|
|
Introduction
Here's a sweet exploit I came up with while waiting in line at the Sprint
PCS store. First a little back story, Sprint PCS is a digital
CDMA network making it virtually impossible to clone...or so we thought.
The weakness of Sprint's network is that there digital coverage is
pathetic. To fill up the HUGE holes in their network, Sprint
has roaming agreements throughout the US. The roaming agreement is
that whenever there isn't a digital signal (1900) the phones will drop
to analog (800) which is what Sprint calls "roaming".
THE
EXPLOIT
Every Sprint PCS store has a sales floor where they have activated phones
that you can pick up and use. Sprint stores do that so you can try
out their phones to hear the sound quality of each different phone before
you buy one or to call home(or anyone) as a courtesy call. In fact,
every time I go to a Sprint store I always make at least 15-20 prank calls
all over the US.
Basically all you need to do is:
1)Go through the menu and look for the phone's telephone number which is your MIN (mobile id number)
2)Look at the back of the phone and find an 8 character number/letter sequence and this is your ESN.
3)Program the ESN and MIN into your analog OKI-900 phone.
Guess what you just cloned the Sprint PCS's courtesy phone. So when you use your cloned OKI-900 phone, Sprint PCS will think your roaming since your using an analog only phone.
These phones are activated using unlimited calling minutes and I doubt that the Sprint PCS store looks though the hundreds off phones calls that are made from these phones each month so there's little to no chance of getting caught. There's like 7-8 different models out right now so you should get all 7-8 accounts and use'em like crazy.
SPRINT PCS CLONING by oki900/okiwan/kehoki etc. (whatever the hell he wants to be known as these days)
Introduction
Here's a sweet exploit I came up with while waiting in line at the Sprint
PCS store. First a little back story, Sprint PCS is a digital
CDMA network making it virtually impossible to clone...or so we thought.
The weakness of Sprint's network is that there digital coverage is
pathetic. To fill up the HUGE holes in their network, Sprint
has roaming agreements throughout the US. The roaming agreement is
that whenever there isn't a digital signal (1900) the phones will drop
to analog (800) which is what Sprint calls "roaming".
THE
EXPLOIT
Every Sprint PCS store has a sales floor where they have activated phones
that you can pick up and use. Sprint stores do that so you can try
out their phones to hear the sound quality of each different phone before
you buy one or to call home(or anyone) as a courtesy call. In fact,
every time I go to a Sprint store I always make at least 15-20 prank calls
all over the US.
Basically all you need to do is:
1)Go through the menu and look for the phone's telephone number which is your MIN (mobile id number)
2)Look at the back of the phone and find an 8 character number/letter sequence and this is your ESN.
3)Program the ESN and MIN into your analog OKI-900 phone.
Guess what you just cloned the Sprint PCS's courtesy phone. So when you use your cloned OKI-900 phone, Sprint PCS will think your roaming since your using an analog only phone.
These phones are activated using unlimited calling minutes and I doubt that the Sprint PCS store looks though the hundreds off phones calls that are made from these phones each month so there's little to no chance of getting caught. There's like 7-8 different models out right now so you should get all 7-8 accounts and use'em like crazy.
Here
is the list of * Codes / Asterisk codes etc.
*2
TALK Access Provider's
Customer Service Dept.
*4
TALK Access Automated
Account and Usage Data
*72
TALK Call forwarding to another
phone
*720
TALK Turn Call Forwarding feature off
*73
TALK Call Forward - No answer
to another phone
*730
TALK Call Forward - No answer off
*74
TALK Call Forward - Busy to another
phone
*740
TALK Call forward - Busy off
*70
TALK Cancel Call Waiting on a
per call basis
*67
TALK Caller ID Block on a per
call basis
*82
TALK Override Call ID Block on
a per call basis
*98
TALK Do Not Disturb on
*980
TALK Do Not Disturb off
*0
TALK Sprint PCS Operator
*18
TALK Turns "Call Delivery OUTSIDE
home service area account" ON
*180
TALK Turns the "Call Delivery OUTSIDE home
service area" OFF
*211
TALK SmarTraveller - only in certain areas
With that in mind it's a good idea to type in *98 from the phone that you copy the ESN/MIN from so it won't ring when incoming calls come.
Also considering this would be an exploit, you can get your phone's Master Lock code by calling the customer service department and changing your cell phone number over the phone. They will assign you a new phone number and walk you through the steps of reprogramming your new number including giving your the Master Lock code. Note: when you first buy a Sprint PCS phone and activate it, the phone is programmed using a Subsidiary code that you can only use once.
SORRY OKI, PLEASE FORGIVE US FOR THIS OVERSIGHT. :(