CELLULAR PHREAKS & CODE DUDES
=============================
By John Markoff
Wired, 1.1 (Premiere Issue), 1993
---------------------------------------
Hacking Chips On Cellular Phones Is The
Latest Thing In The Digital Underground
---------------------------------------
In Silicon Valley, each new technology gives rise to a new generation
of hackers. Consider the cellular telephone. The land-based tele-
phone system was originally the playground for a small group of hardy
adventurers who believed mastery of telephone technology was an end
in itself. Free phone calls weren't the goal of the first phone
phreaks. The challenge was to understand the system.
The philosophy of these phone hackers: Push the machines as far as
they would go.
Little has changed. Meet V.T. and N.M., the nation's most clever
cellular phone phreaks. (Names here are obscured because, as with
many hackers, V.T. and N.M.'s deeds inhabit a legal gray area.) The
original phone phreaks thought of themselves as "telecommunications
hobbyists" who explored the nooks and crannies of the nation's tele-
phone network -- not for profit, but for intellectual challenge. For
a new generation, the cellular revolution offers rich new veins to
mine.
V.T. is a young scientist at a prestigious government laboratory.
He has long hair and his choice in garb frequently tends toward Pata-
gonia. He is generally regarded as a computer hacker with few
equals. N.M. is a self-taught hacker who lives and works in Silicon
Valley. He has mastered the intricacies of Unix and DOS. Unusually
persistent, he spent almost an entire year picking apart his cellular
phone just to see how it works.
What V.T. and N.M. discovered last year is that cellular phones are
really just computers -- networked terminals -- linked together by a
gigantic cellular network. They also realized that just like other
computer, cellular phones are programmable.
Programmable! In a hacker's mind that means there is no reason to
limit a cellular phone to the paltry choice of functions offered by
its manufacturer. That means that cellular phones can be hacked!
They can be dissected and disassembled and put back together in re-
markable new ways. Optimized!
Cellular phones aren't the first consumer appliances to be cracked
open and augmented in ways their designers never conceived. Cars,
for example, are no longer the sole province of mechanics. This is
the information age: Modern automobiles have dozens of tiny micro-
processors. Each one is a computer; each one can be reprogrammed.
Hot rodding cars today doesn't mean throwing in a new carburetor; it
means rewriting the software governing the car's fuel injection
system.
This is the reality science fiction writers William Gibson and Bruce
Sterling had in mind when they created cyberpunk: Any technology, no
matter how advanced, almost immediately falls to the level of the
street. Here in Silicon Valley, there are hundreds of others like
V.T. and N.M. who squeeze into the crannies of any new technology,
bending it to new and more exotic uses.
On a recent afternoon, V.T. sits at a conference room in a San
Francisco highrise. In his hand is an OKI 900 cellular phone. It
nestles comfortably in his palm as his fingers dance across the key-
board. Suddenly, the tiny back-lit screen flashes a message: "Good
Timing!"
Good Timing? This is a whimsical message left hidden in the phone's
software by the manufacturer's programmers. V.T. has entered the
phone's software sub-basement -- a command area normally reserved for
technicians. This is where the phone can be reprogrammed; a control
point from which the phone can be directed to do new and cooler
things. It is hidden by a simple undocumented password.
How did V.T. get the password, or even know one was required? It
didn't take sophisticated social engineering -- the phone phreak's
term for gaining secret engineering data by fooling unwitting
employees into thinking they are talking to an official phone company
technician. Rather, all he did was order the technical manual, which
told him he needed special codes to enter the software basement.
V.T. then called the cellular phone maker's technical support
hotline. "They said 'sorry about that,' and asked for a fax number.
A couple of minutes later we had the codes," he recalls with a faint
grin.
V.T.'s fingers continue darting across the keys -- he is issuing com-
mands built into the phone by the original programmers. These com-
mands are not found in the programmer's user manual. Suddenly,
voices emerge from the phone's ear piece. The first is that of a
salesman getting his messages from a voice mail system. V.T. shifts
frequencies. Another voice. A woman giving her boss directions to
his next appointment.
What's going on here? V.T. and N.M. have discovered that every cell-
ular phone possesses a secret mode that turns it into a powerful
cellular scanner.
That's just the beginning. Using a special program called a "dis-
assembler," V.T. has read-out the OKI'S software, revealing more
than 90 secret commands for controlling the phone.
That's how the two hackers found the undocumented features that turn
the phone into a scanner. Best of all, the manufacturer has included
a simple interface that makes it possible to control the phone with a
standard personal computer.
A personal computer! The most programmable of a hacker's tools! That
means that what appears to be a simple telephone can be easily trans-
formed into a powerful machine that can do things its designers never
dreamed of!
V.T. and N.M. have also discovered that the OKI'S 64-Kbyte ROM -- a
standard off-the-shelf chip that stores the phone's software -- has
more than 20 Kbytes of free space. Plenty of room to add special
features, just like hot rodding the electronics of a late-model car.
Not only do the hackers use the software that is already there, but
they can add some of their own as well. And for a good programmer, 20
Kbytes is a lot of room to work with.
It is worth noting that V.T. and N.M. are not interested in getting
free phone calls. There are dozens of other ways to accomplish that,
as an anonymous young pirate recently demonstrated by stealing the
electronic serial number from a San Diego roadside emergency box and
then racking up thousands of phone calls before the scam was discov-
ered. (Such a serial number allowed the clever hacker to create a
phone that the phone network thought was somewhere on a pole by the
side of the freeway.)
It's also possible to wander to street corners in any borough in New
York City and find a code dude -- street slang for someone who il-
legally pirates telephone codes -- who will give you 15 minutes of
phone time to any corner of the world for $10. These "dudes" find
illegally gathered charge card numbers and then resell them on the
street until telephone security catches on. The tip-off: often an
unusually large number of calls to Ecuador or France emanating from
one particular street corner.
Then again, it's possible for you to join the code hackers who write
telephone software that automatically finds codes to be stolen. Or
you can buy a hot ROM -- one that contains magic security information
identifying you as a paying customer. Either way, your actions would
be untraceable by the phone company's interwoven security databases.
But free phone calls are not what V.T. and N.M. are about. "It's so
boring," says V.T. "If you're going to do something illegal, you
might as well do something interesting."
So what's tempting? N.M. has hooked his portable PC and his cellular
phone together. He watches the laptop's screen, which is drawing a
map of each cellular phone call currently being placed in our cell --
a term for the area covered by one broadcast unit in the cellular
phone network. The network can easily query each cellular phone as
to its current location. When phones travel from one cell to the
next -- as they tend to do in a car -- information is passed on in
the form of hidden code married to the phone transmission. Since N.M.
knows where each local cell is, he can display the approximate geo-
graphic locations of each phone that is currently active.
But for that tracking scheme to work, the user must be on the phone.
It would take only a few days of hacking to extend the software on
N.M.'s PC to do an even more intriguing monitoring task: Why not pi-
rate the data from the cellular network's paging channel (a special
frequency that cellular networks use to communicate administrative
information to cellular phones) and use it to follow car phones
through the networks? Each time there is a hand-off from one cell to
the next, that fact could be recorded on the screen of the PC --
making it possible to track users regardless of whether or not they
are on the phone.
Of course this is highly illegal, but N.M. muses that the capability
is something that might be extremely valuable to law enforcement
agencies -- and all at a cost far below the exotic systems they now
use.
Hooking a cellular phone to a personal computer offers other surveil-
lance possibilities as well. V.T. and N.M. have considered writing
software to monitor particular phone numbers. They could easily des-
ign a program that turns the OKI 900 on when calls are originated
from a specific number, or when specific numbers are called. A
simple voice-activated recorder could then tape the call. And, of
course, a reprogrammed phone could automatically decode touch-tone
passwords -- making it easy to steal credit card numbers and voice-
mail codes.
Then there's the vampire phone. Why not, suggests V.T., take advan-
tage of a cellular phone's radio frequency leakage -- inevitable low-
power radio emissions -- to build a phone that, with the press of a
few buttons, could scan the RF spectrum for the victim's electronic
serial number. You'd have to be pretty close to the target phone to
pick up the RF, but once you have the identity codes, a reprogrammed
phone becomes digitally indistinguishable from the original. This is
they type of phone fraud that keeps federal investigators up at
night.
Or how about the ultimate hacker's spoof? V.T. has carefully studied
phone company billing procedures and found many examples of inaccu-
rate bills. Why not monitor somebody's calls and then anonymously
send the person a corrected version of their bill: "According to our
records...."
Of course, such software hacks are probably highly illegal, and auth-
orities seem to be catching on. The Electronic Communications Priva-
cy Act of 1986 makes it a federal crime to eavesdrop on cellular
phone calls. More recently, Congress passed another law forbidding
the manufacture of cellular scanners. While they may not be manu-
facturers, both N.M. and V.T. realize that their beautifully crafted
phones are probably illegal.
For now, their goals are more modest. V.T., for example, would like
to be able to have several phones with the same phone number. Not a
problem, as it turns out. Although federal law requires that elec-
tronic serial numbers be hidden in specially protected memory loca-
tions, V.T. and N.M. have figured out how to pry the OKI'S ESN out
and and write software so that they can replace it with their own
number.
V.T. and N.M.'s explorations into the soul of the OKI 900 have left
them with a great deal of admiration for OKI'S programmers. "I don't
know what they were thinking, but they had a good time," V.T. said,
"This phone was clearly built by hackers."
The one thing V.T. and N.M. haven't decided is whether or not they
should tell OKI about the bugs -- and the possibilities -- they've
found in the phone's software.
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
W h y W i r e d:
Because the Digital Revolution is whipping through our lives like a
Bengali typhoon -- while the mainstream media is still groping for
the snooze button. And because the computer "press" is too busy
churning out the latest PCINFOCOMPUTINGCORPORATEWORLD iteration of
its ad sales formula cum parts catalog to discuss the meaning or
context of SOCIAL CHANGES SO PROFOUND their only parallel is probably
the discovery of fire.
There are a lot of magazines about technology. Wired is not one of
them. Wired is about the most powerful people on the planet today --
THE DIGITAL GENERATION. These are the people who only only foresaw
how the merger of computers, telecommunications and the media is
transforming life at the cusp of the new millenium, they are making
it happen.
OUR FIRST INSTRUCTION TO OUR WRITERS: AMAZE US.
Our second: We know a lot about digital technology, and we are bored
with it. Tell us something we've never heard before, in a way we've
never seen before. If it challenges our assumptions, so much the
better.
So why now? Why Wired? Because in the age of information overload,
THE ULTIMATE LUXURY IS MEANING AND CONTEXT.
Or put another way, if you're looking for the soul of our new
society in wild metamorphosis, our advice is simple. Get Wired.
- LR
You can reach me at 415/904 0664, or LR@WIRED.COM.
-------------------------------------------------------------------------
TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH
