page_title: Advanced Mobile Phone System
section_title: Cloning
hierarchical_section_title: Advanced Mobile Phone System / Cloning
caption_attribution_description: English: Dr. Martin Cooper, the inventor of the cell phone, with DynaTAC prototype from 1973 (in the year 2007). Deutsch: Martin Cooper mit einem etwas größeren DynaTAC-Prototypen von 1973 (im Jahr 2007) Русский: Мартин Купер, изобретатель сотового телефона с прототипом DynaTAC 1973 года (в 2007 году) 中文（台灣）‎: 馬汀庫柏博士，全世界第一隻商用手機的發明人。
context_page_description: Advanced Mobile Phone System was an analog mobile phone system standard originally developed by Bell Labs and later modified in a cooperative effort between Bell Labs and Motorola. It was officially introduced in the Americas on October 13, 1983, Israel in 1986, Australia in 1987, Singapore in 1988, and Pakistan in 1990. It was the primary analog mobile phone system in North America through the 1980s and into the 2000s. As of February 18, 2008, carriers in the United States were no longer required to support AMPS and companies such as AT&T and Verizon Communications have discontinued this service permanently. AMPS was discontinued in Australia in September 2000, in Pakistan by October 2004, in Israel by January 2010, and Brazil by 2010.
context_section_description: In the 1990s, an epidemic of "cloning" cost the cellular carriers millions of dollars. An eavesdropper with specialized equipment could intercept a handset's ESN (Electronic Serial Number) and MDN or CTN (Mobile Directory Number or Cellular Telephone Number). The Electronic Serial Number, a 12-digit number sent by the handset to the cellular system for billing purposes, uniquely identified that phone on the network. The system then allowed or disallowed calls and/or features based on its customer file. A person intercepting an ESN/MDN pair could clone the combination onto a different phone and use it in other areas for making calls without paying.
  Cellular phone cloning became possible with off-the-shelf technology in the 1990s. Would-be cloners required three key items :
  A radio receiver, such as the Icom PCR-1000, that could tune into the Reverse Channel (the frequency on which AMPS phones transmit data to the tower)
  A PC with a sound card and a software program called Banpaia
  A phone that could easily be used for cloning, such as the Oki 900
  The radio, when tuned to the proper frequency, would receive the signal transmitted by the cell phone to be cloned, containing the phone's ESN/MDN pair. This signal would feed into the sound-card audio-input of the PC, and Banpaia would decode the ESN/MDN pair from this signal and display it on the screen. The hacker could then copy that data into the Oki 900 phone and reboot it, after which the phone network could not distinguish the Oki from the original phone whose signal had been received. This gave the cloner, through the Oki phone, the ability to use the mobile-phone service of the legitimate subscriber whose phone was cloned – just as if that phone had been physically stolen, except that the subscriber retained his or her phone, unaware that the phone had been cloned—at least until that subscriber received his or her next bill.
  The problem became so large that some carriers required the use of a PIN before making calls. Eventually, the cellular companies initiated a system called RF Fingerprinting, whereby it could determine subtle differences in the signal of one phone from another and shut down some cloned phones. Some legitimate customers had problems with this though if they made certain changes to their own phone, such as replacing the battery and/or antenna.
  The Oki 900 could listen in to AMPS phone-calls right out-of-the-box with no hardware modifications.
caption: Martin Cooper of Motorola in 2007, reenacting the first private handheld mobile-phone call on a larger prototype model in 1973.
exif: {"Image ImageDescription": "Photo by Best DSC!", "Image Make": "RJD", "Image Model": "LDC-828Z3", "Image Orientation": "Horizontal (normal)", "Image Software": "0.4.62-C 2006/2/10 14:3", "Image DateTime": "2007:06:05 14:45:08", "Image YCbCrPositioning": "Co-sited", "Image Copyright": "", "Image ExifOffset": "2290", "Image Padding": "[]", "Thumbnail Compression": "JPEG (old-style)", "Thumbnail XResolution": "72", "Thumbnail YResolution": "72", "Thumbnail ResolutionUnit": "Pixels/Inch", "Thumbnail JPEGInterchangeFormat": "37773", "Thumbnail JPEGInterchangeFormatLength": "4004", "EXIF ExposureTime": "1/45", "EXIF FNumber": "72/25", "EXIF ExposureProgram": "Program Normal", "EXIF ISOSpeedRatings": "400", "EXIF ExifVersion": "0220", "EXIF DateTimeDigitized": "2007:06:05 14:45:08", "EXIF ComponentsConfiguration": "CrCbY", "EXIF CompressedBitsPerPixel": "3216685/1018464", "EXIF ShutterSpeedValue": "11/2", "EXIF ApertureValue": "153/50", "EXIF ExposureBiasValue": "0", "EXIF MaxApertureValue": "61/20", "EXIF MeteringMode": "Average", "EXIF LightSource": "Daylight", "EXIF Flash": "Flash fired, red-eye reduction mode", "EXIF FocalLength": "397/50", "EXIF FlashPixVersion": "0010", "EXIF ColorSpace": "sRGB", "EXIF ExifImageWidth": "3296", "EXIF ExifImageLength": "2472", "EXIF RelatedSoundFile": "RelatedSound", "EXIF ExposureIndex": "1", "EXIF SensingMethod": "One-chip color area", "EXIF FileSource": "0", "EXIF SceneType": "0", "EXIF WhiteBalance": "Auto", "EXIF Padding": "[]", "EXIF OffsetSchema": "4132"}