[SOLVED] RF Emission from Piezoelectric Buzzer

If the pair of telephone cables I showed earlier are used as an antenna for reception, how far could a very low power signal (1 uV) travel on the wire?

That's impossible to answer exactly but it wouldn't be far. The wires would act as an antenna but there are two reasons why they probably aren't:

1. The wires have to be the correct length and orientation to work properly as an antenna. The length is decided by the phone manufacturer so it's unlikely they would pick it exacly right for a transmitter to be installed later and if it's position relative to other objects changed it would also detune it. In other words the phone would have to be precision designed ready for the bug which is hardly likely.

2. If you look at any antenna, the bit that picks up the signal has a counterpart that "it pushes against". I'm explaining it very non-technically! In a TV/Broadcast radio type antenna you will notice the point where the connection is made splits into opposite directions, sometimes with the ends looped together, it's called a "dipole". The voltage and current received or transmitted creates a wave with opposite polarities at each end. If you were to point both ends of the dipole in the same direction the opposite signals would cancel out and it would no longer receive or transmit efficiently. Your wires double back on themselves so as an antenna they would work particularly badly.

If you want a guess at how far the 1uV signal would travel, not knowing it's layout or frequency, I would guess one or two metres at most and probably not equally in all directions.

Brian.

betwixt said:

If you want a guess at how far the 1uV signal would travel, not knowing it's layout or frequency, I would guess one or two metres at most and probably not equally in all directions.
Brian.

Click to expand...

You are referring to a receiving antenna?

It makes little difference, when receiving the length from end to end of the dipole converts electromagnetic radiation (the radio signal) to a voltage, when transmitting it converts a voltage into electromagnetic radiation. Whichever way it's performed, folding the ends of the dipole together stops it working properly. Imagine a skipping rope analogy: tie one end to a fixed point, a wall for example, then swing the free end up and down. As one particular rate of movement, a wave will build up along the rope, any other speed results n random motion. That steady wave is analogous to the bug frequency and length of antenna. Now untie the fixed end and hold both ends of the rope in your hand and try to recreate the same wave! That's analogous to folding the antenna wire back on itself.

When you refer to 1uV I have to assume it is at the connection point of the antenna where it is a pure voltage. Beyond the 'wired' connections when the signal is in free space it is notoriously difficult to quantify. Think of the 'assumed' antena as a light bulb and you can then imagine the spread of light it projects on to surfaces in a dark room. Everything the light passes through or is obscured by will reduce it's visibility and the distance away before it hits a surface decides it's spread and therefore brightness per unit of area. Add to that there might be reflections which divert the light from a straight line. A radio signal behaves much in the same way as the light beam so you can imagine when it is embedded in something like a telephone where it is surrounded by plastics and metals, the radiated signal is highly unpredictable.

Brian.

FvM said:

The nice off-topic chat about good old telephone technology reveals the helplessness regarding the original thread topic, I presume. I can hardly imagine that the discussion gives any new insights.

B.t.w., there have been discussions about eavesdropping in good old days too. I remember that a guy who was a bit affine to conspiracy theories asked me to check, if an offender could utilize the carbon mike for on-hook eavesdropping by feeding RF power to the telephone line, bypassing the hook-switch with the spark suppression capcitor. You know that carbon mikes have been used as AM modulator in the early broadcasting experiments. My result was, it's theoretically possible, but you must tap the telephone line quite near due to it's strong RF attenuation.

Click to expand...

How "near" are you referring to?

- - - Updated - - -

FvM said:

Theroretically yes. Other than with the ancient carbon mike which can modulate RF on it's own, the attack would depend on a counterfeit ringer IC and a considerable RF level, sufficient to power a transmitter after being rectified.

The attack could be detected either by the RF or the DC voltage at the ringer IC (see e.g. posts #31, #33, #75, #85).

Click to expand...

How can I test if the ringer IC is counterfeit?

I could not detect any significant voltage on the ringer IC. I think they were not transmitting RF down the telephone line.

The modulated RF containing the audio is not high power, it only needs a range of maximum 2 m. At that low power it's very difficult to detect RF against ambient RF.

I suspect they only send RF down the line when they want to listen in on conversations.

How "near" are you referring to?

Click to expand...

Some 10 meters, typically inside your building.

How can I test if the ringer IC is counterfeit?

Click to expand...

I guess you can't. Referring to your scenario with the RF is only applied temporarily, you won't see anything in idle state. But the radiated RF level from the unshielded cables would reveal to a spectrum analyzer when the device is active.

You are talking about a really sophisticated eavesdropping device. My first objection against it's plausibility would be (as others mentioned before) that there are 99 easier ways.

EricaS said:

send RF down the line

Click to expand...

As mentioned before, RF on a phone line can be blocked easily by low pass filter.

volker@muehlhaus said:

As mentioned before, RF on a phone line can be blocked easily by low pass filter.

Click to expand...

I don't want to block or stop it, I want to prove that it's being used this way.

- - - Updated - - -

FvM said:

Some 10 meters, typically inside your building.


I guess you can't. Referring to your scenario with the RF is only applied temporarily, you won't see anything in idle state. But the radiated RF level from the unshielded cables would reveal to a spectrum analyzer when the device is active.

You are talking about a really sophisticated eavesdropping device. My first objection against it's plausibility would be (as others mentioned before) that there are 99 easier ways.

Click to expand...

How can I generate an RF frequency down a telephone line so that I can test the telephone if it does in fact broadcast low power RF?

List your top three alternative eavesdropping methods.

How can I generate an RF frequency down a telephone line so that I can test the telephone if it does in fact broadcast low power RF?

Click to expand...

It would be quite difficult, the phone line will not behave like a conductor in the sense of a power cord and being two wires, one up and one down parallel to each other, to carry the high frequency current, it would be hard to impedance match. I would suspect several Watts of power and a very lossy matching network would be needed. It would also require the line connection back to the switchboard/outside to be isolated or it would be seen as a parallel load to the RF generator. It would be like trying to find the best way to mount for a tightrope so you could drive a bus along it.

By far the easier methods would be:
1. a tiny audio transmitter, something about 10mm square would be plenty big enough and easy to hide but would be battery powered with short lifetime (a few days).
2. a hidden 'normal' microphone wired back to an amplifer. Almost zero cost but would need a hidden cable.
3. a transmitter & microphone hidden in an AC outlet box, plenty of power available there!
4. if your room has a PA system, the loudspeaker could be used as a microphone. Is your bug at work or home?

As FvM mentioned, there must be another 96 ways left.

Brian.

betwixt said:

It would be quite difficult, the phone line will not behave like a conductor in the sense of a power cord and being two wires, one up and one down parallel to each other, to carry the high frequency current, it would be hard to impedance match. I would suspect several Watts of power and a very lossy matching network would be needed. It would also require the line connection back to the switchboard/outside to be isolated or it would be seen as a parallel load to the RF generator. It would be like trying to find the best way to mount for a tightrope so you could drive a bus along it.

Click to expand...

Is there not a way to do this with the phone not connected to the telephone system? Just standalone feeding RF directly to the connection. Something simple that I can demonstrate the bugged phone as broadcasting RF and an unbugged phone as not. This would be good evidence in support of my case.

betwixt said:

By far the easier methods would be:
1. a tiny audio transmitter, something about 10mm square would be plenty big enough and easy to hide but would be battery powered with short lifetime (a few days).
2. a hidden 'normal' microphone wired back to an amplifer. Almost zero cost but would need a hidden cable.
3. a transmitter & microphone hidden in an AC outlet box, plenty of power available there!
4. if your room has a PA system, the loudspeaker could be used as a microphone. Is your bug at work or home?

Click to expand...

All of these methods can be easily detected: Battery power requires constant change and there is the significant risk of being found either accidentally or during a TSCM sweep.

This method doesn't raise suspicion. There is constant power supply, the telephone does not have extraneous cirtuitary, and its virtually unaltered.
As I've said before the only alteration I see is the reversal of the ringer polarity.
Which to date I cannot find an explanation for.

Having found my laptop is broadcasting audio as FM, I'm more convinced than ever that the telephone is capable of the same thing. The telephone was used before laptops had microphones.

This is at work not home.

EricaS said:

I don't want to block or stop it, I want to prove that it's being used this way.

Click to expand...

How can you ever proof it if the RF signal is only there during full moon on Thursdays, and switched off in the presence of RF signal analyzers?

volker@muehlhaus said:

How can you ever proof it if the RF signal is only there during full moon on Thursdays, and switched off in the presence of RF signal analyzers?

Click to expand...

That's why I want to proof it with my own RF generator.

EricaS said:

That's why I want to proof it with my own RF generator.

Click to expand...

Unfortunately your answers quite clearly indicate aren't interested in a respectable test - that is a test which can demonstrate any imagined effect is not there. If one test fails to show your imagined effects, then you ignore the result and invent another "test"; rinse and repeat ad infinitum.

Amusing for a while, then it becomes rather pointless and sad.

BTW, consider the legality of transmitting arbitrary RF signals. In most countries it is illegal, for very good reasons. Get detected at your place of work (which you have stated is high security) and you may be in trouble there too.