[bradleyland]

If you're after a specific individual, a far better target than their computer would be their cell phone. Computers are complex and stationary. Cell phones are eminently more susceptible to this type of attack because the government can compel carriers to use technology that is already in place. No malware package required.

Working in telecom was enlightening for me. There's a feature called "executive barge in" that pops up from time to time when shopping for PBX systems. Executive barge in allows a user with the appropriate rights to open an audio channel to any phone connected to the switch, bypassing the alerting phase. That is to say, the phone never rings; the audio channel just opens. Most systems provide some sort of brief alert tone, but this is entirely implementation based. There's nothing implicit about opening a channel that would require a tone.

All digital phone systems have the ability to implement a feature like this. Cell phones are digital phones. With old analog (POTS) phones, when the phone was "on hook", there was a physical change in the connection of the copper pairs. In modern phone systems on-hook/off-hook is just a software state. There is no physical difference. Opening an audio channel is a distinct event, completely separate from the alerting signal [1] in common cell phone protocols.

The bottom line is that if you're really concerned that someone is listening in, you should watch the horrible movie "RED" and imitate John Malkovich's character the best you can.

http://www.scribd.com/doc/54495209/UMTS-3G-WCDMA-Call-Flows

[jacquesm]

It is possible to use a phone as an eavesdropping device even when it is on-hook:

http://www.euronet.nl/~rembert/echelon/muren/index.html#floo... (dutch)

[bradleyland]

I don't think frequency flooding works with the newer types of microphones used in modern analog phones (electret/dynamic). The article specificly mentions carbon mics, and that frequency flooding can be defeated with a capacitor.

[jacquesm]

Yes, those are 'POTS' phones, the old style variety as mentioned in the great grand parent.

Newer phones, basically anything with a bunch of electronics are not susceptible to this kind of trick.

When it was first revealed by the dutch hacker group 'hack-tic' (http://en.wikipedia.org/wiki/Hack-Tic) the phone company denied it could be done until there was a public demonstration.

[bradleyland]

Not to be argumentative, because I really appreciated that link :) but POTS stands for "plain old telephone service". It's still in use all over the place today.

The distinction is in the type of phone attached to the POTS line. It looks like it requires a combination of a carbon mic and an old, non-integrated-circuit switchhook. Something like you'd find in an old Western Electric 2500 [1].

A carbon mic has some pretty unique properties. Base output is very high, such that output is easily detected at a distance without amplification, and they're very low impedance. Even slightly newer telephone designs would use an electret style microphone. The most basic electret circuits require a capacitor, which is noted to defeat the frequency flooding attack.

1 - http://en.wikipedia.org/wiki/Model_500_telephone#Model_2500