LevelBlue

LevelBlue + SentinelOne: Global Partnership to Deliver AI-Powered Managed Security Operations and Incident Response. Learn More

Submit RFP Request a Demo

Introducing D-Modem: A software SIP modem

Change theme to light
3 Minute Read by Dan Bastone

Connect to dialup modems over VoIP using SIP, no modem hardware required.

Even in 2021, Stroz Friedberg’s Security Testing practice occasionally receives requests from our clients for penetration testing of systems accessible over dialup modem. These legacy systems have sometimes been running for decades, and often have never undergone any type of formal security assessment. While not usually accessible over the internet, in many cases these systems are connected to an organization’s internal LAN, making them attractive targets for attackers looking to bypass internet-based perimeter defenses.

Connecting to these systems typically requires a physical modem and either a PSTN -connected landline, or a low-latency VoIP connection and an analog telephone adapter (ATA).

To facilitate testing these systems in the modern era, Stroz Friedberg is releasing D-Modem, a software solution that does not require a physical modem or ATA. All that is required is an account with a SIP VoIP provider. It works by combining the slmodem softmodem (available in Debian Linux) with the PJSIP SIP stack.

Source code and build instructions: https://github.com/strozfriedberg/D-Modem 

 

How it Works

Traditional “controller-based” modems generally used a microcontroller and a DSP to handle all aspects of modem communication on the device itself. Later, so-called “Winmodems” were introduced that allowed for field-programmable DSPs and moved the controller and other functionality into software running on the host PC. This was followed by “pure software” modems that moved DSP functionality to the host as well. The physical hardware of these softmodems was only used to connect to the phone network, and all processing was done in software.

D-Modem replaces a softmodem’s physical hardware with a SIP stack. Instead of passing audio to and from the software DSP over an analog phone line, audio travels via the RTP (or SRTP) media streams of a SIP VoIP call.

Advance your IoT security with LevelBlue.

Learn More

Usage

The repository contains two applications:

  • slmodemd – A stripped down and patched version of Debian’s sl-modem-daemon package. All kernel driver code has been replaced with socket-based communication, allowing external applications to manage audio streams.
  • d-modem – External application that interfaces with slmodemd to manage SIP calls and their associated audio streams.

After they have been built, you will need to configure SIP account information in the SIP_LOGIN environment variable:

# export SIP_LOGIN=username:password@sip.example.com

Next, run slmodemd, passing the path to d-modem in the -e option. Use -d<level> for debug logging.

# ./slmodemd/slmodemd -d9 -e ./d-modem
SmartLink Soft Modem: version 2.9.11 Oct 28 2021 16:51:30
symbolic link `/dev/ttySL0' -> `/dev/pts/3' created.
modem `slamr0' created. TTY is `/dev/pts/3'
Use `/dev/ttySL0' as modem device, Ctrl+C for termination.

In another terminal, connect to the newly created serial device at 115200 bps:

# screen /dev/ttySL0 115200

You can now interact with this terminal (almost) as you would with a normal modem using standard AT commands. A similar modem’s manual provides a more complete list.

Because there isn’t any dial tone on our SIP connection, you’ll need to disable dial tone detection:

atx3
OK

To successfully connect, you will likely need to manually select a modulation and data rate. In our testing, V.32bis (14.4kbps) and below appears to be the most reliable, though V.34 (33.6kbps) connections are sometimes successful. For example, the following command selects V.32bis with a data rate of 4800 – 9600 bps. Refer to the manual for further details.

at+ms=132,0,4800,9600
OK

Finally, dial the number of the target system. Below shows a connection to the NIST atomic clock:

atd303-494-4774
CONNECT 9600

National Institute of Standards and Technology
Telephone Time Service, Generator 1b
Enter the question mark character for HELP
                                         D L
MJD YR MO DA HH MM SS ST S UT1 msADV <OTM>

59515 21-10-28 21:40:18 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:19 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:20 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:21 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:22 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:23 11 0 -.1 045.0 UTC(NIST) *

 

Known Issues / Future Work

  • Connections are unreliable, and it is currently difficult to connect at speeds higher than 14.4kbps or so. It might be possible to improve this by disabling/reconfiguring PJSIP’s jitter buffer.
  • Additional logging/error handling is needed
  • The serial interface could be replaced with stdio or a socket, and common AT configuration options could be exposed as command line options
  • There is currently no support for receiving calls.

ABOUT LEVELBLUE

LevelBlue is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.

Tips & Tricks Vulnerabilities Penetration Testing

Latest Intelligence

Crypto Drainers as a Converging Threat: Insights into Emerging Hybrid Attack Ecosystems
A Closer Look at the Novel and Stealthy KarstoRAT Malware
Go With the Flow: Abusing OAuth Device Code Flow

Discover how our specialists can tailor a security program to fit the needs of
your organization.

Request a Demo

Stay Informed

Sign up to receive the latest security news and trends straight to your inbox from LevelBlue.
© Copyright 2026