HARDWARE This section addresses the ways in which an adversary could exploit vulnerabilities that are inherent in the system hardware to gain unwanted access to information passing through the switch.
SUSCEPTIBILITY TO TAPPING A PBX’s susceptibility to tapping depends on the methods used for communication between the PBX and its instruments. This communication may include voice, data, and signaling information. The signaling information is typically commands to the instrument (turn on indicators, microphones, speakers, etc.) and status from the instrument (hook status, keys pressed, etc.). Three general communications methods are discussed below.
Analog Voice with or without Separate Control Signals This is the simplest of the three methods discussed here. Analog voice information is passed between the PBX and the instrument on either a single pair of wires or two pairs (one for transmit and one for receive). If there is any additional signaling communication (other than the hook switch) between the PBX and the instrument, it is done on wires that are separate from the voice pair(s). The voice information is transmitted essentially as it is picked up by a microphone. It is in a form that can be directly reproduced by a speaker. The voice line can be easily tapped by connecting a high impedance differential amplifier to the pair of voice wires. The amplified voice signal can then be heard directly with a speaker or headphones, or it can be recorded for later playback. If signaling data is transmitted on a separate set of wires, it is normally in proprietary formats. An adversary with physical access can gain useful information by hooking an oscilloscope up to each wire and observing the effects when the instrument is taken on and off hook, keys are pressed, etc. For example, in one common format the voltage present on each data wire reflects the on/off status of a control or indicator.
9