272 lines
15 KiB
Plaintext
272 lines
15 KiB
Plaintext
|
|
CELLULAR PHREAKS & CODE DUDES
|
|
=============================
|
|
By John Markoff
|
|
Wired, 1.1 (Premiere Issue), 1993
|
|
|
|
---------------------------------------
|
|
Hacking Chips On Cellular Phones Is The
|
|
Latest Thing In The Digital Underground
|
|
---------------------------------------
|
|
|
|
|
|
In Silicon Valley, each new technology gives rise to a new generation
|
|
of hackers. Consider the cellular telephone. The land-based tele-
|
|
phone system was originally the playground for a small group of hardy
|
|
adventurers who believed mastery of telephone technology was an end
|
|
in itself. Free phone calls weren't the goal of the first phone
|
|
phreaks. The challenge was to understand the system.
|
|
|
|
The philosophy of these phone hackers: Push the machines as far as
|
|
they would go.
|
|
|
|
Little has changed. Meet V.T. and N.M., the nation's most clever
|
|
cellular phone phreaks. (Names here are obscured because, as with
|
|
many hackers, V.T. and N.M.'s deeds inhabit a legal gray area.) The
|
|
original phone phreaks thought of themselves as "telecommunications
|
|
hobbyists" who explored the nooks and crannies of the nation's tele-
|
|
phone network -- not for profit, but for intellectual challenge. For
|
|
a new generation, the cellular revolution offers rich new veins to
|
|
mine.
|
|
|
|
V.T. is a young scientist at a prestigious government laboratory.
|
|
He has long hair and his choice in garb frequently tends toward Pata-
|
|
gonia. He is generally regarded as a computer hacker with few
|
|
equals. N.M. is a self-taught hacker who lives and works in Silicon
|
|
Valley. He has mastered the intricacies of Unix and DOS. Unusually
|
|
persistent, he spent almost an entire year picking apart his cellular
|
|
phone just to see how it works.
|
|
|
|
What V.T. and N.M. discovered last year is that cellular phones are
|
|
really just computers -- networked terminals -- linked together by a
|
|
gigantic cellular network. They also realized that just like other
|
|
computer, cellular phones are programmable.
|
|
|
|
Programmable! In a hacker's mind that means there is no reason to
|
|
limit a cellular phone to the paltry choice of functions offered by
|
|
its manufacturer. That means that cellular phones can be hacked!
|
|
They can be dissected and disassembled and put back together in re-
|
|
markable new ways. Optimized!
|
|
|
|
Cellular phones aren't the first consumer appliances to be cracked
|
|
open and augmented in ways their designers never conceived. Cars,
|
|
for example, are no longer the sole province of mechanics. This is
|
|
the information age: Modern automobiles have dozens of tiny micro-
|
|
processors. Each one is a computer; each one can be reprogrammed.
|
|
Hot rodding cars today doesn't mean throwing in a new carburetor; it
|
|
means rewriting the software governing the car's fuel injection
|
|
system.
|
|
|
|
This is the reality science fiction writers William Gibson and Bruce
|
|
Sterling had in mind when they created cyberpunk: Any technology, no
|
|
matter how advanced, almost immediately falls to the level of the
|
|
street. Here in Silicon Valley, there are hundreds of others like
|
|
V.T. and N.M. who squeeze into the crannies of any new technology,
|
|
bending it to new and more exotic uses.
|
|
|
|
On a recent afternoon, V.T. sits at a conference room in a San
|
|
Francisco highrise. In his hand is an OKI 900 cellular phone. It
|
|
nestles comfortably in his palm as his fingers dance across the key-
|
|
board. Suddenly, the tiny back-lit screen flashes a message: "Good
|
|
Timing!"
|
|
|
|
Good Timing? This is a whimsical message left hidden in the phone's
|
|
software by the manufacturer's programmers. V.T. has entered the
|
|
phone's software sub-basement -- a command area normally reserved for
|
|
technicians. This is where the phone can be reprogrammed; a control
|
|
point from which the phone can be directed to do new and cooler
|
|
things. It is hidden by a simple undocumented password.
|
|
|
|
How did V.T. get the password, or even know one was required? It
|
|
didn't take sophisticated social engineering -- the phone phreak's
|
|
term for gaining secret engineering data by fooling unwitting
|
|
employees into thinking they are talking to an official phone company
|
|
technician. Rather, all he did was order the technical manual, which
|
|
told him he needed special codes to enter the software basement.
|
|
V.T. then called the cellular phone maker's technical support
|
|
hotline. "They said 'sorry about that,' and asked for a fax number.
|
|
A couple of minutes later we had the codes," he recalls with a faint
|
|
grin.
|
|
|
|
V.T.'s fingers continue darting across the keys -- he is issuing com-
|
|
mands built into the phone by the original programmers. These com-
|
|
mands are not found in the programmer's user manual. Suddenly,
|
|
voices emerge from the phone's ear piece. The first is that of a
|
|
salesman getting his messages from a voice mail system. V.T. shifts
|
|
frequencies. Another voice. A woman giving her boss directions to
|
|
his next appointment.
|
|
|
|
What's going on here? V.T. and N.M. have discovered that every cell-
|
|
ular phone possesses a secret mode that turns it into a powerful
|
|
cellular scanner.
|
|
|
|
That's just the beginning. Using a special program called a "dis-
|
|
assembler," V.T. has read-out the OKI'S software, revealing more
|
|
than 90 secret commands for controlling the phone.
|
|
|
|
That's how the two hackers found the undocumented features that turn
|
|
the phone into a scanner. Best of all, the manufacturer has included
|
|
a simple interface that makes it possible to control the phone with a
|
|
standard personal computer.
|
|
|
|
A personal computer! The most programmable of a hacker's tools! That
|
|
means that what appears to be a simple telephone can be easily trans-
|
|
formed into a powerful machine that can do things its designers never
|
|
dreamed of!
|
|
|
|
V.T. and N.M. have also discovered that the OKI'S 64-Kbyte ROM -- a
|
|
standard off-the-shelf chip that stores the phone's software -- has
|
|
more than 20 Kbytes of free space. Plenty of room to add special
|
|
features, just like hot rodding the electronics of a late-model car.
|
|
Not only do the hackers use the software that is already there, but
|
|
they can add some of their own as well. And for a good programmer, 20
|
|
Kbytes is a lot of room to work with.
|
|
|
|
It is worth noting that V.T. and N.M. are not interested in getting
|
|
free phone calls. There are dozens of other ways to accomplish that,
|
|
as an anonymous young pirate recently demonstrated by stealing the
|
|
electronic serial number from a San Diego roadside emergency box and
|
|
then racking up thousands of phone calls before the scam was discov-
|
|
ered. (Such a serial number allowed the clever hacker to create a
|
|
phone that the phone network thought was somewhere on a pole by the
|
|
side of the freeway.)
|
|
|
|
It's also possible to wander to street corners in any borough in New
|
|
York City and find a code dude -- street slang for someone who il-
|
|
legally pirates telephone codes -- who will give you 15 minutes of
|
|
phone time to any corner of the world for $10. These "dudes" find
|
|
illegally gathered charge card numbers and then resell them on the
|
|
street until telephone security catches on. The tip-off: often an
|
|
unusually large number of calls to Ecuador or France emanating from
|
|
one particular street corner.
|
|
|
|
Then again, it's possible for you to join the code hackers who write
|
|
telephone software that automatically finds codes to be stolen. Or
|
|
you can buy a hot ROM -- one that contains magic security information
|
|
identifying you as a paying customer. Either way, your actions would
|
|
be untraceable by the phone company's interwoven security databases.
|
|
|
|
But free phone calls are not what V.T. and N.M. are about. "It's so
|
|
boring," says V.T. "If you're going to do something illegal, you
|
|
might as well do something interesting."
|
|
|
|
So what's tempting? N.M. has hooked his portable PC and his cellular
|
|
phone together. He watches the laptop's screen, which is drawing a
|
|
map of each cellular phone call currently being placed in our cell --
|
|
a term for the area covered by one broadcast unit in the cellular
|
|
phone network. The network can easily query each cellular phone as
|
|
to its current location. When phones travel from one cell to the
|
|
next -- as they tend to do in a car -- information is passed on in
|
|
the form of hidden code married to the phone transmission. Since N.M.
|
|
knows where each local cell is, he can display the approximate geo-
|
|
graphic locations of each phone that is currently active.
|
|
|
|
But for that tracking scheme to work, the user must be on the phone.
|
|
It would take only a few days of hacking to extend the software on
|
|
N.M.'s PC to do an even more intriguing monitoring task: Why not pi-
|
|
rate the data from the cellular network's paging channel (a special
|
|
frequency that cellular networks use to communicate administrative
|
|
information to cellular phones) and use it to follow car phones
|
|
through the networks? Each time there is a hand-off from one cell to
|
|
the next, that fact could be recorded on the screen of the PC --
|
|
making it possible to track users regardless of whether or not they
|
|
are on the phone.
|
|
|
|
Of course this is highly illegal, but N.M. muses that the capability
|
|
is something that might be extremely valuable to law enforcement
|
|
agencies -- and all at a cost far below the exotic systems they now
|
|
use.
|
|
|
|
Hooking a cellular phone to a personal computer offers other surveil-
|
|
lance possibilities as well. V.T. and N.M. have considered writing
|
|
software to monitor particular phone numbers. They could easily des-
|
|
ign a program that turns the OKI 900 on when calls are originated
|
|
from a specific number, or when specific numbers are called. A
|
|
simple voice-activated recorder could then tape the call. And, of
|
|
course, a reprogrammed phone could automatically decode touch-tone
|
|
passwords -- making it easy to steal credit card numbers and voice-
|
|
mail codes.
|
|
|
|
Then there's the vampire phone. Why not, suggests V.T., take advan-
|
|
tage of a cellular phone's radio frequency leakage -- inevitable low-
|
|
power radio emissions -- to build a phone that, with the press of a
|
|
few buttons, could scan the RF spectrum for the victim's electronic
|
|
serial number. You'd have to be pretty close to the target phone to
|
|
pick up the RF, but once you have the identity codes, a reprogrammed
|
|
phone becomes digitally indistinguishable from the original. This is
|
|
they type of phone fraud that keeps federal investigators up at
|
|
night.
|
|
|
|
Or how about the ultimate hacker's spoof? V.T. has carefully studied
|
|
phone company billing procedures and found many examples of inaccu-
|
|
rate bills. Why not monitor somebody's calls and then anonymously
|
|
send the person a corrected version of their bill: "According to our
|
|
records...."
|
|
|
|
Of course, such software hacks are probably highly illegal, and auth-
|
|
orities seem to be catching on. The Electronic Communications Priva-
|
|
cy Act of 1986 makes it a federal crime to eavesdrop on cellular
|
|
phone calls. More recently, Congress passed another law forbidding
|
|
the manufacture of cellular scanners. While they may not be manu-
|
|
facturers, both N.M. and V.T. realize that their beautifully crafted
|
|
phones are probably illegal.
|
|
|
|
For now, their goals are more modest. V.T., for example, would like
|
|
to be able to have several phones with the same phone number. Not a
|
|
problem, as it turns out. Although federal law requires that elec-
|
|
tronic serial numbers be hidden in specially protected memory loca-
|
|
tions, V.T. and N.M. have figured out how to pry the OKI'S ESN out
|
|
and and write software so that they can replace it with their own
|
|
number.
|
|
|
|
V.T. and N.M.'s explorations into the soul of the OKI 900 have left
|
|
them with a great deal of admiration for OKI'S programmers. "I don't
|
|
know what they were thinking, but they had a good time," V.T. said,
|
|
"This phone was clearly built by hackers."
|
|
|
|
The one thing V.T. and N.M. haven't decided is whether or not they
|
|
should tell OKI about the bugs -- and the possibilities -- they've
|
|
found in the phone's software.
|
|
|
|
|
|
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
|
|
|
|
|
|
W h y W i r e d:
|
|
|
|
Because the Digital Revolution is whipping through our lives like a
|
|
Bengali typhoon -- while the mainstream media is still groping for
|
|
the snooze button. And because the computer "press" is too busy
|
|
churning out the latest PCINFOCOMPUTINGCORPORATEWORLD iteration of
|
|
its ad sales formula cum parts catalog to discuss the meaning or
|
|
context of SOCIAL CHANGES SO PROFOUND their only parallel is probably
|
|
the discovery of fire.
|
|
|
|
There are a lot of magazines about technology. Wired is not one of
|
|
them. Wired is about the most powerful people on the planet today --
|
|
THE DIGITAL GENERATION. These are the people who only only foresaw
|
|
how the merger of computers, telecommunications and the media is
|
|
transforming life at the cusp of the new millenium, they are making
|
|
it happen.
|
|
|
|
OUR FIRST INSTRUCTION TO OUR WRITERS: AMAZE US.
|
|
|
|
Our second: We know a lot about digital technology, and we are bored
|
|
with it. Tell us something we've never heard before, in a way we've
|
|
never seen before. If it challenges our assumptions, so much the
|
|
better.
|
|
|
|
So why now? Why Wired? Because in the age of information overload,
|
|
THE ULTIMATE LUXURY IS MEANING AND CONTEXT.
|
|
|
|
Or put another way, if you're looking for the soul of our new
|
|
society in wild metamorphosis, our advice is simple. Get Wired.
|
|
|
|
- LR
|
|
|
|
You can reach me at 415/904 0664, or LR@WIRED.COM.
|
|
|
|
-------------------------------------------------------------------------
|
|
|
|
|