http://www.phrack.org/issues.html?issue=64&id=5 is another hacker going at it as well, from 2007. It includes a little more information about the protocol, but doesn't touch on listening to encrypted versions.