Anyone a victim of Phone Cloning?

Hello,

Reading through a string of posts about a customer who has been having
trouble tracking his minutes through #MIN... made me think of this
question.

Has anyone ever been a victim of having your cell phone "cloned"? I
wouldn't even know how to go about even doing something like this.
Would incoming calls go to both phones (the original and the cloned
one)?

Most importantly, how would you be able to tell if your phone was being
cloned? And how could you stop it?

Thanks,
Eric

> Has anyone ever been a victim of having your cell phone "cloned"? I
> wouldn't even know how to go about even doing something like this.
> Would incoming calls go to both phones (the original and the cloned
> one)?
>
> Most importantly, how would you be able to tell if your phone was being
> cloned?

You can't.
Cloning is usually done by monitoring the cellular channels to
capture the esn/min combination and program them into another phone.
Or, if the person can get physical access to the phone, he can write down
the esn and phone number of the phone.
Over the air capturing is currently limited to AMPS operation and
some TDMA phones.
But, as spread spectrum technology becomes more common,
you will probably see people capturing esn/min pares off a CDMA
control channel after spread spectrum receivers become readily available.

>And how could you stop it?

Once your phone has been cloned, the only way
to get things back on the right track is to change
the account over to a different phone with a different esn.
That would render all the clones useless.

On cloned phones.
Both phones would ring on an incoming call.
Some carriers have sentry programs that look for evidence
of the same phone being used in multiple places at one time.
And if they detect any indication of that, they will lock the account.

You can usually tell if you have already been cloned by
odd calls showing up on your bill, and a large amount
of calls showing up on your bill.
Or if you get a lot off odd calls where someone will call
and just hang up when they hear who it is.

The only question I have is about the over the air programming
on CDMA phones.
Does it prompt you for information that will guaranty that you
are the valid account user?
If they didn't, it would be a hole that cloners could use.

In article <nZ5fb.167514$3o3.12129417@bgtnsc05-news.ops.worldnet.att.net>,
N9WOS <n9wos@nobug.worldnet.att.net> wrote:
>Cloning is usually done by monitoring the cellular channels to
>capture the esn/min combination and program them into another phone.
>Or, if the person can get physical access to the phone, he can write down
>the esn and phone number of the phone.
>Over the air capturing is currently limited to AMPS operation and
>some TDMA phones.
>But, as spread spectrum technology becomes more common,
>you will probably see people capturing esn/min pares off a CDMA
>control channel after spread spectrum receivers become readily available.

With CDMA, the ESN is NEVER sent. The channel from the phone to the
tower is encoded using the ESN of the phone; the phone knows its own
ESN, and the system looks it up from the MIN which IS sent. Without
knowing the ESN, the data stream is extremely difficult to even find
buried in the 1.25MHz CDMA carrier, making it essentially impossible for
anyone short of someone like the NSA to extract the on-the-air signal.
It is much easier to get a court order or whatever they need these days
to intercept the call at the switch.

"N9WOS" <n9wos@nobug.worldnet.att.net> wrote in message
news:nZ5fb.167514$3o3.12129417@bgtnsc05-news.ops.worldnet.att.net...
> > Has anyone ever been a victim of having your cell phone "cloned"? I
> > wouldn't even know how to go about even doing something like this.
> > Would incoming calls go to both phones (the original and the cloned
> > one)?
> >
> > Most importantly, how would you be able to tell if your phone was being
> > cloned?
>
> You can't.
> Cloning is usually done by monitoring the cellular channels to
> capture the esn/min combination and program them into another phone.
> Or, if the person can get physical access to the phone, he can write down
> the esn and phone number of the phone.
> Over the air capturing is currently limited to AMPS operation and
> some TDMA phones.
> But, as spread spectrum technology becomes more common,
> you will probably see people capturing esn/min pares off a CDMA
> control channel after spread spectrum receivers become readily available.
>
> >And how could you stop it?
>
> Once your phone has been cloned, the only way
> to get things back on the right track is to change
> the account over to a different phone with a different esn.
> That would render all the clones useless.
>
> On cloned phones.
> Both phones would ring on an incoming call.
> Some carriers have sentry programs that look for evidence
> of the same phone being used in multiple places at one time.
> And if they detect any indication of that, they will lock the account.
>
> You can usually tell if you have already been cloned by
> odd calls showing up on your bill, and a large amount
> of calls showing up on your bill.
> Or if you get a lot off odd calls where someone will call
> and just hang up when they hear who it is.
>
> The only question I have is about the over the air programming
> on CDMA phones.
> Does it prompt you for information that will guaranty that you
> are the valid account user?
> If they didn't, it would be a hole that cloners could use.
>
>
As far as I know, all it needs is your phone esn which is automatic.

> With CDMA, the ESN is NEVER sent. The channel from the phone to the
> tower is encoded using the ESN of the phone; the phone knows its own
> ESN, and the system looks it up from the MIN which IS sent. Without
> knowing the ESN, the data stream is extremely difficult to even find
> buried in the 1.25MHz CDMA carrier,

The esn is part of it.

It generates a 42 bit PN (pseudo noise) number for voice encryption.
a 64 bit number for control encryption.
and a 32 bit number for data encryption.

All of that from the ESN, A key and the random SSD generated
by the carrier.
The interim processing is the cave algorithm and other
sub encryption algorithms.

The coding system is good but nothing is perfect.

The best thing they did was have a running call counter
on both ends of the link.
That is a better help against fraud than all the encryption they
have thrown into the mix.

And you don't have to know any of that to get
access to the actual data stream.
That is just spread with a standard spreading sequence.
The point of the other stuff above is to make that
data stream useless.

> > The only question I have is about the over the air programming
> > on CDMA phones.
> > Does it prompt you for information that will guaranty that you
> > are the valid account user?
> > If they didn't, it would be a hole that cloners could use.
> >
> >
> As far as I know, all it needs is your phone esn which is automatic.

Hopefully the phone esn is embedded in the qualcomm chip that does
the encryption or that is a security hole the size of Montana.

Who would need to scan for the esn/min pair,
the network will provide it for you.
All you would have to be is lucky enough to guess a
active esn.

good luck... run the math...

-Tom


> Who would need to scan for the esn/min pair,
> the network will provide it for you.
> All you would have to be is lucky enough to guess a
> active esn.

> good luck... run the math...

I think you are missing the point.
ESNs are assigned sequentially.
The phone in a shipping crate usually is accompanied
with other phones that have an ESN that is incremented
by 1 (or a few more) away from the phone in question.

When you see a new phone that has just been sold in your
area, you know that the other phones in that crate has
already been distributed in your area, or is waiting to be distributed.

If you look at the phone on display or buy a phone, you can
just use that esn to determine what other ESNs you should try in your area.

That is why they need the ESN embedded in the QC chip.
If it is outside of the chip, then they could just make up
a unit to feed the QC chip an ESN to try, and if the network
programs the phone, then you have the ESN, A key, And MIN.

Has anyone had a modern phone purposely cloned--I see google searches
with foreign ads for it? the software for this is illegal in the us, and
the old stuff all come from overseas(?)anyway.

junk@oddbite.com (Thomas Zielinski) wrote in article
<4af581c2.0310031101.30b75c07@posting.google.com >:
> good luck... run the math...
>
> -Tom
>
>
> > Who would need to scan for the esn/min pair,
> > the network will provide it for you.
> > All you would have to be is lucky enough to guess a
> > active esn.

[posted via phonescoop.com]

On Fri, 03 Oct 2003 03:24:03 GMT, "N9WOS"
<n9wos@nobug.worldnet.att.net> posted in alt.cellular.verizon:

>But, as spread spectrum technology becomes more common,
>you will probably see people capturing esn/min pares off a CDMA
>control channel after spread spectrum receivers become readily available.

IIRC, the ESN isn't transmitted in CDMA.