Spectronics Backdoor Passwords

From: James M. Atkinson <jm..._at_tscm.com>
Date: Mon, 27 Feb 2006 18:21:31 -0500

If any list member is interested I now have a method of faking the
remote control codes and/or passwords for the Spectronics line of
eavesdropping devices.

This allows a TSCM specialist the ability to "blink" a Spectronics
bugging device on for a second or two to detect it, and then to shut
it back down before the eavesdropper catches on to the fact that his
bugging device has just been caught. There is a small number of 12
bit "house" activation codes that can be run though in less than a
second, but they are only 6-8 in total. If you can't hit it with the
basic sequence then you will have to run though the full 12 bit
sequence which will till take you less than ten minutes. The signal
is transmitted at 433.92 MHz as a AFSK data stream so most of you
will have no problem getting the bug to give itself up (cracks about
Prom dresses not withstanding).

The entire RF TRANSIT section shuts down when these things go into
sleep mode, but the RECEIVE section stays awake on monitors the
command channel all the time. The bugs are EXTREMELY easy to find
them if you can use the bypass codes (less than a second), or the
full sequence (less then 10 minutes) due to the small size of the
activation key, and known activation frequency. You can also find
these little bugs by purchasing 8 ea car alarm remote (12+ bits) and
simply pressing the button of each remote in sequence. You will need
to reprogram in each of the remote activation codes into the remote,
but your only talking about a sequence that is two bytes long (please
stop laughing at such a simple method to find them).

A company called Oregon Scientific and Davis Instruments makes a line
of Wireless Digital Thermometers that operate on the same frequency
as, use the same bit stream as, and operate similar to these
Spectronics Eavesdropping devices. The only problem with these
thermometers is that if you have a Spectronics eavesdropping system
nearby you run the risk of accidently activating the eavesdropping
device during a bug sweep as the weather changes (cough-cough,
nudge-nudge, wink-wink). Hand held code grabbers used by the car
alarm and garage door opener industry also make short work out of
tracking these devices, but their possession and/or use may cause legal issues

To run through the entire sequence of house command signals you only
need to spit out 128 bits of data, or 16 characters. This is
important as you can also use a wireless keyboard that operates at
433.92 MHz which uses the same format and merely type in the 16
character "all on" sequence via the keyboard, but using the car alarm
remote is a little easier. If you end up having to search for all 12
bit variations then you wouldn't want to use the car alarm method and
would need something that could tumble the entire sequence.

Spectronics is not the only company to use either this frequency, nor
are they the only ones to use the 12 bit activation code. If you
really want to take an eavesdropper to the ground you can issue the
same sequence at 310 MHz, and 916 MHz at the same time you were
transmitting the 433 MHz codes.

-jma



----------------------------------------------------------------------------------------------------
We Expertly Hunt Real Spies, Real Eavesdroppers, and Real Wiretappers.
----------------------------------------------------------------------------------------------------
  James M. Atkinson Phone: (978) 546-3803
  Granite Island Group Fax: (978) 546-9467
  127 Eastern Avenue #291 Web: http://www.tscm.com/
  Gloucester, MA 01931-8008 Email: mailto:jm..._at_tscm.com
----------------------------------------------------------------------------------------------------
   World Class, Professional, Ethical, and Competent Bug Sweeps, and
Wiretap Detection using Sophisticated Laboratory Grade Test Equipment.
----------------------------------------------------------------------------------------------------
Received on Sat Mar 02 2024 - 00:57:19 CST

This archive was generated by hypermail 2.3.0 : Sat Mar 02 2024 - 01:11:44 CST