The THC Hack/Phreak Archives: DNABOX3.TXT (112 lines) Note: I did not write any of these textfiles. They are being posted from the archive as a public service only - any copyrights belong to the authors. See the footer for important information. ========================================================================== ZDAD? ZA? ZD? ZD? ZD? Z? t t 1-FEB--89 Z? IMOMMMOMOMOMOMOMOMOMOMOMOCelBY 3CDDD6 THE DNA BOX GDY t33 Z6 Hacking Cellular Phones GDDDD? Cel @A4 uHQMQMQMQMQMQMQMQMQMQMQMQMQ< ZA? u ' ` ' ` ' ` ' ` ' ` ' ` x @DY B Cel R T T H R E E t @DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDY Celvious DNA files discussed the possibility of using Japanese handheld HAM radios and personal computers, or tape recorders toCelck Cellular Phone codes, and possible uses for investment & business info obtained by hacking executive and corporate phoneCellls, and investment info services, as well as approaches to modifying the Cellular Phones themselves for use as hacking tooCeland pirate communication devices. Here using and modifying UHF-band radio scanners to hack and monitor Cellular and MobilCelelephone systems will be dealt with. Radio Shack, Uniden, and several other manufacturers make scanners for use by amateuCeladio hobbyists. Most of these will intercept mobile radiotelephone calls without modification by tuning in frequencies in thCel156 MHz and 475 MHz regions. Most of these scanners have line-level audio outputs that can feed a tape recorder or demodulatCeltone decoder chip which can then interface directly to a computer for analyzing codes. Mobile phones use a tone-pulse dialiCelprotocol that should be simple to decode and emulate using standard handheld ham radio gear. You can almost count the dialiCelbeeps without any special equipment. Phone channels are easy to find: they usually broadcast a standard busy signal or an idCeltone (a fixed audio sine wave) when waiting for the next call. You will also hear conversations, ringing, and mobile phone Celrators on these channels. Here's a partial list of frequencies used by mobile phones: (frequencieCeln MHz) 152.51 154.57 152.66 152.69 152.72 152.78 154.54 475.45 475.475 475.55 475.6 475.8 475.825 Cel5.85 475.9 476.05 As you can see, many of the frequencies are spaced 30KHz or 25KHz apart, so there are probably more Celnnels in the gaps at those intervals. These frequencies were gathered in a few minutes of casual listening using an unmodCeled Radio Shack Pro-2021 scanner in search mode. SCANNING CELLULAR FREQUENCIES: Hobby scanners capable of monitoring CelCelar Phones are prohibited in the US. To save money on the production line, many international scanner manufacturers make onlCelne kind of scanning chip which they use in both US and foreign models. These chips are capable of scanning in the 800MHz ranCelbut this feature is diabled by grounding certain pins in the US models. Often restoring Cellular scanning functions is mereCela matter of cutting a circuit trace or removing a single diode from a scanner's printed circuit board. For instance, reCeling diode 513 from a Radio Shack Pro-2004 Scanner will enable the 870MHz Cellular range. Installing diode 510 will increase Cel number of scanning channels from 300 to 400. Installing diode 514 will increase the scanning rate from 16 to 20 channels pCelsecond. These are located on the printed circuit board labeled PC-3. The Uniden Bearcat 200/205XLT can be modified for CeCellar scanning by cutting or removing the 10K-ohm resisitor located on the printed circuit above the letters "DEN" on the miCelprocessor chip labeled "UNIDEN UC-1147". The Regency Electronics MX7000 Scanner reportedly scans Cellular Phones without Celification. An additional scanner rumored to be modifiable is the Realistic Pro-32. Another source of useful radio gear Cel "Export Only" manufacturers. One of these is currently rumored to be offering a handheld cellular phone that does it's ownCeluting and has an operating radius of 160 kilometers! CELLULAR PHONE FREQUENCIES: Here are the frequency range assignmentsCelr Cellular Telephones: Repeater Input (Phone transmissions) 825.03 - 844.98 Megahertz Repeater Output (Tower transmissioCel 870.03 - 889.98 Megahertz There are 666 Channels. Phones transmit 45 MHz below the corresponding Tower channel. The chanCels are spaced every 30 KHz. CORDLESS PHONE FREQUENCIES: It's also possible to hack the popular cordless phones. These use Cel 49MHz band used by baby monitors and toy FM walkie talkies. Scanners can be used to monitor these without modification, anCelM handheld transceivers will allow 2-way hacking of these frequencies, which some may find amusing. Channel Handset TranCelt Base Transmit ------- ---------------- ------------- 1 49.67 46.61 (frequencies in Megahertz) 2Cel 49.845 46.63 3 49.86 46.67 4 49.77 46.71 5 49.875 Cel.73 6 49.83 46.77 7 49.89 46.83 8 49.93 46.87 9 49.Cel 46.93 10 49.97 46.97 Business Update: As of January 1989 there are legal maneuvers going onCel lift the ban on portable phones by traders at the NY Stock Exchange. ZDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDCelDDDDDDDDDDDDDDDDDDDDD? 3 The DNA BOX - Striking at the Nucleus of Corporate Communications. 3 u A current project of..Cel A Outlaw Telecommandos :3]33^:3]]33^3]3: :3]33^:3]]3Cel