Don't Broadcast DTMF in Public

Have you noticed that your phone plays tones when you enter data on the phone keypad? Those are called “DTMF” - Dual Tone Multi-Frequency - and it’s a leftover technology from when phones needed to signal network equipment in the pre-digital age.

Turns out they’re easily decoded back into the digits you were pressing by anyone nearby.

If you were in a cafe accessing your bank’s phone service, speakerphone on, and somebody recorded your keypad entries, they could decode them.

If they did, they might see something like this:

1200574#
06082003#
8854#

The first one looks like maybe an account number. And if you look like you’re about 23 years old, the second one could be a birthdate, leaving the last one to be a PIN.

Listen carefully enough and you might even be able to hear which bank they’re talking to. Uh oh…

In DTMF, each key on a phone keypad is represented by two sine waves (tones) transmitted simultaneously. It’s a signalling method from last century, and it survives today.

An audio recording of the tones is all that’s needed to decode these back into the original keypresses.

A keypad showing keys and the DTMF frequencies they generate

From https://www.cryptomuseum.com/phone/dtmf/

Here’s a proof of concept recording I made in a noisy location with my accomplice entering some digits on their phone about 4m away.

DTMF in public

Here is what the spectrogram of that recording looks like in Sonic Visualizer, which I used instead of Audacity because it displays the frequency your cursor is pointing to, making decoding easy.

spectrogram

That’s a little hard grok if you don’t know what you’re looking for. But those horizontal segments that are just a little more solid than their surroundings represent a single, pure tone in the audio. You can see that there are two tones at a time. They look like little line islands.

It’s clearer with no room noise and the phone closer:

spectrogram

In the first spectrogram, I can visually, just barely, figure out that my accomplice was typing 031031#.

Here I am typing that same sequence on my phone in a quieter room to demonstrate that it sounds about right:

DTMF tones for '031031#', for comparison

So, be careful using the speakerphone in public with your phone’s keypad - the keys you’re typing are easy for a hacker with too much free time to decode.

References