Cell Phone Overview

---------------------------------------------

---------------------------------------------

[Cell Phones] - By Kript0n (Version 1.0)

[Contribution to Black Sun Research Facility]

[Parts of this text by Extrem Dreames]

---------------------------------------------

---------------------------------------------

http://blacksun.box.sk

[Table of Contents]

.Intro

.Intro Q&A

.Getting to Business

.The numbers

.Cells and frequencies (info & tables)

.Programming the NAM

---------------------------[Intro]----------------------------

Cell phones. Everybody knows what they are. But haven\'t you

tried to understand them a little better? Like, how the hell

your cellphone connects to the \"server\" or shit like that?

Well, this tutorial reveal some of these secrets, and invite

you to research a little. Dive into the world of DTMF...

By the way... This tute is not very easy to understand at

first sight, because it has a lot of technical only information.

I know that. If you have any doubts mail me at bitchz@usa.net

-------------------------[Intro Q&a]--------------------------

Q: What is a cell phone?

A: A 800 mhz radiotelephone, running 3 watts, with the ability

to change channel on computer command from the central switch.

This happens when you travel through

the service area and your

signal becomes stronger at a neighboring cell base station.

Q: They are marketed as a high security device with no

possibility of anyone making a phoney call and charging it to

someone else, how can it be phreaked?

A: An understanding of the phone reveals that every time a call

is made, the phone number,an electronic serial number, and

other data is sent to the switch. If you were to listen to the

oposite side of the control channel as the call is being \"set-up\"

you would hear this data being transmitted to the switch in NRZ

code (non-return to zero). All one has to do, is record this

info and program the bogus phone to these params and a free call

is possible through

the switch.

---------------------[Getting to business]----------------------

.Behind the calling process. An intro to the magic numbers:

When a cellular phone makes a call, it normally transmits it\'s

Electronic Security Number(ESN),Mobile Identification Number(MIN),

it\'s Station Class Mark(SCM) and the number called in a short

burst of data. This burst is the short buzz you hear after you

press the SEND button and before the tower catches the data.

These four things are the components the cellular provider uses

to ensure that the phone is programmed to be billed and that it

also has the identity of both the customer and the phone.

.The Hack Begins

The ESN and the phone number (MIN) are the two primary identifiers

for any cellular phone. By changing both, the cellular carrier

will accept the call and bill it to either a wrong account or

provide service based on the fact that it is NOT a disconnected

receiver. It will also look at the other two components, in order

to insure that it is actually a cellular phone and to forward

billing information to that carrier.

Ok, this gave you some ideas didn\'t it? I should have guessed.

You\'re already thinking on how to change these two simple numbers.

The Station Class Mark can also be changed if you wish to prevent

the cellular carrier from determining the type of phone that is

placing the call. By providing the cellular tower with a false SCM,

the cellular carrier, the FCC, or whoever happens to chase down

cellular fraud is often looking for a particular phone which in

reality is not the phone they are looking for. For example, you

can provide the SCM for a Radio Shack phone, when in reality you

are using a Novatell (How this is done from changing the SCM I do

not know...remember...I didn\'t write this).

The Number Assignment Module (NAM) also has the SIDH (System

Identification for Home System) number programmed into it. Refer to

SIDH TABLE. The transmittal of the SIDH number tells the carrier

where to forward the billing information to in case the user is

\"roaming\".