Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
If I generate a DTMF(dual tone multi frequency) tone on phone A, clearly the tone gets decoded by the other phones (phone B, C...) on the call. Does the DTMF tone also get decoded by phone A?
How is the tone removed from the signal processing on phone A? Can I have the tone be interpreted by phone A?
This is interesting to me for public telephones that are used to enter a pin.
DTMF signals have no inherent meaning - they just transmit the pressing of a key on the phone. It makes though only sense to decode these if there is an application which actually expects to interpret these key presses in a meaningful way and then acts on the extracted information. And it makes no sense to decode these information on the senders side since there is nothing gained from decoding these.
That said, it might of course be possible that DTMF decoding is part of some software library or chipset which gets also used on the senders side and which due some misconfiguration or bad design will always attempt to decode potential DTMF signals, no matter if some applications expects to make use of the extracted information or not. It is only unlikely, i.e. either is not done or is uncommon.
In most "analog" cases, there isn't a telephone handset that is performing any DTMF decoding operations. On POTS, there's typically a separate device such as an AUDIX PBX, a DMS-100 switch or an answering machine with an IC (Integrated Circuit) chip that performs the signal processing--such a chip is known as a DTMF receiver. Regardless of what ultimately processes the frequencies, sometimes systems will implement security features to prevent precisely what you're describing; for example, muting the caller and/or callee microphone/keypad/etc. These are ways to ensure that decoded DTMF tones originate from the intended source.
In order to prevent red-boxing, some payphone would mute the handset until a coin was deposited. Although it applies to ACTS tones as opposed to DTMF, the countermeasure is conceptually the same. This safeguard could still be abused by simply depositing a single nickel and then using a tone dialer to simulate depositing the remaining coins. (Note that the initial coin deposit unmutes the mic such that the authentic ACTS tone it causes can be handled properly). Alternatively, an "op-redirect" such as dialing a Carrier Access Code (CAC) could be utilized to force operator-assisted dialing which would also unmute the mic, so the operator's trunk is able to receive any ACTS tones (whether they be authentic or not.)
It's possible that call boxes on apartment buildings are susceptible to such vulnerabilities. I know that one location I was a resident of recently was mandating that their tenants subscribed to Google Voice. I didn't live at the site long enough to witness this approach in action, but I suspect it may have been related to the fact that SIP emulates DTMF with INFO requests as defined by RFC4733.
If you remove DTMF tones from sender side (phone A) they will not reach phone B! They have to travel through the voice channel to make use of them in the other side.
If you are concerned about your DTMF tunes being listened to and decoded in a public phone then your concern is valid. There is no way you can protect yourself here. Just don't use public phones!
At call center side though, they have DTMF masking, where they detect DTMF tones beforehand, process them first, then converts them all to one flat tone, so that they cannot be decoded by someone in the organization.
