Scenario #1 - Monitoring Spice Channel Audio on AOL/Time Warner Cable
Along with the usual video sync suppression - the Spice channel, as carried on AOL/Time Warner cable, "jams" the supplied audio carrier to frustrate any attempts on audio eavesdropping. On a normal NTSC video signal, the FM modulated audio carrier is offset 4.5 MHz from the video carrier. Example: if the center video carrier you want to receive (channel 77) is at 541.25 MHz then the audio carrier will be at 545.75 MHz (541.25 + 4.5).
On the good channels, such as Spice, the commie bastards at AOL/Time Warner actually transmit a random "noise" signal at the standard 4.5 MHz offset. The true, unencrypted audio signal is actually transmitted at a non-standard offset of 4.75 MHz, 250 kHz higher (541.25 + 4.75 = 546 MHz). If you where to directly monitor your cable TV signal, through about 20 dB of attenuation, on a communications receiver tuned to 546 MHz (wideband FM) the audio would be crystal clear.
Scenario #2 - Descrambling Cordless Phone Intercepts that use Speech Inversion
It is possible to "decode" the speech inversion used on some of the newer cordless phones using only commonly available parts, some even from Radio Shack.
What you'll need:
- Radio Shack PRO-2042 scanner, part number 20-464, or any radio that you can tap the 455 kHz last intermediate frequency (IF) strip.
- Radio Shack DX-390 shortwave receiver, part number 20-214, or any radio capable of tuning (in upper/lower sideband) 455 kHz +/- 10 kHz.
- 10 k 1/4 watt resistor, Radio Shack part number 271-1335.
- 0.01 uF ceramic capacitor, Radio Shack part number 272-131.
- Chassis mount BNC, Radio Shack part number 278-105.
- RG-58 patch cable, Radio Shack part number 278-964.
- BNC to phono adapter, Radio Shack part number 278-250.
- Phono to 1/8" mono adapter, Radio Shack part number 274-330.
Radio Shack PRO-2042 D34 LocationFor reference: Back of scanner has the antenna jack. Front of scanner has the LCD display. Top of circuit board is where the speaker is. Bottom of circuit board is where the board is covered with surface mount componets.
D34 is a small, surface mount diode located on the bottom of the main circuit board of the scanner.
First, locate the silk screen marking for D34 on top of the main circuit board, it's near the back of the scanner, near the antenna jack. Make a mental note of which way the cathode is pointing (the bar in the symbol).
Now, flip the scanner over. Approximate where you think the diode will be, because it won't be labeled! With the scanner upside down, and the front facing you, it will be in the upper left corner near the antenna jack. It will look like a small black rectangle with a stripe on one side and the marking "2A" on the body.
Solder to the cathode of the diode, the end with the stripe. DON'T overheat the diode or you'll lift it from it's solder pad. It's best to follow a trace and solder to a open pad or safer component that it is connected to.
Using the patch cable and adapters, hook the PRO-2042 scanner to the DX-390 receiver's 1/8" antenna jack.
- Tune the DX-390 to 455 kHz with the BFO switch on.
- Turn the RF gain all the way to zero and adjust the volume to a normal level.
- Now turn on the PRO-2042 and tune to a known scrambled cordless phone conversation. You should hear the scrambled audio on the DX-390 speaker.
- Tune around with the 1 kHz setting from 450 to 460 kHz. Stop when you get a strong, clear signal. You may have to tune a little off of the normal 455 kHz frequency if the signal from the scanner is too strong, or attenuate it.
- Use the BFO to adjust the received cordless phone audio. You should be able to descramble the audio by carefully adjusting the BFO setting.
- It takes a little adjusting, but it will work. Check the data sheet for the Motorola MC13110 cordless phone subsystem for more infomation on how the signal is actually scrambled.