Esn And The Mobile Phone Number example essay topic

Cell Phones] - By Kri pt 0 n (Version 1.0) [Contribution to Black Sun Research Facility] [Parts of this text by Extrem Dreams web of Contents]. Intro. Intro Q&A. Getting to Business. The numbers. Cells and frequencies (info & tables). Programming the NAM Intro Cell phones.

Everybody knows what they are. But haven't you tried to understand them a little better? Like, how the hell your cellphone connects to the 'server' or shit like that? Well, this tutorial reveal some of these secrets, and invite you to research a little. Dive into the world of DTMF... By the way...

This t ute is not very easy to understand at first sight, because it has a lot of technical only information. I know that. If you have any doubts mail me at Intro Q&a Q: What is a cell phone? A: A 800 mhz radiotelephone, running 3 watts, with the ability to change channel on computer command from the central switch. This happens when you travel thru the service area and your signal becomes stronger at a neighboring cell base station. Q: They are marketed as a high security device with no possibility of anyone making a phone call and charging it to someone else, how can it be?

A: An understanding of the phone reveals that every time a call is made, the phone number, an electronic serial number, and other data is sent to the switch. If you were to listen to side of the control channel as the call is being 'set-up " you would hear this data being transmitted to the switch in NRZ code (non-return to zero). All one has to do, is record this info and program the bogus phone to these param's and a free call is possible thru the switch. Getting to business Behind the calling process.

An intro to the magic numbers: When a cellular phone makes a call, it normally transmits it " 's Electronic Security Number (ESN), Mobile Identification Number (MIN), it's Station Class Mark (SCM) and the number called in a short burst of data. This burst is the short buzz you hear after you press the SEND button and before the tower catches the data. These four things are the components the cellular provider uses to ensure that the phone is programmed to be billed and that it also has the identity of both the customer and the phone... The Hack Begins The ESN and the phone number (MIN) are the two primary any cellular phone. By changing both, the cellular carrier will accept the call and bill it to either a wrong account or provide service based on the fact that it is NOT a disconnected receiver. It will also look at the other two components, in order to insure that it is actually a cellular phone and to forward billing information to that carrier.

Ok, this gave you some ideas didn't it? I should have guessed. You " re already thinking on how to change these two simple numbers. The Station Class Mark can also be changed if you wish to prevent the cellular carrier from determining the type of phone that is placing the call. By providing the cellular tower with a false SCM, the cellular carrier, the FCC, or whoever happens to chase down cellular fraud is often looking for a particular phone which in reality is not the phone they are looking for.

For example, you can provide the SCM for a Radio Shack phone, when in reality you are using a Novatel l (How this is done from changing the SCM I do not know... remember... I didn't write this). The Number Assignment Module (NAM) also has the SIDH (System Identification for Home System) number programmed into it. Refer to SIDH TABLE. The transmittal of the SIDH number tells the carrier where to forward the billing information to in case the user is 'roaming'.

The SIDH table tells the major cities and their identifying numbers. Changing an SIDH is programming job that takes only minutes, but be aware that the ESN is still sent to the cellular phone company. After they realize that the ESN is connected to either a fake number or a phone that is not in the network, they will block service. They only way around this is to reprogram the ESN...

Nams Number Assignment Module - A 32 word by 8 bit PROM The NAM contains all the information that can be programmed to the phone directly from the handset. (i.e. SIDH, MIN, LOCK-CODE, etc.) Ok. Now you " ve got an idea of what you can do with these so called ultra-mega-secure-phones (Yeah, right)... The modifications How to get ESN / MIN pairs, the magic stuff] Now Methods for obtaining this valuable information varies, I'll give you a few personal examples on how I was able to get some pairs. One method (which was lo-risk and cheap) was to do the old infamous trashing, I cased out a local cell provider branch office, found out what were there days / hours of operation, snooped and asked some questions on how they deal with fraud, (social engineering skills were needed of course), to which the only answer they could provide was 'oh, well if you didn't make the calls, we will not require you to pay for them, and we " ll change your number " which gave me two good pieces of information, 1 they just chalk it up to loss, to appease the customers, and two, they don't give a fuck in finding out who made the calls.

Now that was good to hear, so on the day before trash collection I simply parked my car by the dumpster, (flashlight in my pocket), and simulated taking a leak behind the trash bin, quickly I open the side access panel, and did a quick search, I found 3 bags with words (cellular, contract) clearly visible in the bags, I grabbed them, look around, and tossed them in the trunk. After getting them to my garage (it was about 11: 30 pm too) and sifting through the coffee filters, and salad containers, I walked off with about 100 pairs. (written contract info which is discarded after its entered into the computer). The cons to this is that you got a lot of explaining to do to the cops if they see you toss some bags of trash in your trunk, and some states have laws governing trash, to the effect of the trash being the property of the company until its collected by designated trash refuge agency, non-the-less, this works for some places, Cell-1's here, have a company called 'DocumentServices' which pick up their trash, and shred the ESN / personal papers and contracts, thus this is ineffective in some areas... Another more expensive way, is to obtain a device called aDDi, Digital Data Interface, this thing comes in various formats from the more expensive stand-alone box, to a device which interfaces with your 800 mhz capable scanner and a PC, the cheapest standalone I seen was $1295, also I saw a kit for a simple one for about 1-$200, this is the safest way do get pairs, simply make the device mobile, and sit in a busy traffic area (freeway overpass) and collect all the data you need... These are just a couple of examples on obtaining the 'magic numbers', some other ways (trading, inside help) does work too, but are sometimes not effective, try to be creative, the Fed know about the trashing from back to the Captain Crunch days, the DDi seems to be the logical choice for snarfing. No need to say that, after getting the pair of numbers, you have to program them in your cell phone.

We will get to this... [Continuing on the numbers] Well if you haven't guessed by now, the mobiles ESN and MIN must match in the switch or no go. This is required for billing purposes. If one had the ESN and the mobile phone number (MIN), he could call anytime and anyplace without fear of a trace - let alone a bill. The ideal setup would let you listen with a scanner to the reverse control channel, record and display heard working numbers and ESN's, and recall them as one needs to make calls.

This would be it, but we are not quite there yet. But some of the hard work has already been done for us. All the aforementioned codes are sent in hex, in NRZ code (phase-key shifting), when a cellular subscriber places a call. But guess what? All phones have an NRZ receiver and transmitter built right into them. All that has to be done is to have a receiver on the reverse control channel, recover the other subscribers data and save it or print it out.

Cellular phones operate on a full duplex channel. One frequency is used for transmission from the base to the phone, while another is used for transmission from the phone to the base. The base frequencies are always exactly 45 MHZ higher than the phone frequency, and both of these are incremented by 30 KHZ as the progression of channels increases from Channel #1 to Chanel #1023 (NOTE: There are no channels between 800 and 990). With some systems (not all) the cellular transmission is received by the base and retransmitted on the base frequency.

When this is done, a scanner can listen to both sides of the conversation by simply monitoring the base frequency. When this is not the case, two scanners set 45 MHZ apart will work. If the system uses OMNI CELLS, as most do, you can readily find all the channels in a cell if you know just one of them, using tables constructed with the instructions below. Cellular frequencies are assigned by channel number, and for all channel numbers, in both wire line and non-wire line systems, the formula is: Transmit Frequency = (channel number x. 030 MHz) + 870 MHz Receive Frequency = (channel number x. 030 Mhz) + 825 Mhz " Band A' (one of the two blocks) uses channels 1-333.

To construct a table showing frequency by cells, use channel 333 as the top left corner of a table. The next entry to the right of channel 333 is 332, the next is 331, etc., down to channel 313. Enter channel 312 underneath 333,311 under 332, etc. Each channel across the top row is the first channel in each CELL of the system; each channel DOWN from the column from the the first channel is the next frequency assigned to that cell. You may have noted that each channel down is 21 channels lower in number. Usually the data channel used is the highest numbered channel in a cell.

' Band B' uses channels from 334 to 666. Construct your table in a similar way, with channel 334 in the upper left corner, 335 the next entry to the right. The data channel should be the lowest numbered channel in each cell this time.