LevelBlue Completes Acquisition of Cybereason. Learn more

Request a Demo

LevelBlue Completes Acquisition of Cybereason. Learn more

Submit RFP
Request a Demo
Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
View All Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
We reduce cyber risk and fortify organizations
Awards and Accolades
Recognition by analysts and media outlets
LevelBlue SpiderLabs
Global researchers, ethical hackers, and responders
LevelBlue Security Operations Platforms
Unprecedented security visibility and control
Security Colony
Access to cybersecurity threat protection resources
Partners
Microsoft
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP

Introducing D-Modem: A software SIP modem

Change theme to light
3 Minute Read by Dan Bastone

Connect to dialup modems over VoIP using SIP, no modem hardware required.

Even in 2021, Aon’s Security Testing practice occasionally receives requests from our clients for penetration testing of systems accessible over dialup modem. These legacy systems have sometimes been running for decades, and often have never undergone any type of formal security assessment. While not usually accessible over the internet, in many cases these systems are connected to an organization’s internal LAN, making them attractive targets for attackers looking to bypass internet-based perimeter defenses.

Connecting to these systems typically requires a physical modem and either a PSTN -connected landline, or a low-latency VoIP connection and an analog telephone adapter (ATA).

To facilitate testing these systems in the modern era, Aon is releasing D-Modem, a software solution that does not require a physical modem or ATA. All that is required is an account with a SIP VoIP provider. It works by combining the slmodem softmodem (available in Debian Linux) with the PJSIP SIP stack.

Source code and build instructions: https://github.com/AonCyberLabs/D-Modem

 

How it Works

Traditional “controller-based” modems generally used a microcontroller and a DSP to handle all aspects of modem communication on the device itself. Later, so-called “Winmodems” were introduced that allowed for field-programmable DSPs and moved the controller and other functionality into software running on the host PC. This was followed by “pure software” modems that moved DSP functionality to the host as well. The physical hardware of these softmodems was only used to connect to the phone network, and all processing was done in software.

D-Modem replaces a softmodem’s physical hardware with a SIP stack. Instead of passing audio to and from the software DSP over an analog phone line, audio travels via the RTP (or SRTP) media streams of a SIP VoIP call.

Advance your IoT security with LevelBlue.

Learn More

Usage

The repository contains two applications:

  • slmodemd – A stripped down and patched version of Debian’s sl-modem-daemon package. All kernel driver code has been replaced with socket-based communication, allowing external applications to manage audio streams.
  • d-modem – External application that interfaces with slmodemd to manage SIP calls and their associated audio streams.

After they have been built, you will need to configure SIP account information in the SIP_LOGIN environment variable:

# export SIP_LOGIN=username:password@sip.example.com

Next, run slmodemd, passing the path to d-modem in the -e option. Use -d<level> for debug logging.

# ./slmodemd/slmodemd -d9 -e ./d-modem
SmartLink Soft Modem: version 2.9.11 Oct 28 2021 16:51:30
symbolic link `/dev/ttySL0' -> `/dev/pts/3' created.
modem `slamr0' created. TTY is `/dev/pts/3'
Use `/dev/ttySL0' as modem device, Ctrl+C for termination.

In another terminal, connect to the newly created serial device at 115200 bps:

# screen /dev/ttySL0 115200

You can now interact with this terminal (almost) as you would with a normal modem using standard AT commands. A similar modem’s manual provides a more complete list.

Because there isn’t any dial tone on our SIP connection, you’ll need to disable dial tone detection:

atx3
OK

To successfully connect, you will likely need to manually select a modulation and data rate. In our testing, V.32bis (14.4kbps) and below appears to be the most reliable, though V.34 (33.6kbps) connections are sometimes successful. For example, the following command selects V.32bis with a data rate of 4800 – 9600 bps. Refer to the manual for further details.

at+ms=132,0,4800,9600
OK

Finally, dial the number of the target system. Below shows a connection to the NIST atomic clock:

atd303-494-4774
CONNECT 9600

National Institute of Standards and Technology
Telephone Time Service, Generator 1b
Enter the question mark character for HELP
                                         D L
MJD YR MO DA HH MM SS ST S UT1 msADV <OTM>

59515 21-10-28 21:40:18 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:19 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:20 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:21 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:22 11 0 -.1 045.0 UTC(NIST) *
59515 21-10-28 21:40:23 11 0 -.1 045.0 UTC(NIST) *

 

Known Issues / Future Work

  • Connections are unreliable, and it is currently difficult to connect at speeds higher than 14.4kbps or so. It might be possible to improve this by disabling/reconfiguring PJSIP’s jitter buffer.
  • Additional logging/error handling is needed
  • The serial interface could be replaced with stdio or a socket, and common AT configuration options could be exposed as command line options
  • There is currently no support for receiving calls.

ABOUT LEVELBLUE

LevelBlue is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.

Tips & Tricks Vulnerabilities Penetration Testing

Latest Intelligence

Threat Intelligence News from LevelBlue SpiderLabs January 2026
A 2025 Threat Trends Analysis
Holiday Fraud 2025: Gift Card Schemes Exploiting Seasonal Shopping

Discover how our specialists can tailor a security program to fit the needs of
your organization.

Request a Demo