HOWTO Tap a phone line

This Wired How-To Wiki article on tapping phone lines is a good primer on what actually happens when someone puts a physical tap on your line. Of course, there are lots of invisible ways to virtually tap your line: in the US, the Federal CALEA statute mandates that phone-switches have tapping back-doors that only cops are supposed to have the passwords for (yeah, right), and the digital PBX in your office is just as likely to have a vulnerability as the PC on your desk.
The Tap: With an access point in mind, you should have an idea of the necessary equipment. Using an old lineman's handset (also called a "butt set") or building a "beige box" are the best starters. In short, the lineman's handset is a tool used by repairmen to test a line for activity. It's little more than a trussed up wall phone with a small dialing pad and alligator clips for tapping directly into a line. A beige box is just the DIY, 133t cousin of the lineman's handset. Of course, if price and jail time are no concern, there are a number of other options -- but for the sake of ease, we'll stick with these.
Tap a Phone Line

(Image: Trussell)

20

  1. This wouldn’t work so well on BRI or PRI service, or VOIP. Do people still use analog POTS lines for voice communication??

  2. @ Chromal
    Uhhh, how many homes do you know that use BRI/PRI/ISDN services ? The majority of them are still using the good old PSTN.
    As the article wasn’t aimed at the corporate environs (hence no Krone frame), so for the at-home-spy-wannabe, this would be just the thing.

    Regardless, VOIP is possibly easier to listen into, as you don’t need physical acccess to the premise, just access to the network.

  3. Nice one, thanks for this! I just picked up a blue lineman’s handset at the thrift store for a massive $3 last month, been meaning to get around to learning how to use it….

    Cheers!

  4. Just to clarify, those instructions at Wired were for someone who has access to your house, listening to the phone line in your house.

    Most people don’t realise (or want to know) just how easy it is to listen into supposedly private conversations, and most- sorry, all professional line taps are done at the exchange or the PABX/PBX.

    The old ‘I think someone is bugging my line, because I heard some clicks’ cliche hasn’t been relevant since the ’70s for most countries when their telcos switched to digital.
    The good guys simply have a digital tap routed to a phoneline of their convienence, ie: the police station, or it goes to a recorder, and they leisurely pick up the recordings twice a week from the exchange.

    Anyway, for those of you paranoid that someone in the house may be listening in with a butt set (as opposed to simply listening at your door ??), do a voltage test on a clean line with a multimeter. Check it every so often. If you see the voltage drop, you may have someone piggybacking on your line.
    The more devices you place on a line, the more the voltage drops. That’s why you can’t have 52 million extensions off the same line.
    But, it’s more likely to be moisture on the line or some engineer has simply switched your pairs in the exchange to another card.

    That said, if you’re using a cordless phone (non DECT), you might as well blab your conversations out into the street for all the privacy that they give.
    Seriously.
    If you do any phone banking on a cordless phone, anyone with a scanner and DTMF module will capture your banking details and password.

    Corporate communications are no harder to compromise, if you know some fundamentals of wiring and can gain access to a comms cabinet.
    The worst part (or best, depending on which side of the fence you’re on), is that they rarely go public when their comms are compromised because, y’know, it might look bad.

    Hmm, perhaps I should write an article on how to compromise communications.. Anyone interested ?

  5. The guy who came to set up my phone and DSL when I moved in last July had one of those phones, but it had another component: some sort of sensor that didn’t even need to make contact with any wires to listen in on the line. I’m guessing it just works by induction (with some form of amplification) but he could easily listen in on any of the signals in that box (I’m in an appartment building, so the box had 7 other lines coming in.)

    As far as I know, with most “physical” phone taps, there is a drop in volume due to part of the signal being split off to the tap. I’m betting that, with this induction method, the drop in volume will probably be a lot less obvious.

  6. it is a message for transmitting cell phone conversations through solid medium known as “copper”. Ludicrous as it sounds, this ancient art does have the advantage of not giving one brain cancer.

  7. You often hear a loud POP when you clip into an active line with a butt set. The others on the line at the time can hear that POP too. Also don’t forget to have the butt set on “listen” (rather than “listen and talk”) else your heavy breathing might be heard.

    Often the line/extension numbers are helpfully written alongside the block so you can clip on before calls are made.

  8. Thanks, Takuan. According to Wikipedia phone-lines were invented in the later 1800s and were actually quite common in the last century. The More You Know, I guess…

  9. #9 posted by peter x , August 13, 2008 6:45 AM
    You often hear a loud POP when you clip into an active line with a butt set. The others on the line at the time can hear that POP too. Also don’t forget to have the butt set on “listen” (rather than “listen and talk”) else your heavy breathing might be heard.
    Often the line/extension numbers are helpfully written alongside the block so you can clip on before calls are made.

    The “pop” can be eliminated if you toss a cheap switch into the circuit. The spark right before the connection happens (or moving the connector around) is usually the cause of noise. Good switch, no pop.

    Or so I’ve heard.

  10. Or how NOT to.. Yes, the actual accessing a place to connect at – and doing so is not an overly complex task.

    Do note that crude taps or just a forgotten old extension phone can kill the DSL signal. And there are many Theft-of service tap splices discovered while tracing down DSL issues. I have found them myself in several cases. Some of these were intentional bridge taps to unarguably steal phone service. As billing anomalies also proved.

    Calls to foreign countries at midnight CST from a store that locked up 9 pm sort of explain it as not an accident.

    Basically the dangerously fractional clue possessing crook unplugged the test link in the demarc box, plugged in a dollar store rj11 2 way plug-ran several cables daisy chained into the back room by passing them thru a vent fan pipe.

    The DSL failed call was just how it got stopped. And of course when reported to the LEC as problem found…

    Bad Karma for a crook stealing phone service?

  11. Chromal: you have a point. You would need special equipment for a PRI/BRI circuit. Like the TS-22 data safe butt sets that you can buy at a home depot.

    Shutz: Thats an inductive amplifier. If you get inteligible audio at all it will sound like a death metal album. They also pick up hellacious noise from things like flourescent lamps.

  12. Use this info carefully:

    NEC NEAX Family of PBX

    From a DTERM handset
    transfer+conf+star
    tranfer+conf+pound

    This is CAT mode. Button assignment is 9000>XXXX,XX
    where XXXX is the extension # and XX is the button number. Most assignments are in this format: F1000
    You’ll have to play around as I am not going to give out any specific exploits, but any quality admin would have disabled any eavesdropping commands from a MOC.

    I lot of PBX PABX systems have DISA (direct inward system access) in the form of dial-up modem/VT100 terminals. Much phreaking fun can be done from a connection like this. Most don’t even have passwords . . .

  13. at our (the consumer) request, communications have become a nearly completely deregulated industry, so go for it. don’t get caught though, it’ll get federal/Homeland Security real quick.
    computers & complex voice services have made eavesdropping & code breaking way too easy. best bet: use a regular land line & speak in some invented vocal code.
    government sets up relatively few traps, it’s just that they ‘forget’ to have them taken down & the telco happily keeps taking their monthly $$. then something gets their interest & it’s blacked-out Suburban time with a legal bug in place

  14. In some rare occasions in the past I’ve had people dialing off my phone line as they dialed 0800 numbers which appeared on the monthly phone bills, I was sure for certain that no-one had phoned any 0800 numbers from my phone, I wasnt aware of Phone Line Tapping untill I did a bit of searching, after reading the stuff above its made it a bit clear to know what is going on.

    I’m now on the search on how to prevent Phone Line Tapping, and I just hope I can get a bit of legal advice on how to do self phone line scanning to prevent people dialing off my phone line. The duration and cost of these 0800 numbers are expensive and at any rate if it keeps up I’m going to have to cancel my phone line.

    Thanks in advance for any help. :)

  15. I recently caught my soon to be ex husband audio recording me using his cell phone record mode at our childs visitation drop off. Since then friends of mine often hear noises on the line with me when Im on the phone (a cell phone). They all describe it the same way…a loud noise followed by static that ends after about 20 seconds. Could he be tapping my cell phone as well? How to I find out for sure…and how do I stop it?

  16. How can someone bypass the lines connecting to residential home, without being caught ,again and again? 13 years of this is enough. Even the detectives say that I definatly have a sound device of some kind on my phone, and phone companies say they are bypassing the line , how ? Thanks for your help, if anyone can help me ….

  17. Is it paranoid or it is actually happened?
    I have a DSL line over the phone and I am afraid that someone might have access to my web pages. These thugs seem to know what I am looking for and where I am about to visit the next day. I feel that there is always someone following me to places then doing things to our cars. It is not really safe to park cars specially in public or store parking lots. If you really pay attention, there is always someone looking suspicious near in a parking lot. Is it possible.? I am thinking of seeking a help from local FBI on this matter. I don’t trust local police since they will not come unless someone got hurt or they only come several hours later when you are not there anymore.

Comments are closed.