Melody behind Phone Numbers

Have you ever found that the dialing sound of each number is different when you make a call?

At the beginning of last month (September, 2012), a Chinese college student Liu decoded the mobile phone number of Mr. Zhou (the boss of China’s IT giant 360) through listening and analyzing the dialing sound from a video in which Mr. Zhou was called. Mr. Zhou subsequently confirmed that the truth of this issue and praised that student for his well-done. Moreover, Li Kaifu, a former CEO of Google China encouraged that student to join his current company.

How could a college student without professional knowledge of sound analysis and decode do this? 

We can see from movies or cartoons that someone who has absolute pitch can identify the telephone number when hearing the dialing sounds. Some people even can make a phone call by singing. Amazing, isn’t it?

In fact, the telecommunication signaling uses the technology of Dual-tone multi-frequency signaling (DTMF). That means when we press a button on phone keyboard, the sound sent out has a high frequency and a low frequency. In other words, if you make a sound with a related high and low frequency, the related number can be called.  Although it is hard to achieve singing dialing in our daily life, some kinds of software like CoolEdit has been invented to make a call and do not need to press the keypads.

The keypad of DTMF is laid out in a 4*4 matrix as the following table.

DTMF Keypad Frequencies (with sound clips)

  High Frequency
1209 HZ 1366 HZ 1477HZ 1633 HZ
Low Frequency 697 HZ 1 2 3 A
770 HZ 4 5 6 B
852 HZ 7 8 9 C
941 HZ * 0 # D

According to this knowledge, Liu firstly collected the dialing sound from the video, then changed it to a PCM (pulse-code modulation) signed 24 bits mono wav. After that, he opened that wav in the audio analysis software such as Adobe Soundbooth to get a waveform. Finally changed the waveform to the sound spectrum, from which can easily identified the numbers.

Picture 1: Sound spectrum with the frequencies and numbers (From: Liu’s Blog)

(To protect the privacy, some parts of this picture are mosaics.)

The whole process is easy to learn and imitate, and the audio analysis software also can be down or bought from Internet. A college student of TV editing and directing major said he can decode the number from the sound in 5 minutes and every one can achieve it once know the principle and processes. Now, we have to worry about our privacy and information security considering the development of high-technology. 

Please be careful when you make a call, because if someone records it, the phone number an be decoded by sound analysis.

However, do not worry too much about your passwords of credit cards, because the sound of each number on ATM or POS is the same, so this sound analysis technology cannot be used to decoded your passwords. But you still need to take care in case of other stealing methods.




4 Responses to “Melody behind Phone Numbers”

  1. Yumin Zhao says:

    Hi, Anthony.

    Thanks for your comments.I did some research again. You are right, the sound of each number on ATM is the same. Sorry for this mistake. Because the news I read pointed out an information security expert of a university mentioned that a lady lost her money because her PIN was stolen by sound analysis. It seems to be wrong.

    Moreover, listening carefully is really a easier way, which I also mentioned in the blog. But as you said, the accuracy may be low, and it will be hard for people who are not sensitive to the sound. The aim of this blog is to introduce the principles behind the Touch Tone and raise the public awareness of information security.

    Thank you very much.

    So Phuong, do not worry too much! Cheers!

  2. Anthony Agosta says:

    It was very interesting reading this post. I am very familiar with the signal processing methods you have outlined here. Whereby you can determine the keys someone has pressed on a telephone keypad by taking the Fourier Transform (FT) of the time-varying signal (i.e. recording of the key sequence being pressed). The FT gives us the spectrum of the recording, from which we can clearly identify which frequency components are present (i.e. each key digit has a spectrum with two frequency peaks – corresponding to the DTFM key frequencies) and so the key pressed on the telephone can be determined via the lookup table you have provided 🙂

    However, for simple telephone numbers which are around 10 digits long. Simple trial and error (i.e. pressing each telephone key individually {*,#,A,B,C,D,0,1,2,3,4,5,6,7,8,9} and listening carefully to see which double-tone sounds as close to your recorded sample, is more than sufficient to achieve the same task, albeit is a less rigorous way). I believe that is the method employed by the spy’s in the movies.

    Lastly, I would just like to point out that the method you outlined here cannot be used for determining your PIN number when you use your credit card to purchase items at a shop or use the ATM. Because irrespective of which buttons you press, the same audible tone is heard all the time. This also applies to keypad entry systems to unlock safes and the like. For you see, in these types of security applications it would be rather absurd to employ unique tones for each button pressed as it would give away your PIN (even if a different unique look-up table is used)…something the banks and security companies are well aware of!

    As mentioned earlier, even if a different initially unknown look-up table is used, it can easily be populated by pressing all the keys available on the access pad and recording the sounds they make, and also performing spectral analysis to determine how many frequency components are present when each key button is pressed, to further streamline the processing of similar signals.

    So rest assured that while you are entering your PIN at the shops or ATMs, you should be more concerned about someone looking over your shoulder (visually inspecting your PIN), rather than someone listening to you key it in which only serves to provide as much information as to the length of your PIN, of which 4-digits seems to be the norm, though 8-digit PINs are becoming more popular these days for added security.

  3. Yumin Zhao says:

    Hi, Phuong!

    Do not worry too much. Although these issues could happen, the probability of occurence is still low. Most people will not do this even though they know the principles.
    Just be careful to ensure no suspicious persons around you when pressing pin numbers in public place. Do not put your ID cards and credit cards together in case of losing together.

    Take it easy!

  4. Phuong says:

    It’s a bit scary thinking that someone could get my passwords or pin numbers if they really wanted to. Do you know if there are sure fire ways to prevent someone decoding our pin numbers?