Re: blind demodulation - sound card - lucent winmodem

From: Ryan Russell (ryan@securityfocus.com)
Date: Sat Jun 29 2002 - 13:07:05 EDT


On Sat, 29 Jun 2002, Evrim ULU wrote:

> The limit on a normal phone line is 64K. But when there is noise on the line
> (this is the usual case in fact) one bit is dropped and result is simply 56K
> (53.3K says modem-howto of linux).

The loss of one bit per byte is due to robbed-bit signaling, not noise.
Noise will simply reduce you further from 56K. The 53.3K is a
FCC-mandated maximum, actualy 56K is theoretically possible on a perfect
line.

>
> PCM says that there are 256(8 bits) different signals at a sampling rate
> of 8000 per second. 56K Modems uses amplitude modulation.

They use G.711 in one direction (the 56K direction) and Quadrature
Amplitude Modulation in the other, the 33.6K direction. QAM is not just
AM, it's AM and phase shift keying. My information isn't new enoguht to
tell you what happens on the upstream in V.92.

> Although
> modems do lots of tricks like crc checking/data compression, there must
> be a way to demodulate the traffic since it's a simple analog one.

Half digital/half analog.

Can you give a little more info as to what the scenario is that you've
got? There are a number of places where it would be much easier to tap
the conversation that ends up crossing the modems, or play MITM with a
pair of modems.

                                        Ryan

----------------------------------------------------------------------------
This list is provided by the SecurityFocus Security Intelligence Alert (SIA)
Service. For more information on SecurityFocus' SIA service which
automatically alerts you to the latest security vulnerabilities please see:
https://alerts.securityfocus.com/



This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:22 EDT