Any system will leak information in every possible way if we don’t carefully plug the holes and design the system.
The last day I was attending a telephone conference. The host dialed the phone number in a big conference enabled phone which made big beep sounds for every key he pressed. The IVRS directed him to enter the password for the system. He dialed the long password and looked very happy that he had a very good password for the system. Meanwhile, I calculated and wrote down the password in my notepad.
How did I do that?
Simple! When he dialed the numbers, the phone beeped according to the keys pressed. If you have slight experience in recognizing the sounds, you can decode the message that is being sent.
You can do this for virtually every mobile phone if “Key Tones” are enabled. You can recognize messages sent, passwords entered and numbers dialed this way.
The moral: Remember to switch off the fancy Key Tones in your phones and computers.
What? Is this true? God…. Thanks for that bro… It could really help quite a lot of them….
Of course Tenny,
Many people are ignorant of this fact.
I have heard that there are people who can recognize what you type just by hearing the sound from the keyboard of a PC or laptop. This works because the pattern of sounds is well known and one can guess the content.
Derick,
It becomes easy if the device produces different tones according to the keys typed.
this is not true.
the keypad on phone only have THREE different tones. for the 3 columns.
each key on the right most column has the HIGHEST tone. the middle one has middle pitch. the leftmost column has LOWEST tone.
this means 1,4,7 and */+ have LOWEST tone
2,5,8 and 0 have middle tone
3,6,9,# have highest tone.
there is no way you could have guessed the exact password just by hearing tones.
I know this because I work for a small company that makes land phone sets.
@not,
The tones are all different for the numbers in every single phone I tested with.
Please verify with other phones you have access to.
I think this is the way tone dialing works. Isn’t it?
In addition to each column having a tone frequency, each row is also assigned a specific frequency. Each button is a combination of the two tones, and so it is possible for someone of discriminate hearing to identify each key. Perhaps more dangerously, this is an easy opportunity for a replay attack – just record the password tones, and then play them into your phone when prompted.