Archives for : ASP

    Ham Radio Iphone applications

    I have a Iphone and have been loading Ham applications onto it… Below is a list of some of them.

    • Amateur Radio Exam Prep for iPhone – Amateur Radio License exams are composed of questions from a pool. Use this application to practice all possible questions prior to taking your exam
    • CallBook for iPhone– CallBook is an Amateur Radio application that allows you to look up call signs via the free WM7D server, the QRZ Online subscription service or the HamCall subscription server and track active APRS stations on Lookup results can be emailed and the QTH can be instantly viewed in the Maps application
    • Elmer for iPhone – iPhone Software to practice taking your Ham Radio Exam
    • Freq Finder: iPhone Repeater Directory – Freq Finder is an iPhone based Ham Radio Repeater Directory that locates repeaters based on the user location.
    • FreqLoader: iPhone companion for the mobile ham– FreqLoader is the perfect iPhone/iPod Touch companion for amateur radio operators, monitoring enthusiasts, shortwave listeners and anyone with an interest in the air waves. Whether you’re an active licensed ham or an avid scanner listener, FreqLoader will allow you to find what you’re looking for, keep track of your stations, maintain complete logs and share your finds with friends, groups and the world.
    • hamDXcluster for iPhone – DX Cluster for iPhone application
    • iLocator for iPhone – A small application for Apple iPhone that calculate grid locator from gps, wifi or gsm cells by IW2BSQ
    • iPhone Ham Radio Callsign Lookup– This webapp provides an iPhone-compatible lookup of Amateur Radio Callsigns. It provides the name, address, and license class (from the FCC’s public records) of any US-Licensed Amateur Radio Operator.
    • Morse Key for iPhone – A free simple touchscreen-based CW Morse Code straight key. Practice sending Morse Code on your iPhone.
    • IBCNU APRS on the Iphone - The Live IBCNU feed can be found here.
    • APRS – how to configure the application can be found at Find Maps  at


    EchoLink is finally available for the iPhone and iPod touch. It even allows me to use my Bluetooth car kit to have a QSO.

    HAM’s who use EchoLink on the PC and Mac will appreciate the value of this on the iPhone.

    Ham Radio Links

    Amateur Packet Radio Australian

    Aussiewide Packet Radio Network


    Queensland APRS Users Group

    VK2KFJ’s Packet Radio Links page


    VK5 AX25 Packet Network Map (VK5AH)




    Amateur Packet Radio Gateways

    Amateur Packet Radio, net 44, and AMPR.ORG `

    American Febo Enterprises







    G4JKQ TCP/IP Telnet listing

    G7JJF TNC Driver Support (WINTNC)

    High speed packet

    High Speed Packet radio

    High-speed Packet Radio


    K4ABT (home page)

    Linux® / Amateur Radio Information

    Linux AX25-HOWTO


    Packet Info and Downloads

    Packet Links

    Packet Net (VK5 packet map)

    Packet Net (FBB software)

    PAcket Digital Amateur Network (PADAN)

    Radio-TNC Wiring Diagrams


    Slovenian ATV/Packet

    Sound Card Packet




    TNOS Central


    WA4DSY 56k RF Modem

    Yet Another 9k6 Modem


    Sound Card Packet

    Sound Card Buddy

    Soundcard Interfacing

    Sound Card Packet AGWPE (KC2RLM)

    Sound Card Interface with Tone Keyer (WA8LMF)

    QDG sound card interface

    Return to Top


    Winlink! 2000

    Aussie Winlink

    Pactor Communications Australia


    Winpack home page

    Winpack info


    TNC information


    Setting Your TNC’s Audio Drive Level

    TNC and Radio mods


    MFJ-1278B Care and maintenance


    AEA radio and TNC mods

    Other suppliers


    Fox Delta



    The DXZone Digital and Packet Radio



    TNC-X – The Expandable TNC


    Amateur Packet Radio Gateways


    The Gateways Home Page


    High-Speed Digital Networks and Multimedia (Amateur)

    North Texas High Speed MultiMedia group

    Also take a look at the wireless LAN pages


    Aus APRS




    APRS in Adelaide


    APRS in the UK





    BYONICS (Electronics Projects for Amateur Radio)


    Dansk APRS Gruppe

    France APRS

    Kansas City APRS Working Group


    Live Australian APRS data maps


    Queensland APRS Users Group

    Tri-State APRS Working Group

    Other Digital Modes




    Morse Code

    CW Operators’ QRP Club Inc.

    Fists Down Under

    LEARN MORSE CODE in one minute !

    MRX morse code

    Not Morse Code, Slow Scan , Packet or APRS

    HamDream by HB9TLK (digital radio)

    JE3HHT, Makoto (Mako) Mori

    PSK31 and other PC Magic

    WSJT ACTIVITY IN AU (follow link)

    Amateur Digital Radio

    AR Digital Voice Communications

    Australian National D-Star

    Ham Radio digital info

    ICOM America digital

    Temple University Digital Voice Project

    Temple University Vocoder Redux

    WinDRM – HF Digital Radio Mondiale



    Australian D-Star information

    D-Star wikipedia

    ICOM America D-Star Forums


    Software Defined Radio

    FlexRadio Systems Software Defined Radios

    Rocky software for SoftRock-40 hardware

    SDRadio – a Software Defined Radio

    SoftRock-40 Software Defined Radio

    The Weaksignals pages og Alberto I2PHD (software)

    Digital Radio

    BBC digital Radio

    Digital Audio Broadcasting

    Digital Radio Broadcasting

    Digital Radio


    DRM – Digitaler Rundfunk unter 30 MHz


    Amateur Radio Direction Finding

    Amateur Radio Direction Finding and Orienteering

    Amateur Radio Direction Finding Webring

    Homing In


    Victorian ARDF Group Inc.

    Repeater Linking

    There are currently There are 5 internet linking projects that I know of :-

    IRLP,  iPHONE, iLINK, eCHOLINK and WIN SYSTEM (May 2005)


    Hamlink (K1RFD)

    KWARC (live audio)

    Internet Linking


    IRLP status



    G4CDY-L Internet Gateway



    VK2JTP iLINK gateway

    WB2REM & G4CDY’S  iLINK boards



    laser diodes

    A R Laser Communications

    Australian Optical DX Group

    Driver Enhancements

    European Laser Communications


    Amateur Radio Licence


    Worldwide Information on Licensing for Radio Amateurs by OH2MCN

    Amateur Radio Clubs and Organisations

    Also see ATV link page

    and VHF link page


    Adelaide Hills Amateur Radio Society

    Amateur Radio Victoria

    Barossa Amateur Radio Club VK5BRC

    Brisbane Amateur Radio Club

    Brisbane VHF Group

    Central Coast Amateur Radio Club

    Central Goldfields A R Club


    Coffs Harbour & District Amateur Radio Club

    CW Operators’ QRP Club Inc.

    Eastern and Mountain District Radio Club

    Gold Coast AR Society

    Healesville Amateur Radio Group

    Historical Wireless Society of South East Queensland

    Ipswich Metro Radio Group

    Lockyer Valley Radio and Electronic Club Inc

    Manly-Warringah Radio Society


    QRP Amateur Radio Club International

    Queensland APRS Users Group

    RADAR Club Inc

    Radio Amateurs Old Timers Club Australia Inc

    Radio Sport

    Radio and Electronics Association of Southern Tasmania

    Riverland Amateur Radio Club

    South Australian Packet User Group Inc. (SAPUG)


    South Coast AMATEUR RADIO Club


    Sunshine Coast Amateur Radio Club

    VK Young Amateur Radio Operator’s Net


    VK3BEZ (WIA Eastern Zone Amateur Radio Club)


    West Australia Repeater Group


    WIA VK4 Qld



    WICEN Australia

    WICEN Brisbane Qld

    New Zealand


    Papakura Radio Club

    Wanganui Amateur Radio Society Inc.

    Wellington VHF Group


    American QRP Club


    Clear Lake Amateur Radio Club





    K2MFF Amateur Radio club

    North TeXas Repeater Association


    The Repeater Builders Technical Information Page

    Richardson Wireless Klub




    Submarine Veterans Amateur Radio

    Southgate AR club


    The 500 KC Experimental Group for Amateur Radio

    Tucson Amateur Packet Radio

    W6DEK 435 Los Angeles

    Amateur Radio


    Australian AR Repeater Map



    Ham Radio in Australia with VK1DA

    HF Radio Antenna Tuners

    Queensland AR Repeater listings

    Radioactive Networks: Ham

    Tony Hunt VK5AH (Home of Adelaides 10m Repeater)

    VK1DA’s Amateur Radio Web Directory



    VK2BA (AM radio)




    VK3YE’s Gateway to AR










    New Zealand

    Micro Controller Projects for Radio Amateurs and Hobbyists

    Precision Frequency Transmission and Reception



    AC6V’s AR & DX Reference

    Amateur radio with Knoppix

    Amateur Radio Soundblaster Software Collection


    AMRAD Low Frequency Web Page


    Direction finding

    DSP Links




    eQSL (electronic QSL)


    Felix Meyer



    Gateway to Amateur Radio

    Grid Square Locator


    G4KLX (The [ON/]G4KLX Page)




    Hamview DSP software

    Homebrew RF Test Equipment And Software

    KB4VOL   link site



    KU4AY ham radio directory



    K1TTT Technical Reference


    K3TZ Ham Radio Experimentation

    K6XC (links)

    Lighthouses (International Lighthouse/ Lightship Weekend)



    Michael Todd Computers & Communications



    NW7US   (Amateur and Shortwave Radio)

    N3EYR’s Radio Links


    PI6ATV (ATV, Antenna, software, info)

    Radio Links

    Radio Corner (forum)

    Ray Vaughan


    streaming radio programs

    The Elmer HAMlet (information)

    VE1XYL and VE1ALQ

    WB6VUB (links)



    XE1BEF  (DX, mods, links and more)

    Communications Equipment


    Andrews Communication Systems





    Hamak (RM Products Italy)


    KENWOOD Australia

    Kyle Communications

    ICOM Australia



    Radio-Data (links)

    Radio Specialists (equipment connectors and antenna)



    Townsville CB& Communications

    TTS Systems

    VK4-ICE Communications

    WiNRADiO (PC based receivers)



    Vertex Standard


    Z Communications Company (repair of old radio equipment)

    See also Kits and components

    Radio mods, cables, connection info

    batlabs (Motorola radio connection, cable info)

    Hall Electronics

    Radio Mods (mods info and more)

    W4RP IC-2720H Page

    XE1BEF  (DX, mods, links and more)

    Please also look at manufacture’s sites

    Lightning Protection (video and links)

    K9WK Amateur Radio

    Lightning Protection Institute

    Marine Grounding Systems

    Moonraker boat lightning information



    RFI Lightning protection


    Amateur Spread Spectrum

    Spread Spectrum Scene

    Spread spectrum

    SS Info

    Call-sign finders

    The DX Notebook



    Equipment suppliers and manufacturers

    Easy-radio (your DNS server may have problems finding this site)

    Kits and Components

    Australian and selected international suppliers




    Antique Electronic Supply

    Antenna Systems and Supplies Inc. (sm)



    Clarke & Severn Electronics

    Cliff Electronics (Aus) Pty. Ltd


    David Hall Electronics

    Dick Smith Electronics


    Dominion Electronics


    Elliott Sound Products


    Fox Delta (ATV and more)

    Hammond Mfg

    Hy-Q International

    IRH Components


    Microwave Dynamics

    MicroZed Computers



    Mouser Electronics


    Oatley electronics

    Ocean State Electronics


    pacific DATACOM


    Prime Electronics

    Radio Parts

    R.C.S. Radio (circuit boards)

    RF Modules Australia (ZigBee) http:\

    RFShop (Brisbane)

    Rockby Electronics and Computers

    RS Components



    Silvertone Electronics

    South Island Component Centre (New Zealand)

    Surplus Sales of Nebraska

    Surplustronics (New Zealand)

    Tandy (Australia)


    TTS Systems

    WB9ANQ’s Surplus Store


    Worldwide Electronic Components http:/

    Also look at the ATV links

    PCB layout and schematic programs baas electronics LAYo1 PCB


    Electronics WORKBENCH Industries McCAD OrCAD TARGET 3001! Tech5 TinyCAD VEGO ABACOM

    Amateur Satellites and space



    AMSAT-ZL (kiwisat)

    CSXT Civilian Space eXploration Team



    ISS fan club

    SATSCAPE   (free satellite tracking program)

    Satellite tracking software





    IPS Radio and Space Services


    Near-Real-Time MUF Map

    Radio Mobile (path prediction)

    VK4ZU (Propagation)


    Satellite TV



    KRISTAL electronics


    Nationwide Antenna Systems


    SAT TV


    Radio and Scanning


    Brisbane Radio Scanner

    Extreme Worldwide Scanner Radio

    Newcastle Area Radio Frequency Guide


    New Zealand

    Kiwi Radio


    Wellington Scanner Frequencies


    ZL3TMB (Christchurch NZ)


    Frequency guide

    Incident Broadcast Network (including Australian feeds)

    Radio H.F.  (some ham stuff)

    Amateur Radio DX and Contest

    DX Cluster

    AA1V’s DX Info-Page

    AC6V’s AR & DX Reference

    Australian contesting

    Buckmaster callsign database

    DX Greyline

    DX Summit

    DX 425 News


    EI8IC Global Overlay Mapper

    eQSL (electronic QSL)

    German DX Foundation-GDXF

    GlobalTuners (provides access to remotely controlled radio receivers all over the world)

    Ham Atlas by SP6NVK

    Kiwi DX List

    Oceania Amateur Radio DX Group Incorporated

    Oceania DX Contest


    The AM Window

    The Daily DX

    IARU QSL Bureaus

    International DX Association

    Internet Ham Atlas


    IOTA groups and Reference


    IOTA 425

    Island Radio Expedition Fondation

    LA9HW HF Contest page

    NG3K Contest/DX Page

    Northern California DX Foundation

    Simple phrases in European Languages

    SUMMITS on the AIR

    Telnet Access to DX Packet Clusters

    The DX Notebook

    VE6OA’s DX Links Contest Club

    World of DK4KQ

    XE1BEF  DX and links

    Logging Software

    VK Contest Log (VKCL)

    VK/ZL Logger

    WinRD+ logging program




    CLX Home page

    DX CLUSTER programs




    DX PacketCluster Sites on the Internet

    DXSpider – DX cluster system is written in perl

    Packet Cluster user manual

    The DXSpider User Manual

    VE7CC-1 Dx Spider Cluster


    Short Wave DX


    Electronic DX Press (HF, MW and VHF)

    CQ World Wide DX Contest


    Longwave Club of America (also Ham)

    NIST time stations

    OK1RR DX & Contesting Page

    Prime Time Shortwave

    Radio Interval Signals


    SM3CER Contest Service

    The British DX Club

    Yankee Clipper Contest Club


    Radio Scouting

    Scouts Australia JOTA/JOTI

    The history of the Jamboree On The Air history.htm

    World Organization of the Scout Movement

    Australian Regulator


    International Regulator


    Electronic Information and technical reference

    AC6V’s Technical Reference

    Chip directory

    Circuit Sage

    CommLinx Solutions Pty Ltd

    Computer Power Supply Mods

    Discover Circuits

    Electronic Information

    Electronics Links and Resources

    Epanorama (lots of links)

    Electronics Tutorials

    Electronic Theory

    Fox Delta


    Hobby Projects (electronic resource)


    Information site

    ISO Date / Time

    Latitude/Longitude Conversion utility – 3 formats

    New Wave Instruments (check out SS Resources)

    Paul Falstad (how electronic circuits work)

    PINOUTS.RU (Handbook of hardware pinouts)



    RF Cafe

    RF Globalnet

    RHR Laboratories


    RS232 Connections, and wiring up serial devices

    RF Power Table

    Science Lobby (electronic links)

    Tech FAQ (technical information for mobile electronics installers)

    Electronic service

    Repair of TV Sets

    Sci.Electrinic.Repair FAQ

    Service engineers Forum


    Cable Data




    Coaxial cable data

    Coaxial Cable Page




    NESS Engineering

    RF Industries cables


    Times Microwave


    W4ZT Antenna cable chart

    50 W Coaxial Cable Information

    75 W Coaxial Cable Information

    Antique Radio

    Antique Electronic Supply

    Alan Lord

    Antique Radio

    Apex Jr

    Archives of Boatanchors

    Australian Vintage Radio MK II

    Australian Wireless (OZ-Wireless) Email List

    AWA and Fisk Radiola

    Crystal Radio


    Hammond Museum of Radio

    Historical Radio Society of Australia Inc.

    JMH’s Virtual Valve Museum

    John Rose’s Vintage Radio Home

    Klausmobile Russian Tube Directory


    Kurrajong Radio Museum

    Links to Vintage Radios (Amateur)

    Mike’s Electric Stuff

    Nostalgiar Air

    Phil’s Old Radios

    Radio A’s Vintage Radio Page

    Radio Era

    Rap ‘n Tap

    Replacing Capacitors

    Savoy Hill Publications

    South East Qld Group of the HRSA

    SEQG of the HRSA Crystal comp

    SEQG One Tube Radio comp


    The Vintage Radio Emporium

    The Wireless Works

    Triode Tube Data Tubesworld  (Valve Audio and Valve data)

    Vintage Radio

    Vintage Radio Times

    Vintage Radios and programs

    Vintage Radios UK

    Vintage Radio and Test Equipment Site

    Vintage Radio World

    Vintage Radio and Audio Pages



    Ye Olde Hurdy Gurdy Museum of Vintage Radio

    Valve Audio and Valve data Ake’e Tube Data CVC

    Data Sheet Locator


    Frank’s Electron tube Pages

    Hammond  Manufacturing

    House of Tubes

    High Voltage Tube Archive


    Industrial Valve Data


    NJ7P Tube Data Search

    RCA-R10 Data

    SAS Audio Labs

    Sowter Audio Transformers

    Spice Valves



    Tube datasheets

    Vacuum Tube Links

    Valves and Tubes

    Valve Data Links

    Valve Data

    Valves Unlimited

    Valve and Tube Supplies


    Audio Calculators and Links Calculators & References Links.htm


    Car Audio Australia

    DIY Audio

    Duncan’s Amp Pages

    Elliott Sound Products


    Norman Koren


    The Self Site

    The Class-A Amplifier Site


    DUBUS (VHF magazine)

    Elektor Electronics

    Harlan Technologies (Amateur Television Quarterly)

    Radio & Communications Monitoring Monthly


    VHF Communications Mag



    SETI Australia

    WPA cracking is getting quicker

    I was reading some posts on the Full-disclosure mailing list and came across the some posts relating to WPA hacking (WPA attack improved to 1min). After spending hundreds of hours using the AIR tools to crack WEP encryption and looking into networks as part of my previous job, I was very interested to see how things are progressing.

    The thread mentioned the paper “A Practical Message Falsification Attack on WPA” posted on

    It was a coincidence as I was only taking to one of the executives at work about how easy WEP is to crack and what you can do/discover once you are in.

    I hope you enjoy the paper.

    —– Update —–

    Once this was posted I received many message s and a few more links for the post.

    So here thet are:,researchers-crack-wpa-encryption-in-60-seconds.aspx
    /wpa_psk-h1kari_renderman.torrent?95896A255A82D1FE8B6A2BFFC098B735058B30D7 – Though will only help with TKIP

    Thanks to

    Oliver from

    Michael from SA Government

    Tim from CQR Consulting

    —– End Update ——

    The EDinburgh Great Shiraz Challenge

    Kerry and I went along to the EDinburgh Cellars Great Shiraz Challenge.

    Between Kerry and I we tasted more than 25 great wines over a harrowing 2.5 hours of hustle and bustle in a huge tent in the ED’s carpark. It was great, we both thought that it was well worth the $30/head entry fee.

    One of the great things was the amount of large and small wine companies presenting their spoils. Refreshingly many of the tasting areas were manned by the wine maker, winery owner or someone of similar stature. This made for great conversations and allowed us to find other great non-mainstream wineries on the day.

    As Kerry (Wine group – 9yrs) and I (Corporate) both worked for SouthCorp (Prior to Fosters), we agreed that we would be looking for the special wines of the day. Well we did grab an RWT on the way out as the last tasting for the day – we are not stupid.

    We had a great day overall and purchased and ordered some great wins at the Cellars after the event.

    It was great catching up with Barb and Karel from Lengs and Cooter Wines and taste some of their great wines. Barb used to work at SouthCorp for many years and Karl worked at Telstra, but Kerry and I agree that they make great wines.

    Of the wines in the winning list below our favourites are:

    2006 Woodstock “The Stocks” Shiraz

    2004 Bullers Caliope Shiraz

    2006 Hentley Farm “The Beast” Shiraz

    2005 d’Arenberg Dead Arm Shiraz

    2006 Glaetzer ‘Bishop’ Shiraz

    Other top votes from us for the day are:

    2008 Mike Press Adelaide Hills Shiraz (It’s been a long time since we’ve tasted such a good cheap wine)

    2007 Honey MoonVineyard Adelaide Hills Shiraz

    2004 Lengs & Cooter Old Vines Shiraz

    2004 Lengs & Cooter Reserve Shiraz

    2005 Artful Dodger Barossa Shiraz

    2007 Veronique Regions Shiraz

    2006 Cape Jaffa La Lune Biodynamic Shiraz

    2006 Ceravolo Sparkling Shiraz

    2007 Yelland & Papps Greenock Shiraz

    Results – Shiraz Challenge

    Shiraz Day 2008 was a massive hit, with a record crowd of over 900 slurping through a field of just over 300 Shiraz. As always, we ask attendees to vote for their favourite wine of the day, and congratulations goes to Clarendon Hills for their superbly compelling 2006 Liandra Shiraz. Here’s the full list of the Top 20:

    2006 Clarendon Hills Liandra Syrah

    2005 Torbreck Factor Shiraz

    2005 Langmeil Freedom 1843 Shiraz

    2006 Hentley Farm ‘The Beast’ Shiraz

    2005 Whistler Reserve Shiraz

    2006 Penfolds RWT Shiraz

    2005 Wild Witch Shiraz

    2005 d’Arenberg Dead Arm Shiraz

    2005 Dutschke St Jakobi Shiraz

    2006 Woodstock ‘The Stocks’ Shiraz

    2006 Brick Kiln Shiraz

    2004 Bullers Caliope Shiraz

    2006 Hentley Farm ‘The Beauty’

    2005 Pikes ‘The E.W.P’ Shiraz

    2004 Paracombe Somerville Shiraz

    2006 Kalleske Greenock Shiraz

    2005 Bendbrook Goat Track Shiraz

    2004 Penfolds St Henri Shiraz

    2004 Bethany Wines GR9 Reserve

    2005 Paxton EJ Shiraz

    TOP 20 UNDER $30:

    2005 Tin Shed Melting Pot Shiraz

    2004 Carlei Estate ‘Green Vineyard’

    2004 Majella Shiraz

    2007 Torbreck Woodcutters Shiraz

    2005 Hugo Shiraz

    2006 Tar & Roses Shiraz

    2004 Whistler Shiraz

    2005 2 Mates Shiraz McLaren Vale

    2005 d’Arenberg Footbolt Shiraz

    2006 Mitolo Jester Shiraz

    2006 Guichen Bay Vineyards Reserve

    2006 Pirathon Shiraz by Kalleske

    2006 Scarpantoni Block 3 Shiraz

    2006 Naked Run Barossa Shiraz

    2006 Bird in Hand Shiraz

    2006 O’Leary Walker Shiraz

    2006 Glaetzer ‘Bishop’ Shiraz

    2007 Paxton Quandong Shiraz

    2006 Trevor Jones ‘Boots’ Shiraz

    2005 Dutschke Gods Hill Road Shiraz


    Corporate Phone Lockdown Links


    I’m looking at some of the techniques used to lockdown the Iphone, Samsung, Sony and HDC mobile phones. I hope others find the links useful.


    Lock down the information on your iPhone and iPod touch

    iPhone’s PIM lockdown

    Apple ‘wise’ to lock down iPhone software,apple-wise-to-lock-down-iphone-software.aspx

    iPhone lockdown to boost on-demand services

    Wired’s Easy-Peasy iPhone Lockdown Checklist

    Gartner: iPhone 2.0 cuts business mustard

    3G iPhone: The business perspective

    What IT staff can do if the CEO gets an iPhone

    Iphone Hacking

    Iphone Enterprise

    New Specification to Lock Down Mobile Phones




    ———– Advertisement ———- is dedicated to the service, repair, and modification of ALL iPod, iPhone, Zune, and other small electronic devices.

    VoIP and SIP links

    I’m looking at the Microsoft OCS server and other SIP integration environments. So I thought I would put the links here for others who were interested. I am also considering the issues associated with Mitel VoIP and OCS integration.

    It would be interesting if the Microsoft OCS could seamlessly allow the use of soft phones and the Mitel VoIP system. I assume a trunk needs to be setup between the two… Anyway something to look at.

    Office Communications Server 2007 VoIP Test Set

    OCS Testing Tool

    Connect Mitel and OCS2007

    Mitel 3300 & OCS – Ring on deskphone and softphone

    Connecting Mitel 3300cx and OCS


    OCS 2007 Best Practices Analyzer

    Secure Application Development links


    I have been putting some secure application development documents together recently and have found some good general tutorials and guidelines which I thought I would post here.

    Best Practices

    Other Resources

    Serious flaws in bluetooth security lead to disclosure of personal data




    In November 2003, Adam Laurie of A.L. Digital Ltd. discovered that there are serious flaws in the authentication and/or data transfer mechanisms on some bluetooth enabled devices. Specifically, three vulnerabilities have been found:

    Firstly, confidential data can be obtained, anonymously, and without the owner’s knowledge or consent, from some bluetooth enabled mobile phones. This data includes, at least, the entire phone book and calendar, and the phone’s IMEI.

    Secondly, it has been found that the complete memory contents of some mobile phones can be accessed by a previously trusted (“paired”) device that has since been removed from the trusted list. This data includes not only the phonebook and calendar, but media files such as pictures and text messages. In essence, the entire device can be “backed up” to an attacker’s own system.

    Thirdly, access can be gained to the AT command set of the device, giving full access to the higher level commands and channels, such as data, voice and messaging. This third vulnerability was identified by Martin Herfurt, and they have since started working together on finding additional possible exploits resulting from this vulnerability.

    Finally, the current trend for “Bluejacking” is promoting an environment which puts consumer devices at greater risk from the above attacks.

    The SNARF attack:
    It is possible, on some makes of device, to connect to the device without alerting the owner of the target device of the request, and gain access to restricted portions of the stored data therein, including the entire phonebook (and any images or other data associated with the entries), calendar, real-time clock, business card, properties, change log, IMEI (International Mobile Equipment Identity [6], which uniquely identifies the phone to the mobile network, and is used in illegal phone ‘cloning’). This is normally only possible if the device is in “discoverable” or “visible” mode, but there are tools available on the Internet that allow even this safety net to be bypassed[4]. Further details will not be released at this time (see below for more on this), but the attack can and will be demonstrated to manufacturers and press if required.

    The BACKDOOR attack:
    The backdoor attack involves establishing a trust relationship through the “pairing” mechanism, but ensuring that it no longer appears in the target’s register of paired devices. In this way, unless the owner is actually observing their device at the precise moment a connection is established, they are unlikely to notice anything untoward, and the attacker may be free to continue to use any resource that a trusted relationship with that device grants access to (but note that so far we have only tested file transfers). This means that not only can data be retrieved from the phone, but other services, such as modems or Internet, WAP and GPRS gateways may be accessed without the owner’s knowledge or consent. Indications are that once the backdoor is installed, the above SNARF attack will function on devices that previously denied access, and without the restrictions of a plain SNARF attack, so we strongly suspect that the other services will prove to be available also.

    The BLUEBUG attack:
    The bluebug attack creates a serial profile connection to the device, thereby giving full access to the AT command set, which can then be exploited using standard off the shelf tools, such as PPP for networking and gnokii for messaging, contact management, diverts and initiating calls. With this facility, it is possible to use the phone to initiate calls to premium rate numbers, send sms messages, read sms messages, connect to data services such as the Internet, and even monitor conversations in the vicinity of the phone. This latter is done via a voice call over the GSM network, so the listening post can be anywhere in the world. Bluetooth access is only required for a few seconds in order to set up the call. Call forwarding diverts can be set up, allowing the owner’s incoming calls to be intercepted, either to provide a channel for calls to more expensive destinations, or for identity theft by impersonation of the victim.

    Although known to the technical community and early adopters for some time, the process now known as “Bluejacking”[1] has recently come to the fore in the consumer arena, and is becoming a popular mechanism for exchanging anonymous messages in public places. The technique involves abusing the bluetooth “pairing”[2] protocol, the system by which bluetooth devices authenticate each other, to pass a message during the initial “handshake” phase. This is possible because the “name” of the initiating bluetooth device is displayed on the target device as part of the handshake exchange, and, as the protocal allows a large user defined name field – up to 248 characters – the field itself can be used to pass the message. This is all well and good, and, on the face of it, fairly harmless, but, unfortunately, there is a down side. There is a potential security problem with this, and the more the practice grows and is accepted by the user community, and leveraged as a marketing tool by the vendors, the worse it will get. The problem lies in the fact that the protocol being abused is designed for information exchange. The ability to interface with other devices and exchange, update and synchronise data, is the raison d’être of bluetooth. The bluejacking technique is using the first part of a process that allows that exchange to take place, and is therefore open to further abuse if the handshake completes and the “bluejacker” successfully pairs with the target device. If such an event occurs, then all data on the target device becomes available to the initiator, including such things as phone books, calendars, pictures and text messages. As the current wave of PDA and telephony integration progresses, the volume and quality of such data will increase with the devices’ capabilities, leading to far more serious potential compromise. Given the furore that irrupted when a second-hand Blackberry PDA was sold without the previous owner’s data having been wiped[3], it is alarming to think of the consequences of a single bluejacker gathering an entire corporate staff’s contact details by simply attending a conference or camping outside their building or in their foyer with a bluetooth capable device and evil intent. Of course, corporates are not the only potential targets – a bluejacking expedition to, say, The House of Commons, or The US Senate, could provide some interesting, valuable and, who’s to say, potentially damaging or compromising data.<<<


    The above may sound alarmist and far fetched, and the general reaction would probably be that most users would not be duped into allowing the connection to complete, so the risk is small. However, in today’s society of instant messaging, the average consumer is under a constant barrage of unsolicited messages in one form or another, whether it be by SPAM email, or “You have won!” style SMS text messages, and do not tend to treat them with much suspicion (although they may well be sceptical about the veracity of the offers). Another message popping up on their ‘phone saying something along the lines of “You have won 10,000 pounds! Enter this 4 digit PIN number and then dial 0900-SUCKER to collect your prize!” is unlikely to cause much alarm, and is more than likely to succeed in many cases.

    Workarounds and fixes
    We are not aware of any workarounds for the SNARF or BLUEBUG attacks at this time, other than to switch off bluetooth. For permanent fixes, see the ‘Fixes’ section at the bottom of the page.

    To permanently remove a pairing, and protect against future BACKDOOR attacks, it seems you must perform a factory reset, but this will, of course, erase all your personal data.

    To avoid Bluejacking, “just say no”. :)

    The above methods work to the best of our knowledge, but, as the devices affected are running closed-source proprietary software, it not possible to verify that without the collaboration of the manufacturers. We therefore make no claims as to the level of protection they provide, and you must continue to use bluetooth at your own risk.

    Who’s Vulnerable
    To date the quantity of devices tested is not great. However, due to the fact that they are amongst the most popular brands, we still consider the affected group to be large. It is also assumed that there are shared implementations of the bluetooth stack, so what affects one model is likely to affect others. This table is accurate to the best of our knowledge, but without the cooperation of the manufacturers (which we currently do not have), it is not possible to conduct more extensive validation.

    The devices known to be vulnerable at this time are:

    Vulnerability Matrix (* = NOT Vulnerable)
    MakeModelFirmware RevBACKDOORSNARF when VisibleSNARF when NOT VisibleBUG
    Sony EricssonR520m20R2G?YesNo?
    Sony EricssonT68i20R1B
    Sony EricssonT61020R1A081
    Sony EricssonT61020R1A081???Yes
    Sony EricssonZ1010??Yes??
    Sony EricssonZ60020R2C007
    Nokia7650?YesNo (+)?No
    * SiemensS55?NoNoNoNo
    * SiemensSX1?NoNoNoNo
    MotorolaV600 (++)?NoNoNoYes
    MotorolaV80 (++)?NoNoNoYes

    + We now believe the 7650 is only vulnerable to SNARF if it has already been BACKDOORed.
    ++ The V600 and V80 are discoverable for only 60 seconds, when first powered on or when this feature is user selected, and the window for BDADDR discovery is therefore very small. Motorola have stated that they will correct the vulnerability in current firmware.

    What is the Philosophy of Full Disclosure, and why are we providing the tools and detailing the methods that allow this to be done? The reasoning is simple – by exposing the problem we are achieving two goals: firstly, to alert users that the dangers exist, in order that they can take their own precautions against compromise, and secondly, to put pressure on manufacturers to rectify the situation. Consumers have a right to expect that their confidential data is treated as such, and is not subject to simple compromise by poorly implemented protocols on consumer devices. Manufacturers have a duty of care to ensure that such protection is provided, but, in practice, commercial considerations will often take precedence, and, given the choice, they may choose to simply supress or hide the problem, or, even worse, push for laws that prevent the discovery and/or disclosure of such flaws[5]. In our humble opinion, laws provide scant consumer protection against the lawless.

    After 13 months, and in consideration of the fact that affected manufacturers had acknowledged the issues and made updated firmware available, Full Disclosure took place at the Chaos Computer Club’s annual congress – 21C3, in Berlin, 2004.

    Slides from the disclosure talk can be found here:

    Proof of concept utilities have been developed, but are not yet available in the wild. They are:

    • bluestumbler – Monitor and log all visible bluetooth devices (name, MAC, signal strength, capabilities), and identify manufacturer from MAC address lookup.
    • bluebrowse – Display available services on a selected device (FAX, Voice, OBEX etc).
    • bluejack – Send anoymous message to a target device (and optionally broadcast to all visible devices).
    • bluesnarf – Copy data from target device (everything if pairing succeeds, or a subset in other cases, including phonebook and calendar. In the latter case, user will not be alerted by any bluejack message).
    • bluebug – Set up covert serial channel to device.
      Tools will not be released at this time, so please do not ask. However, if you are a bona-fide manufacturer of bluetooth devices that we have been otherwise unable to contact, please feel free to get in touch for more details on how you can identify your device status.

    The above vulnerabilities were discovered by Adam Laurie, during the course of his work with A.L. Digital, in November 2003, and this announcement was prepared thereafter by Adam and Ben Laurie for immediate release.

    Adam Laurie is Managing Director and Chief Security Officer of A.L. Digital Ltd.

    Ben Laurie is Technical Director of A.L. Digital, and author of Apache-SSL and contributor to many other open source projects, too numerous to expand on here.

    A.L. Digital Ltd. are the owner operators of The Bunker, the world’s most secure data centre(s).


    Further information relating to this disclosure will be updated at






    • bluesniff
    • btscanner
    • redfang



    Bluetooth Wireless Specification


    This article is about the Bluetooth wireless specification. For King Harold Bluetooth, see Harold I of Denmark

    Bluetooth is an industrial specification for wireless personal area networks (PANs).

    Bluetooth provides a way to connect and exchange information between devices like personal digital assistants (PDAs), mobile phones, laptops, PCs, printers and digital cameras via a secure, low-cost, globally available short range radio frequency.

    Bluetooth lets these devices talk to each other when they come in range, even if they’re not in the same room, as long as they are within 10 metres (32 feet) of each other.

    The spec was first developed by Ericsson, later formalised by the Bluetooth Special Interest Group (SIG). The SIG was formally announced on May 20, 1999. It was established by Sony Ericsson, IBM, Intel, Toshiba and Nokia, and later joined by many other companies as Associate or Adopter members.

    Table of contents

    * 1 About the name
    * 2 General information
    o 2.1 Embedded Bluetooth
    * 3 Features by version
    o 3.1 Bluetooth 1.0 and 1.0B
    o 3.2 Bluetooth 1.1
    o 3.3 Bluetooth 1.2
    o 3.4 Bluetooth 2.0
    * 4 Future Bluetooth uses
    * 5 Security concerns
    * 6 Bluetooth profiles
    * 7 See also
    * 8 External links

    About the name

    The system is named after a Danish king Harald Blåtand (<arold Bluetooth in English), King of Denmark and Norway from 935 and 936 respectively, to 940 known for his unification of previously warring tribes from Denmark, Norway and Sweden. Bluetooth likewise was intended to unify different technologies like computers and mobile phones. The Bluetooth logo merges the Nordic runes for H and B.

    General information


    A typical Bluetooth mobile phone headset

    The latest version currently available to consumers is 2.0, but few manufacturers have started shipping any products yet. Apple Computer, Inc. offered the first products supporting version 2.0 to end customers in January 2005. The core chips have been available to OEMs (from November 2004), so there will be an influx of 2.0 devices in mid-2005. The previous version, on which all earlier commercial devices are based, is called 1.2.

    Bluetooth is a wireless radio standard primarily designed for low power consumption, with a short range (up to 10 meters [1], ) and with a low-cost transceiver microchip in each device.

    It can be used to wirelessly connect peripherals like printers or keyboards to computers, or to have PDAs communicate with other nearby PDAs or computers.

    Cell phones with integrated Bluetooth technology have also been sold in large numbers, and are able to connect to computers, PDAs and, specifically, to handsfree devices. BMW was the first motor vehicle manufacturer to install handsfree Bluetooth technology in its cars, adding it as an option on its 3 Series, 5 Series and X5 vehicles. Since then, other manufacturers have followed suit, with many vehicles, including the 2004 Toyota Prius and the 2004 Lexus LS 430. The Bluetooth car kits allow users with Bluetooth-equipped cell phones to make use of some of the phone’s features, such as making calls, while the phone itself can be left in a suitcase or in the boot/trunk, for instance.

    The standard also includes support for more powerful, longer-range devices suitable for constructing wireless LANs.

    A Bluetooth device playing the role of “master” can communicate with up to 7 devices playing the role of “slave”. At any given instant in time, data can be transferred between the master and one slave; but the master switches rapidly from slave to slave in a round-robin fashion. (Simultaneous transmission from the master to multiple slaves is possible, but not used much in practice). These groups of up to 8 devices (1 master and 7 slaves) are called piconets.

    The Bluetooth specification also allows connecting two or more piconets together to form a scatternet, with some devices acting as a bridge by simultaneously playing the master role in one piconet and the slave role in another piconet. These devices have yet to come, though are supposed to appear within the next two years.

    Any device may perform an “inquiry” to find other devices to which to connect, and any device can be configured to respond to such inquiries.

    Pairs of devices may establish a trusted relationship by learning (by user input) a shared secret known as a “passkey”. A device that wants to communicate only with a trusted device can cryptographically authenticate the identity of the other device. Trusted devices may also encrypt the data that they exchange over the air so that no one can listen in.

    The protocol operates in the license-free ISM band at 2.45 GHz. In order to avoid interfering with other protocols which use the 2.45 GHz band, the Bluetooth protocol divides the band into 79 channels (each 1 MHz wide) and changes channels up to 1600 times per second. Implementations with versions 1.1 and 1.2 reach speeds of 723.1 kbit/s. Version 2.0 implementations feature Bluetooth Enhanced Data Rate (EDR), and thus reach 2.1 Mbit/s. Technically version 2.0 devices have a higher power consumption, but the three times faster rate reduces the transmission times, effectively reducing consumption to half that of 1.x devices (assuming equal traffic load).

    Bluetooth differs from Wi-Fi in that the latter provides higher throughput and covers greater distances but requires more expensive hardware and higher power consumption. They use the same frequency range, but employ different multiplexing schemes. While Bluetooth is a cable replacement for a variety of applications, Wi-Fi is a cable replacement only for local area network access. A glib summary is that Bluetooth is wireless USB whereas Wi-Fi is wireless Ethernet.

    Many USB Bluetooth adapters are available, some of which also include an IrDA adapter.

    Embedded Bluetooth

    Bluetooth devices and modules are increasingly being made available which come with an embedded stack and a standard UART port. The UART protocol can be as simple as the industry standard AT protocol, which allows the device to be configured to cable replacement mode. This means it now only takes a matter of hours (instead of weeks) to enable legacy wireless products that communicate via UART port.

    Features by version

    Bluetooth 1.0 and 1.0B

    Versions 1.0 and 1.0B had numerous problems and the various manufacturers had great difficulties in making their products interoperable. 1.0 and 1.0B also had mandatory Bluetooth Hardware Device Address (BD_ADDR) transmission in the handshaking process, rendering anonymity impossible at a protocol level, which was a major set-back for services planned to be used in Bluetooth environments, such as Consumerism.

    Bluetooth 1.1

    In version 1.1 many errata found in the 1.0B specifications were fixed. There was added support for non-encrypted channels.

    Bluetooth 1.2

    This version is backwards compatible with 1.1 and the major enhancements include

    • Adaptive Frequency Hopping (AFH), which improves resistance to radio interference by avoiding using crowded frequencies in the hopping sequence
    • Higher transmission speeds in practice
    • extended Synchronous Connections (eSCO), which improves voice quality of audio links by allowing retransmissions of corrupted packets.
    • Received Signal Strength Indicator (RSSI)
    • Host Controller Interface (HCI) support for 3-wire UART
    • HCI access to timing information for Bluetooth applications.

    Bluetooth 2.0

    This version is backwards compatible with 1.x and the major enhancements include

    • Non-hopping narrowband channel(s) introduced. These are faster but have been criticised as defeating a built-in security mechanism of earlier versions; however frequency hopping is hardly a reliable security mechanism by today’s standards. Rather, Bluetooth security is based mostly on cryptography.
    • Broadcast/multicast support. Non-hopping channels are used for advertising Bluetooth service profiles offered by various devices to high volumes of Bluetooth devices simultaneously, since there is no need to perform handshaking with every device. (In previous versions the handshaking process takes a bit over one second.)
    • Enhanced Data Rate (EDR) of 2.1 Mbit/s.
    • Built-in quality of service.
    • Distributed media-access control protocols.
    • Faster response times.
    • Halved power consumption due to shorter duty cycles.

    Future Bluetooth uses

    One of the ways Bluetooth technology may become useful is in Voice over IP. When VOIP becomes more widespread, companies may find it unnecessary to employ telephones physically similar to today’s analogue telephone hardware. Bluetooth may then end up being used for communication between a cordless phone and a computer listening for VOIP and with an infrared PCI card acting as a base for the cordless phone. The cordless phone would then just require a cradle for charging. Bluetooth would naturally be used here to allow the cordless phone to remain operational for a reasonably long period.

    Security concerns

    In November 2003, Ben and Adam Laurie from A.L. Digital Ltd. discovered that serious flaws in Bluetooth security lead to disclosure of personal data (see It should be noted however that the reported security problems concerned some poor implementations of Bluetooth, rather than the protocol itself.

    In a subsequent experiment, Martin Herfurt from the was able to do a field-trial at the CeBIT fairgrounds showing the importance of the problem to the world. A new attack called BlueBug was used for this experiment.

    In April 2004, security consultants @Stake revealed a security flaw that makes it possible to crack into conversations on Bluetooth based wireless headsets by reverse engineering the PIN.

    This is one of a number of concerns that have been raised over the security of Bluetooth communications. In 2004 the first purported virus using Bluetooth to spread itself among mobile phones appeared for the Symbian OS. The virus was first described by Kaspersky Labs and requires users to confirm the installation of unknown software before it can propagate. The virus was written as a proof-of-concept by a group of virus writers known as 29a and sent to anti-virus groups. Because of this, it should not be regarded as a security failure of either Bluetooth or the Symbian OS. It has not propagated ‘in the wild’.

    In August 2004, a world-record-setting experiment (see also Bluetooth sniping) showed that with directional antennas the range of class 2 Bluetooth radios could be extended to one mile. This enables attackers to access vulnerable Bluetooth-devices from a distance beyond expectation.

    Bluetooth uses the SAFER+ algorithm for authentication and key generation.

    Bluetooth profiles

    In order to use Bluetooth, a device must be able to interpret certain Bluetooth profiles. These define the possible applications. Following profiles are defined:

    • Generic Access Profile (GAP)
    • Service Discovery Application Profile (SDAP)
    • Cordless Telephony Profile (CTP)
    • Intercom Profile (IP)
    • Serial Port Profile (SPP)
    • Headset Profile (HSP)
    • Dial-up Networking Profile (DUNP)
    • Fax Profile
    • LAN Access Profile (LAP)
    • Generic Object Exchange Profile (GOEP)
    • Object Push Profile (OPP)
    • File Transfer Profile (FTP)
    • Synchronisation Profile (SP)

    This profile allows synchronisation of Personal Information Manager (PIM) items. As this profile originated as part of the infra-red specifications but has been adopted by the Bluetooth SIG to form part of the main Bluetooth specification, it is also commonly referred to as IrMC Synchronisation.

    • Hands-Free Profile (HFP)
    • Human Interface Device Profile (HID)
    • Hard Copy Replacement Profile (HCRP)
    • Basic Imaging Profile (BIP)
    • Personal Area Networking Profile (PAN)
    • Basic Printing Profile (BPP)
    • Advanced Audio Distribution Profile (A2DP)
    • Audio Video Remote Control Profile (AVRCP)
    • SIM Access Profile (SAP)

    Compatibility of products with profiles can be verified on the Bluetooth Qualification website.

    See also

    External links