Decius wrote:

Ha... They were using old school dtmf techniques to detect call status! Thats a bizarre approach. You'd think they'd have some device that spoke SS7 and the network would simply send the digital call traffic to them. U: I just read the paper. Apparently there IS no good reason they are using inband signals. Its a good paper. Read it.

Of course, this kind of vulnerability isn't what I'm really interested in with respect to CALEA equipment. The big question is how does Law Enforcement get access to the CALEA system and is the security/authentication of that access method sufficient to prevent other parties from using the system. I've heard unsubstantiated whisperings that it isn't... U: The paper seems to allude to this suspicion as well...

SS8 makes a SS7-talking CALEA intercept device. Their idea on implementation is pretty much "just send us that DS3, we'll pick off what we want". Seems to do the job, but there are always other concerns with the system (timing, etc.). But yes, with DSx circuits and SS7, you can easily loop a circuit through a tap device and just copy the bits you want off of it and onto a disk.

RE: Blue Boxing Wiretapping Systems