Copy Link
Add to Bookmark
Report
NuKE Issue 07-004
================================================================================
NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE
uK E-
E- "The _COMPLETE_ Cellular Telephone Hackers Guide Nu
Nu PART 2 KE
KE The Hacker's Best Tricks" -N
-N OCRd By uK
uK The NuKE Crew E-
E- Nu
E-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-NuKE-Nu
NuKE InfoJournal #7
August 1993
% The ROAMing Technique %
Cellular telephones have a ROAM mode, which indicates that the user is in an
area other than his or her "home" area. This ability allows the user to place
a call in an area away from his own, such as another state, and allows the
phone to be used when travelling or commuting. However, it is impossible for the
local MTSO to know when an "outsider" is on-line in their area, therefore,
incoming calls are not available when ROAMing unless a Call Following feature
is activated by the cellular carrier.
Cellular carriers have common agreements to cross-bill applicable charges,
including extra charges for being an "outsider", when a cellular user takes
advantage of the roaming capabilities of a cellular telephone.
It is possible for a user to make a call when ROAMing and not be billed. The
local area MTSO may put the call through and bill it to the registered user
at a later date, only to learn that the caller was using a stolen number. Keep
in mind that all call information is recorded and can be traced. It is
possible for the authorities to follow up with the "called" party. The calls
most frequently followed up on are calls repeatedly made to the same number
(the user's home number, family members, friends, etc) and noticeable trends
in calling (calling from the same cell each time, calling at the same time of
day, the same area, etc.)
The "ROAMing Technique" is frequently used, due to the fact that carriers
normally will not commit to the time and expense of tracing a call to recoup
the small amount lost on short calls (less than one percent of these calls are
deemed a sufficient loss to be followed up on).
This method requires the NAME be programmed with a fake SIDH (refer to the
Home System ID article). This may provide access for a limited time. A smart
hacker knows to ignore any message to contact the cellular carrier.
% Clone Approach %
A cellular phone can also be reprogrammed to imitate another cellular phone.
This is done for two reasons. First, the owner of two cellular phones does
not want to pay two individual service charges since he only uses one phone at
a any given time. Secondly, a hacker wants to make free phone calls that will
be charged to another cellular user. This approach will work until the wrongly
charged user reports these charges to the carrier at the end of the month
when they get their bill. Called numbers will probably be investigated for the
source.
The entire ESN and NAM (MIN components) are required to accomplish cloning.
The NAM parameters of one phone should be programmed into the other. The ESN
PROM of the first should be read and programmed into the second. The idea is
to make both phones appear to the carrier as the same phone. If an ESN of a
particular phone is not known, then a Cellular Service Monitor or ESN Reader
will be necessary. Most cellular service centres will have one or you can
look in at the Buyer's Guide Article.
Only one phone can be used at any given time. Both phones, will try respond
to incoming calls. The phone that offers the most powerful link will be
connected to break the connection of the other, weaker phone link.
Refer to the first part on how to program the ESN/NAM.
================================================================================
