Introducing D-Modem: A software SIP modem

October 29, 2021 6 mins

Introducing D-Modem: A software SIP modem

Connect to dialup modems over VoIP using SIP, no modem hardware required.

Even in 2021, Aon’s Security Testing practice occasionally receives requests from our clients for penetration testing of systems accessible over dialup modem. These legacy systems have sometimes been running for decades, and often have never undergone any type of formal security assessment. While not usually accessible over the internet, in many cases these systems are connected to an organization’s internal LAN, making them attractive targets for attackers looking to bypass internet-based perimeter defenses.

Connecting to these systems typically requires a physical modem and either a PSTN-connected landline, or a low-latency VoIP connection and an analog telephone adapter (ATA).

To facilitate testing these systems in the modern era, Aon is releasing D-Modem, a software solution that does not require a physical modem or ATA. All that is required is an account with a SIP VoIP provider. It works by combining the slmodem softmodem (available in Debian Linux) with the PJSIP SIP stack.

Source code and build instructions: https://github.com/AonCyberLabs/D-Modem

Building — Support

Contact our cyber response teams for urgent breach assistance.

Contact Us

How it Works

Traditional “controller-based” modems generally used a microcontroller and a DSP to handle all aspects of modem communication on the device itself. Later, so-called “Winmodems” were introduced that allowed for field-programmable DSPs and moved the controller and other functionality into software running on the host PC. This was followed by “pure software” modems that moved DSP functionality to the host as well. The physical hardware of these softmodems was only used to connect to the phone network, and all processing was done in software.

D-Modem replaces a softmodem’s physical hardware with a SIP stack. Instead of passing audio to and from the software DSP over an analog phone line, audio travels via the RTP (or SRTP) media streams of a SIP VoIP call.

Usage

The repository contains two applications:

slmodemd – A stripped down and patched version of Debian’s sl-modem-daemon package. All kernel driver code has been replaced with socket-based communication, allowing external applications to manage audio streams.

d-modem – External application that interfaces with slmodemd to manage SIP calls and their associated audio streams.

After they have been built, you will need to configure SIP account information in the SIP_LOGIN environment variable:

# export SIP_LOGIN=username:[email protected]

Next, run slmodemd, passing the path to d-modem in the -e option. Use -d<level> for debug logging.

# ./slmodemd/slmodemd -d9 -e ./d-modem
SmartLink Soft Modem: version 2.9.11 Oct 28 2021 16:51:30 
symbolic link `/dev/ttySL0' -> `/dev/pts/3' created. 
modem `slamr0' created. TTY is `/dev/pts/3' 
Use `/dev/ttySL0' as modem device, Ctrl+C for termination.

In another terminal, connect to the newly created serial device at 115200 bps:

# screen /dev/ttySL0 115200

You can now interact with this terminal (almost) as you would with a normal modem using standard AT commands. A similar modem’s manual provides a more complete list.

Because there isn’t any dial tone on our SIP connection, you’ll need to disable dial tone detection:

atx3 
OK

To successfully connect, you will likely need to manually select a modulation and data rate. In our testing, V.32bis (14.4kbps) and below appears to be the most reliable, though V.34 (33.6kbps) connections are sometimes successful. For example, the following command selects V.32bis with a data rate of 4800 – 9600 bps. Refer to the manual for further details.

at+ms=132,0,4800,9600 
OK

Finally, dial the number of the target system. Below shows a connection to the NIST atomic clock:

atd303-494-4774 
CONNECT 9600

National Institute of Standards and Technology 
Telephone Time Service, Generator 1b 
Enter the question mark character for HELP 
                        D  L 
 MJD  YR MO DA HH MM SS ST S UT1 msADV          <OTM>

59515 21-10-28 21:40:18 11 0 -.1 045.0 UTC(NIST) * 
59515 21-10-28 21:40:19 11 0 -.1 045.0 UTC(NIST) * 
59515 21-10-28 21:40:20 11 0 -.1 045.0 UTC(NIST) * 
59515 21-10-28 21:40:21 11 0 -.1 045.0 UTC(NIST) * 
59515 21-10-28 21:40:22 11 0 -.1 045.0 UTC(NIST) * 
59515 21-10-28 21:40:23 11 0 -.1 045.0 UTC(NIST) *

Known Issues / Future Work

Connections are unreliable, and it is currently difficult to connect at speeds higher than 14.4kbps or so. It might be possible to improve this by disabling/reconfiguring PJSIP’s jitter buffer.
Additional logging/error handling is needed
The serial interface could be replaced with stdio or a socket, and common AT configuration options could be exposed as command line options
There is currently no support for receiving calls

Explore More

Capability Overview

Cyber Resilience
Product / Service

Penetration Testing Services

Author

Dan Bastone

Aon’s Cyber Solutions offers holistic cyber risk management, unsurpassed investigative skills, and proprietary technologies to help clients uncover and quantify cyber risks, protect critical assets, and recover from cyber incidents.

This material has been prepared for informational purposes only and should not be relied on for any other purpose. You should consult with your own professional advisors or technologists before implementing any recommendation or following the guidance provided herein. The companies referenced in this article and/or links provided have no affiliation with our firm and we do not represent any opinions or support any studies by these third party sources. Further, the information provided and the statements expressed are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources that we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future.

The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.