Motorola MA351 2.4Ghz Cordless Phone

Welcome

This site presents information I collected while doing a quick evaluation of the security of the Motorola MA351 cordless telephone. I want to make sure that it's not too easy to intercept my voice while using this phone.

Registration and Identification on Base

Reg. No: 5GGW900BMA350
USOC: RJ11C
REN: 0.0B
FCC ID: NC8MA300
IC: 1945A-MA35X
Model: MA351/MA352

Channel/Frequency Mapping

I did not map out all the channels that the phone supports because it would take too much time. I did, however, record some of the channels.

Channel Low Freq (Base) High Freq (Handset)

1 2.402302 GHz 2.474700 GHz

15 2.404 GHz 2.4768 GHz

28 2.4063 GHz 2.4788 GHz

Channel	Low Freq (Base)	High Freq (Handset)
1	2.402302 GHz	2.474700 GHz
15	2.404 GHz	2.4768 GHz
28	2.4063 GHz	2.4788 GHz

Collected Data

I used an Agilent E3238 Signals Development System (also known as Blackbird) to find and collect the base and handset transmissions. I start by looking from 2.4 GHz to 2.5 GHz while using a stick antenna and looked for two energy spikes. I noted the channel the phone was on and the location of the spikes. I then changed the phone's channel and noted the frequency changes.

I put the handset very close to the stick antenna to figure out which energy spike was the handset and which was the base.

I used the Narrow Band Recorder (a component of the E3238s system) to produce recordings that are approximately 140 kHz wide. These recordings are in CAP file format which is an open Agilent format that's used in many of their test and measurement products. For your convenience I've converted the CAP files to WAVE files after applying an FM demodulator.

I plan to host this page on one of the free web site providers. I may not be able to include the CAP files because they are rather large.

Handset CAP 10 MB
Base CAP 19 MB
Handset WAVE 151 kB
Base WAVE 306 kB

Here is what I am saying:

Handset: "Alright this is John and I'm talking into the Handset at 2.474 uh 7 Ghz"
Base: "Alright this is John talking into the Handset and recording on the Base frequency of 2.3023 GHz .... that's the end"

E3238s Configuration

The E3238 Signals Development System was configured in a 13-slot vxi chassis with the following cards. It used an external Agilent 89431 downconverter.

National Embedded Windows NT controller (2 slots)
E1437A Digital to Analog Converter (Search)
E1485C DSP/FFT Card (Search)
E1437A Digital to Analog Converter (Collection)
E9830A 2GB Delay Memory Module (Collection) [Not used in this experiment]
Spectrum Signal VX08 with 2 onboard DSP's, 2 DSP cards, and 4 DDC cards (4 channels each)

I believe this configuration sells for roughly a quarter of a million dollars.

Check the Agilent Aerospace & Defense web site for more information.

Conclusion

I wish the phone used a digital technique for protecting the speech, but I suppose this analog scrambling is sufficient for my needs. I'll probably keep the phone. It was only $45 at Target and it seems durable.

It should be sufficiently easy to write some DSP code that will undo the scrambling that is employed by this phone. In fact, someone could probably use the CAP files on this web site to build a descrambler. I'm taking a chance that someone with the required skills and the required hardware won't be interested in what I have to say on the phone.