The World of Pager Sniffing/Interception

Architecture and Background

DEF CON 16 - NYCMIKE:The World of Pager Sniffing/Interception: More Activity than one may suspect. Paging networks once sat at the top of the personal and professional communication pyramid.

Vulnerability Analysis

Cell phone technology's have since replaced the now legacy networks at the consumer level, with the exception of niche markets (Due to the signal quality in doors: IT, Emergency Services, Government) the technology may have been retired to a permanent stay in a junk pile. With the fleeing attention and use, it appears that sniffing/interception of pager traffic within the United States has declined to almost a standstill.

Exploitation and Demonstrations

The scope of this paper is to re-introduce the activity of FLEX (1600/3200 level 2, 3200/6400 level 4) and POCSAG (512, 1200, 2400) then present how a hobbyist can decode it, provide a first hand account of how to install and operate a pager "listening Post", introduce a few ways to use captured cap codes, and offer a conceptual "new" technique in capture pager traffic. With that said, my expertise is limited and I by no means should be considered an expert nor should this writing be interpreted as testament.

Remediation and Defensive Strategies

Last but not least there are laws governing over RF interception and they must be adhered (this means you).Decoding digital data with a soundcard now a days is easier than getting on the internet. For copies of the slides and additional materials please see the DEF CON 16 Archive here: