709 700 0122/Investigation

From otp22 db
Jump to: navigation, search
Investigation This is an investigation subpage.

The information found here includes bleeding-edge updates, information dumps, and speculation.
The factual/summarized article for this page is: 709 700 0122
Be sure to separate different subjects here using a new section and subtopics using ===Subsections===.

Summary

709-700-0122 is a telephone number retrieved from Black Oak Lake cemetery on October 4th 2012. The number, when called, played back a series of tones, which lead to the discovery of Named regions and Component drops. On October 29th 2012 different messages, which are not tones, started to be received on this number. These messages appear to be scrambled voices. March 3, 2013: New scrambles.

Binary Tones

Since the number was initially found, it played back a series of tones which were found to be overlaid frequencies in multiples of 200Hz (this behavior has ceased). Viewing a spectrograph of a high quality recording it was apparent that 8 bits of binary data per tone were being transmitted(image). These have been transcribed and it appears that the message is similar to the 3323 0A message and it is being processed as such.

These calls contained some combination of parts from the same 319-byte message: http://pastebin.com/mrGtT29T.

Transcription

7d 2a 7d 2a 7d 2a 21 33 32 33 0a 5f 2b 20 f3 bf 92 83 96 fb 06 0a 6a 39 50 6b dc 6b 23 c9
7a b7 c0 3c 4e e0 61 62 ff d0 ba 3c f5 b3 e4 f4 ac 37 19 4c ca 46 3a a0 f9 3b f2 71 68 e0 
38 a9 03 83 e2 7a fe 8e 01 6c 5a cf 95 ff 58 f2 3e 2f 78 f2 8f 66 f1 d4 98 0d d1 29 4f 86 
17 c4 86 11 4a ba 89 e5 9d 44 7e 8d aa 10 74 a1 ce 87 35 e3 79 4d 53 6a 3c 9a 52 aa ea 54 
1f bc d2 c3 7f 68 77 8d 0e 66 96 3a 3d eb 33 9f a2 65 02 75 ee a8 ab 8e 3c 9b 3a 98 cc f9 
c5 a3 b5 86 8f c2 c3 9c f1 d0 f9 ec d3 c7 d1 d0 39 3b e5 f4 1a cd c8 9d 1b e9 4e 42 06 8c 
3b df b0 2f bc 6b 41 60 e6 3c 2d 10 3a 9f 1a 61 5d 14 e9 83 a0 ae 1c ac f2 c5 ea 6a e7 68 
10 d0 c3 87 48 c1 7a bb 1c 50 03 61 26 53 3d 41 a9 c6 bc bf ad f6 ee 82 ec e2 63 cd 8a 65 
6e 81 40 df c5 b4 b1 21 4f b1 a7 16 74 2d cc 64 6b 85 e4 f8 4a ae c1 4c 16 a5 82 6f a6 33 
1e bf 15 93 b0 7d c5 1e 7d fc 0c 75 af ac 69 cd 7d 05 32 db 40 06 97 ac dc 64 52 13 48 68 
09 f9 f7 80 07 fe 97 8e b6 96 7d 2a 7d 2a 7d 2a 7d 2a

File 2:

7d 2a 7d 2a 21 33 32 33 0a 5f 2b 20 f3 bf 92 83 96 fb 06 0a 6a 39 50 6b dc 6b 23 c9 7a b7 
c0 3c 4e e0 61 62 ff d0 ba 3c f5 b3 e4 f4 ac 37 19 4c ca 46 3a a0 f9 3b f2 71 68 e0 38 a9 
03 83 e2 7a fe 8e 01 6c 5a cf 95 ff 58 f2 3e 2f 78 f2 8f 66 f1 d4 98 0d d1 29 4f 86 17 c4 
86 11 4a ba 89 e5 9d 44 7e 8d aa 10 74 a1 ce 87 35 e3 79 4d 53 6a 3c 9a 52 aa ea 54 1f bc 
d2 c3 7e 68 77 8d 0e 66 96 3a 3d eb 33 9f a2 65 02 75 ee a8 ab 8e 3c 9b 3a 98 cc f9 c5 a3 
b5 86 8f c2 c3 9c f1 d0 f9 ec d3 c7 d1 d0 39 3b e5 f4 1a cd c8 9d 1b e9 4e 42 06 8c 3b df 
b0 2f bc 6b 41 60 e6 3c 2d 10 3a 9f 1a 61 5d 14 e9 83 a0 ae 1c ac f2 c5 ea 6a e7 68 10 d0 
c3 87 48 c1 7a bb 1c 50 03 61 26 53 3d 41 a9 c6 bc bf ad f6 ee 82 ec e2 63 cd 8a 65 6e 81 
40 df c5 b4 b1 21 4f b1 a7 16 74 2d cc 64 6b 85 e4 f8 4a ae c1 4c 16 a5 82 6f a6 33 1e 9f 
15 93 b0 7d c5 1e 7d fc 0c 75 af ac 69 cd 7d

Message as a Cryptogram

User Ymgve noticed that XORing the bytes of data.bin (from 524287677 onward) with the 300-byte payload of the message and a constant value produced a large amount of ASCII characters, which are seen below: (linebreaks added)

i\xc0pxpurti\xc0bEW\xc0rt\xa5
bECYEc\xe1\xe1WYQTSWS\xe1\xe1wugu\xa5
TbGID\xe1DYWfYU\xe1\xe1\xa5
bdBP\xe1WYEWAYE\xc0FVY\xc0CVTWVUEUc\xcdb\xdd\xc0YECVeEYh\xe1\xe1\xa5
SVC\xe1FIqq\xe1\xe1\xe1\xa5
SVC\xe1HR\xe1\xe1\xe1\xa5
SVC\xe1QAqt\xe1\x86\x96\xd0
SVC\xe1dbpvpwu\xe1\xe1\xe1\xa5
SVC\xe1dbqu\xe1\xe1\xe1\xa5
SVC\xe1dbqwpsq\xe1\xe1\xe1\xa5
GEUcEgc\xe1YETAYRb\xe1WYEWAYE\xc0cV\xc0YEcYIEeE\xc0CVTWVUEUc\xc0DYVWb\xc0IU\xc0UATED\xc0YEGIVUb\xa5
UV\xc0SAcEY\xc0cHAU\xc0qwrpppi\xc0VCc\xc0pu\xa5
cHIb\xc0TEbbAGE\xc0fISS\xc0BE\xc0dWDAcED\xe1\xe1


He then discovered that \xC0 characters aligned with space-characters from old Drop messages. Thereafter he began to deduce letter replacements and decoded the beginning of the message. User crash_demons continued where he left off to complete the message.

FI11, HK, JA14 are all separated by a foward slash, as are US06075, US15, US17031. But the International ones are separated from the us ones by \x86, \x96, \xd0. Could this imply a route? Maybe we don't need international assistance. The "\x86\x96\xd0" string is most likely "\xE1\xE1\xA5" ("//\n") that was corrupted at some point before decoding.

Further messages can be found: here.

Cryptogram decoder programs: here

The first message - Manual decoding diagram/worksheet:

Replacements by Ymgve and Crash_Demons :D
Number replacements aside from 7,5 probably are incorrect.
.
    data[524287677+i] ^ wavmsg[i] ^ 0x80
.     
    'i\xc0pxpurti\xc0bEW\xc0rt\xa5
     Z    080524Z    SEP    24\n
.
     bECYEc\xe1\xe1WYQTSWS\xe1\xe1wugu\xa5
     SECRET/   /   PRJMLPL/   /   75X5 \n
.
     TbGID\xe1DYWfYU\xe1\xe1\xa5
     MSGID /  DRPWRN /  /   \n
.
     bdBP\xe1WYEWAYE\xc0FVY\xc0CVTWVUEUc\xcdb\xdd\xc0YECVeEYh\xe1\xe1\xa5
     SUBJ/   PREPARE    FOR    COMPONENT(   S)       RECOVERY/   /   \n  
.
     SVC\xe1FIqq\xe1\xe1\xe1\xa5
     LOC/   FI11/   /   /   \n
.
     SVC\xe1HR\xe1\xe1\xe1\xa5
     LOC/   HK/   /   /   \n
.
     SVC\xe1QAqt\xe1\x86\x96\xd0
     LOC/   JA14/   ?   ?   ?
.
     SVC\xe1dbpvpwu\xe1\xe1\xe1\xa5
     LOC/   US06075/   /   /   \n
.
     SVC\xe1dbqu\xe1\xe1\xe1\xa5
     LOC/   US15/   /   /   \n
.
     SVC\xe1dbqwpsq\xe1\xe1\xe1\xa5
     LOC/   US17031/   /   /   \n
.
     GEUcEgc\xe1YETAYRb\xe1WYEWAYE\xc0cV\xc0YEcYIEeE\xc0CVTWVUEUc\xc0DYVWb\xc0IU\xc0UATED\xc0YEGIVUb\xa5
     GENTEXT/   REMARKS/   PREPARE    TO    RETRIEVE    COMPONENT    DROPS    IN    NAMED    REGIONS\n
.
     UV\xc0SAcEY\xc0cHAU\xc0qwrpppi\xc0VCc\xc0pu\xa5
     NO    LATER    THAN    172000Z    OCT    05\n
.
     cHIb\xc0TEbbAGE\xc0fISS\xc0BE\xc0dWDAcED\xe1\xe1'
     THIS    MESSAGE    WILL    BE    UPDATED/   /
.
.
.
.
.
.
***REPLACEMENT TABLE***
.
.
cd=(
dd=)
c0=' '
.
.
p=0? (can only be 0 or 1 - 2 and higher produce an invalid timestamp)
q=1? (probably only 1 because of 'FI11' and 19 finland regions?)
r=2? (can only be 0,1,2 because of year/month digit?)
s=3? (2, 3, 4, 6, 8 based on zip codes if p = 0)
t=4?
u=5
v=6? (4, 6, 8 based on zip codes if p = 0)
w=7
x=8?
y=9?
.
A=A
B=B
C=C
D=D
E=E
F=F
G=G
H=H
I=I
PQ=J
R=K
S=L
T=M
U=N
V=O
W=P
X=Q
Y=R
b=S
c=T
d=U
e=V
f=W
g=X
h=Y
i=Z

It should be noted that the numerical replacements (p through y -> 0 through 9) are just XOR 64 -- Crash demons (talk) 03:58, January 29, 2013 (UTC)

FIPS and International Regions

It was discovered that the codes relating to possible international locations matched up with the FIPS Region Code list (http://efele.net/maps/fips-10/data/fips-all.txt), FIPS is an acronym for Federal Information Processing Standard, you can find more about it here: http://en.wikipedia.org/wiki/Federal_Information_Processing_Standard

The below are the suspected areas of the next drop sites:

FI11 - Uusimaa, Finland; HK - Hong Kong; JA14 - Ibaraki, Japan

Scrambled messages

Otpreward.jpg

Solved 2/27/2013 by arch_

IRC transcript:

2013-02-27 11:34:59] <Braco> http://otp22.referata.com/wiki/709_700_0122/Investigation#Scrambled_messages 
[2013-02-27 11:35:41] <Arch_> Time to start waveform sifting then. 
[2013-02-27 11:34:35] <Arch_> Okay, where are they 
 [2013-02-27 11:35:41] <Arch_> Time to start waveform sifting then. 
[2013-02-27 11:36:27] <Arch_> ohohoh interesting. 
[2013-02-27 11:38:04] <Arch_> Well i'm gonna have to figure this out by ear. 
[2013-02-27 11:39:54] <Arch_> Well first thing to do is identify common patterns. I'm using audacity to filte them 
[2013-02-27 11:40:20] <Arch_> I need to slow these down to hell first though 
[2013-02-27 11:48:13] <Arch_> I'm getting somewhere actually 
[2013-02-27 11:55:57] <Arch_> Voice is definitely female and definitely reciting numbers (in the one i'm testing with at least) 
[2013-02-27 12:02:10] <Arch_> I have a theory and you won't like it 
[2013-02-27 12:02:28] <Braco> whats the theory Arch_ 
[2013-02-27 12:03:05] <Arch_> That there's like. 3 numbers hidden in each of these messages, and 90% of the audio is literal gibberish 
[2013-02-27 12:03:40] <Arch_> I might be able to back that up with some evidence in a minute 
[2013-02-27 12:05:32] <Arch_> I can definitely hear a distinct "Two" in a different voice to the other 
[2013-02-27 12:05:54] <Arch_> Much higher pitched and sounds synthesised 
[2013-02-27 12:07:50] <Arch_> I'm going through each individual snippet of audio of about 1/4 to half a second and individually changing them 
[2013-02-27 12:08:27] <Braco> interesting Arch_ 
[2013-02-27 12:08:41] <Arch_> gonna look at another file. i can only get a hazy six, a solid 2 and a hazy nine from this one, 
2013-02-27 12:08:44] <HuoXue> What types of changes are you using, though? 
[2013-02-27 12:09:30] <Arch_> Pitch, Amplitude, Reversing, Inverting channels, speed/tempo and equalization 
[2013-02-27 12:50:01] <Arch_> Jesus christ guys 
[2013-02-27 12:50:28] <Arch_> http://vocaroo.com/i/s0fIpEomkXvS 
[2013-02-27 12:53:44] <blyind> you must bea genius or the PM 

[2013-02-27 12:57:58] <Arch_>  trimmed the garbled sections of all the dates ending in 4, layered them and used an inverted radio equalization of about 676hz on each. Lowered the pitch by about 40 and the speed by about 65. Merged and exported 

[2013-02-27 13:00:56] <Arch_> I'm an aspiring programmer. 
[2013-02-27 13:01:06] <Arch_> Audio is just neat and easy. 
[2013-02-27 13:04:11] <Arch_> Another key factor. Length of recording 
[2013-02-27 13:04:53] <Arch_> For the first one, sequentially incrementing in length 
[2013-02-27 13:05:00] <Arch_> but leaving the start points in the same position 
[2013-02-27 13:05:27] <Arch_> Gonna try with some of the later ones 
 [2013-02-27 13:06:25] <TonyInICT> SO I would assume that the people these messages are intended to be to have some kind of software that decodes these faster than what Arch_ can do 
[2013-02-27 13:07:38] <Arch_> It'd require multiple audio channels, the ability to change pitches, reverse/inverse tracks and merge 
[2013-02-27 13:07:52] <Arch_> its weird. 
 [2013-02-27 13:18:26] <Arch_> got another! managed to get it clearer than the last one too 
[2013-02-27 13:18:45] <Arch_> http://vocaroo.com/i/s07av1Y4zslE 
[2013-02-27 13:33:23] <Arch_> Getting the first one reuploaded. 
 [2013-02-27 13:33:38] <Arch_> http://vocaroo.com/i/s0m0LKwTMhEr
...
[17:41]	Arch_	The scramblers i got to work by overlaying 4 different scrambled tracks at different pitch,speed and inversions (from the start and end beeps) plus an inverted radio equalization filter at about 676hz 2012-10-29 19-04, 2012-10-30 15-34, 2012-10-31 05-44,2012-11-02 14-44 provided the first set of numbers. 2012-11-03 17-56,2012-10-30 19-52,2012-10-30 15-37 and 2012-10-29 11-47 provided the second set. 
[17:42]	Arch_	I've tried three more sets since those ones worked 
[17:42]	Arch_	and got nothing of note 
[17:43]	Arch_	I don't know how the values for the scramblers are actually supposed to be figured out though. and i have no way of telling which sets actually contain data. 
[17:43]	Arch_	I don't know how the values for the scramblers are actually supposed to be figured out though. and i have no way of telling which sets actually contain data. 
[17:43]	Arch_	Date might be significant though 
[17:44]	Arch_	Oh and they should be merged in order of the length of the tracks in ascending order

Arch declined the 45 USD reward offered by Maddyman, Adah, Xkeeper and Braco.

History

On Monday 29th October 2012 we received new messages on this number. These are different from the horns, and appear to be scrambled voices.

44 different messages were recorded between 10-29 and 11-04:

The messages stopped on November 4th and resumed on the 15th:

March scrambles

A new message came March 03 2013:

Speculation

Every call is different, so we might have live feed or some long recording cut into pieces.

There is also speculation that the voices are modulated, and the carrier is confirmed as 600hz, and that we will need to unmodulate possibly through a radio circuit playing with frequencies. Rahm has found this relevant wikipedia page: http://en.wikipedia.org/wiki/Voice_inversion

The female voice before the scrambled message appears to be an asterisk prompt message named system-status-msg.gsm which says in full "Please listen carefully to the following system status message."

IRC quote from chshepherd:

  • <cshepherd> yes the sound is not unlike detuned ssb
  • <cshepherd> there are upper and lower sidebands in the audio, but i think they are mirror images, and that happens during ring-modulation, which is one of the reasons i suspected it. and it may be an ingredient, it just ain't the whole formula

He uses Audacity software.

  • <cshepherd> using simple nyquest statements to multiply the sound with a generated sinewave
  • <cshepherd> if you do play with audacity and nyquest scripting (Effects > Nyquest Window) it's worth noting that i tried (mult s (hzosc n)) for many values of n between 100 and 20000 (in the hopes that it was ringmod / simple voice inversion)
  • <anonen> did that get anywhere?
  • <cshepherd> nothing exciting

Quote from IRC:

  • <GarethTheGreat> it's a mix of different modulation schemes, like different signals that were chopped up and put into one file in pieces
  • <GarethTheGreat> some bits are DEFINITELY amplitude modulation (AM), stands out straight away
  • <GarethTheGreat> other bits look like a normal voice signal, other bits something that's definitely encoded/modulated but i can't recogonise the scheme
  • <GarethTheGreat> the quieter periods show a recurring cycle of some sort too, so maybe the whole thing is then wrapped inside of a low-frequency carrier on top of that
  • <anonen> amplitude modulation - how can we deal with that?
  • <GarethTheGreat> you can with some tedious work reverse it manually
  • <GarethTheGreat> but there's probably a far superior way
  • <anonen> which is?
  • <anonen> GarethTheGreat theres a lot of these wavs, ideally we find a way to automate it
  • <GarethTheGreat> an AM radio - a literal physical AM radio
  • <GarethTheGreat> you'd need to feed the signal into it after the aerial amplification stage
  • <GarethTheGreat> and then you'd tune it in and listen
  • <GarethTheGreat> it almost certainly can be done in software with some sort of automated tool, but i'm not a DSP guy
  • <GarethTheGreat> need someone more skilled with DSP
  • <GarethTheGreat> what you need to do is pass the signal in just after the first amplifier - and that involves opening up the physical radio, figuring out where the right part of the circuit is and connecting to it
  • <GarethTheGreat> also need to take care to isolate the magical invisible radio waves in the air so they don't interfere
  • <GarethTheGreat> alternatively, this can all be done mathematically in software
  • <nadando> you can do it in matlab
  • <nadando> http://www.mathworks.com/help/comm/ref/amdemod.html

IRC quote from Calza13:

  • <calza13_> guys, it's variable band inversion scrambling
  • <calza13_> http://seussbeta.tripod.com/crypt.html
  • <calza13_> listen to the message
  • <calza13_> then follow that link and listen to the variable band sample
  • <calza13_> they both look similar on audacity as well
  • <anonen> can you unscramble it then?
  • <calza13_> i'm trying to find some software for it
  • <calza13_> "Variable-band inversion inverts the signal around a constantly varying frequency, making decryption possible, but not bloody likely. Variable band inversion can be identified by the burst of modem noise at the beginning of the transmission (its a 1200 bps carrier) and the repeated clicking sounds as the inverting frequency changes. Descrambling variable band inversion would be a chore for the amateur eavesdropper, as the inversion point
  • <calza13_> base band sounds nothing like it
  • <calza13_> i'm pretty sure it's variable band
  • <calza13_> only problem with that is that the frequency changes a lot

Crypto irc log:

  • <Riastradh> You probably want to look into SRTP or something if you want to encrypt voice transmissions.
  • <Riastradh> (and authenticate)
  • <Riastradh> An authenticated encryption scheme for VoIP, RFC 3711.

Crypto irc log:

  • <AAA_awright> anonen: You're probably on the right track to look into existing scrambling systems, especially from decades ago
  • <AAA_awright> But it could be something stupid like, take the FFT of the waveform, and take the inverse, feeding the time domain into the frequency domain and vice-versa
  • <AAA_awright> That's what it sounds like
  • <AAA_awright> It sounds like someone took their picture of their cat and turned it into a waveform, really
  • <AAA_awright> anonen: Is "709-700-0122" a unique ID I can use? Or some other field?
  • <AAA_awright> anonen: Can you get recordings at higher sample rates
  • <AAA_awright> I'm afraid there's not enough information with only 8000kHz sample rate
  • <AAA_awright> Perhaps not, 4000Hz is usually the upper limit, but it seems there's more information here that's being cut off
  • <AAA_awright> er, 8kHz sample rate, which is usually good for analog telephone lines (not modern cell lines though)
  • <AAA_awright> anonen: http://tesla.bzfx.net/2012-10-29%2011-47%20UTC%20-%20709-700-0122%20-%200.linear.bmp That's what I'm looking at right now
  • <AAA_awright> That's the spectrum plot on linear scale, 62.5Hz at the bottom, 4000Hz at the top
  • <AAA_awright> Notice that voice (and most instruments, especially strings) have overtones, which look like repeating lines going all the way up from the bottom
  • <AAA_awright> They're not very clear in this one because the strong 400Hz or so tone mutes the other levels
  • <AAA_awright> You also see some pre-ringing, you can't help that in a spectrogram
  • <AAA_awright> anonen: But you notice you also see overtones in the scrambled section too
  • <AAA_awright> Actually, it's not like someone encoded an image of their cat
  • <AAA_awright> It's more like what you hear when you have those analog radios and you scan the frequencies across the channels
  • <AAA_awright> You get 0.1s of each radio station
  • <AAA_awright> So you see the overtones, but there's no distinct message
  • <anonen> we are sure there is a real message as every other thing sent did have a message
  • <AAA_awright> I'm seeing two primary types of transforms here
  • <AAA_awright> First is they might be interleaving segments of the messages with each other
  • <AAA_awright> 0.1s of one message, then 0.1s of a the message two seconds later, then 0.1s of another message, etc
  • <AAA_awright> The second is they might be shifting the frequency domain physically up and down
  • <AAA_awright> Usually when you have overtones, they occur at multiples of the first, lowest frequency
  • <AAA_awright> The fundemental
  • <AAA_awright> Human voices work like this too, when we sing 440Hz we also emit frequencies at 880, etc
  • <AAA_awright> 1320Hz, and so on
  • <AAA_awright> Normally the distance between the overtones is the same as the fundemental, but here it isn't
  • <AAA_awright> That can happen sometimes naturally
  • <AAA_awright> Brass instruments omit even or odd overtones
  • <AAA_awright> Which gives them their distinct sound
  • <AAA_awright> But still you can see that
  • <AAA_awright> They may also be overlaying one waveform on top of another
  • <AAA_awright> Or something sophisticated, for instance, they take a random sample from a television broadcast which is unimportant, and play it along with the actual message
  • <AAA_awright> That does absolutely nothing for security but it's harder to sort out which is signal, and which is noise
  • <AAA_awright> Some segments may be played backwards, there's not enough information to tell (pelosives like 's' would be nice but phone doesn't have enough bandwidth to clearly see them)

Tools to solve the messages include:

Possible encryption methods

  • Examples of many different modes
   http://www.kb9ukd.com/digital/
   http://www.bartg.org.uk/modesamples.asp
   http://www.w2sjw.com/radio_sounds.html
   http://www.cryptomuseum.com/crypto/voice.htm
  • Baseband speech inversion
   http://www.youtube.com/watch?v=0uRy-217dNE
   http://www.personainternet.com/~northscan/files.html
   http://www.dxzone.com/cgi-bin/dir/jump2.cgi?ID=16133
   http://www.mediafire.com/?zpn4jvraa2yk4j5 
   http://www.mediafire.com/?b47e0m2k0r37bdf alt source: http://antoninoporcino.xoom.it/VoiceDescrambler/index.htm 
   NIFTY SPECTROGRAM READER TOOL  http://www.mediafire.com/?vybrj0rsvwt8ms8  6MB; see it here http://www.youtube.com/watch?v=UcBDSoVs42M
  
GBPPR2- Youtube users response to my email. (http://www.youtube.com/watch?v=0uRy-217dNE)
   That's pretty neat...
   I used this program:
   http://projects1.gbppr.org/nfl/si.zip   (other link:  	http://www.mediafire.com/?70gjxda42ijcw2c)
   That voice inversion sounds alot more advanced though.
   You may have to break the conversation into "slivers" they apply the voice inversion process to each one, then 
   recombine them into the message.
  • Sigsally
   http://www.youtube.com/watch?v=Ev1Mc_rOM74
  • STU-I NATO phone from 70's
   http://en.wikipedia.org/wiki/STU-I
   http://www.cryptomuseum.com/crypto/usa/stu2/index.htm
  • Rolling Code Inversion
   http://www.kb9ukd.com/digital/rolling.wav 
   Voice scrambling.  Possibly called "Midian".  Radios by Transcrypt International?  Data burst at the start is the scrambling
   sync required to descramble. 	410-420Mhz in Quebec.
   http://www.kb9ukd.com/digital/
  • GBPPR2- Youtube users advice (http://www.youtube.com/watch?v=0uRy-217dNE
  • Some sort of volume inversion - Current frequencies are very top-bottom and leave gaps in the middle, maybe loud frequencies could be soft and softer parts be made loud.
  • ITA2 - but difficult to see on a spectrogram because of the other sounds.
  • Unknown - something to do with the recurring horizontal lines. Note: the lines seem to warp at other spots.

Things That Vargomax Has Tried

I've fed the clips through a few voice inversion descramblers and had no luck. I agree that they sound very much like they're using inversion, and they lack the rhythmic clicking that would indicate rolling code inversion (inversion frequency changing rapidly) so I am still operating on the idea that they are baseband inverted around a 600 Hz carrier (as indicated by the beginning tone). I've tried ring modulating in Audacity with a 600 Hz tone which should descramble baseband inversion, but still don't get anything intelligible. Am currently testing my setup with a few known clips of voice inversion scrambled speech to make sure it's working right.

2BM, 2AZ, and 2CS

November 4, 2012 New message on 709 number

Recording is "Your call cannot be completed as dialed. Please check the number, and dial again. 2BM", repeating several times, each repetition separated by several seconds of silence. Based on the uniformity of autodialer recordings, and the discovery of old phile magazines listing the message, including the mysterious 2BM, as a stock telcom error message, the spoken message was determined to not have any value as a potential code. However, IRC user Adah reported they were getting different messages when calling by themselves.

[2012-11-05 02:12:37] <Adah> It always says "Your call cannot be completed as dialed, please check the number and dial again" followed by three characters.
[2012-11-05 02:15:43] <Adah> I've gotten 2BM, 2AZ, and 2CS
[2012-11-05 02:15:54] <eugd> you've called it yourself?
[2012-11-05 02:15:58] <Adah> Yeah, manually.
[2012-11-05 02:16:21] <eugd> all the ones on the autodialer are 2BM
[2012-11-05 02:18:20] <Adah> This time I got a message that said "announcement for switch 154-6"?
[2012-11-05 02:19:13] <Adah> And the verizon wireless message was in a different voice.
[2012-11-05 02:20:35] <Adah> There are different recordings, I guess.
[2012-11-05 02:24:47] <Adah> There are four messages I've gotten so far: 2BM is the most common, but I've also gotten 2CS and 2AZ
[2012-11-05 02:25:07] <Adah> I'm in New York
[2012-11-05 02:25:21] <eugd> lead us to believe it was just part of the recording
[2012-11-05 02:25:41] <Adah> They could all just be part of the recording but there are definitely different messages that I'm getting.
[2012-11-05 02:40:42] <Adah> I don't know if they're even relevant or if they're all just placeholder messages
[2012-11-05 02:50:31] <Adah> i managed to record the "announcement for switch" message, but it is the worst recording in the world
[2012-11-05 02:55:05] <Adah> oh god this recording is literally the worst
[2012-11-05 02:55:17] <Adah> warning, the background noise is deafening
[2012-11-05 02:55:22] <Adah> http://vocaroo.com/i/s1yWjvXUPXcA
[2012-11-05 02:55:46] <Adah> If you can't hear it properly, it's "Your call cannot be completed as dialed, please check the number and dial again. Announcement for switch 154 dash 6."
[2012-11-05 02:56:09] <Adah> SORRY

Busy signal recordings

From 11-05 to 11-14 46 recordings were made with busy tones along with various lengths of silence. Some of these recordings are identical.


Change in Response After El Cerrito Drop Acquisition

On June 19th, 2013, the number began playing interrupted ring tone. The features of this ring tone suggest a poor attempt to possibly use switching or keying of the ringtone to transmit messages.

On July 7, 2013, the dialer recorded this call: 2013-07-07 02:44 UTC

This is an image of the Amplitude Envelope of that interrupted ringtone:

709-700 20130707.png

This is an image of the first part of the call, expanded in time. It is an Amplitude Envelope. It may represent an attempt to "key" the ring by means other than key or bug. Note that, although it it could be taken to be "dahs and dits", individual "on" periods seem to display about four seperate durations. This may be from operator characteristics, or, may mean the it is not binary. Additionally, note clicks between tone. These may be delimeters, signifying individual grams. (If it is a signal at all.)

709-700 20130707 earlier Part of message.png

This is a similar image, of the amplitude envelope, of a sample of the remainder of the message. It could either represent binary data, as if a Morse Code keying of the ring tone, or, owing to irregular durations of the the individuals sounds, may represent a keying in a different number system.

709-700 20130707 later Part of message003.png

In August 2013 ringing tones still very irregular and different every call

http://dialer.otp22.com/2013-08-23%2009-15%20UTC%20-%20709-700-0122%20-%200%23.wav

fMQgw98.png
5gyXzVR.png

Tones are very irregular in length of every tone and in length of silence between two tones (two patterns short period of silence in beginning and longer at second part. But length of since in each section seems constant!

Here are beginning of two sequential recordings:

http://dialer.otp22.com/2013-08-23%2009-15%20UTC%20-%20709-700-0122%20-%200%23.wav
and
http://dialer.otp22.com/2013-08-23%2009-39%20UTC%20-%20709-700-0122%20-%200%23.wav

uEMC6RJ.png ZdDY23p.png

Clearly different for each call. Is it prerecorded? It is randomly generated on the fly? Same questions that we were asking at scramblers...