ca.pugleaf.net!utzoo!mnetor!uunet!husc6!bloom-beacon!gatech!rutgers!sunybcs!kitty!larryReferences:
<497@auscso.UUCP> <807@mips.UUCP> <533@auscso.UUCP> <5515@jade.BERKELEY.EDU>Show Full Headers
Complete Article Headers
Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP Path: arc1-ca.pugleaf.net!utzoo!mnetor!uunet!husc6!bloom-beacon!gatech!rutgers!sunybcs!kitty!larry From: larry@kitty.UUCP (Larry Lippman) Newsgroups: sci.crypt Subject: Re: Secrecy Shibboleth Message-ID: <2129@kitty.UUCP> Date: Mon, 19-Oct-87 11:51:30 EDT Article-I.D.: kitty.2129 Posted: Mon Oct 19 11:51:30 1987 Date-Received: Tue, 20-Oct-87 05:48:25 EDT References: <497@auscso.UUCP> <807@mips.UUCP> <533@auscso.UUCP> <5515@jade.BERKELEY.EDU> Organization: Recognition Research Corp., Clarence, NY Lines: 102 Summary: Sounds like an urban legend to me...