Advanced Mobile Phone System - Technology

Technology

AMPS is a first-generation cellular technology that uses separate frequencies, or "channels", for each conversation (see FDMA). It therefore required considerable bandwidth for a large number of users. In general terms, AMPS was very similar to the older "0G" Improved Mobile Telephone Service, but used considerably more computing power in order to select frequencies, hand off conversations to PSTN lines, and handle billing and call setup.

What really separated AMPS from older systems is the "back end" call setup functionality. In AMPS, the cell centers could flexibly assign channels to handsets based on signal strength, allowing the same frequency to be re-used in various locations without interference. This allowed a larger number of phones to be supported over a geographical area. AMPS pioneers coined the term "cellular" because of its use of small hexagonal "cells" within a system.

AMPS suffered from many weaknesses when compared to today's digital technologies. As an analog standard, it was very susceptible to static and noise, and had no protection from eavesdropping using a scanner. In the 1990s, an epidemic of "cloning" cost the cellular carriers millions of dollars. An eavesdropper with specialized equipment could intercept a handset's ESN (Electronic Serial Number) and MIN (Mobile Identification Number, or cellular telephone number). The Electronic Serial Number was a 12 digit number sent by the handset to the cellular system for billing purposes, uniquely identifying that phone on the network. The system then allowed or disallowed calls and or features based on its customer file. If an ESN/MIN Pair was intercepted, it could then be cloned onto a different phone and used in other areas for making calls without paying.

Cell phone cloning became possible with off-the-shelf technology in the 1990s. Three key items were needed. The first was a radio receiver, such as the Icom PCR-1000, that could tune into the Reverse Channel, which is the frequency that the phones transmit data to the tower on. The second item was PC with a sound card and a software program called Banpaia, and the third item was a phone that could easily be used for cloning, such as the Oki 900. By tuning the radio to the proper frequency, it would receive the signal transmitted by the cell phone to be cloned, containing the phone's ESN/MIN Pair. This signal would be fed into the sound card audio input of the PC, and Banpaia would decode the ESN/MIN pair from this signal and display it on the screen. The person could then input that data into the Oki 900 phone and reboot it, after which the phone network could not distinguish the Oki from the original phone whose signal had been received. This gave the cloner, through the Oki phone, the ability to use the mobile phone service of the legitimate subscriber whose phone was cloned just as if that phone had been physically stolen instead, except that the subscriber was not without his or her phone and was not aware that the phone had been cloned—at least until that subscriber received his or her next bill.

The problem became so large that some carriers required the use of a PIN before making calls. Eventually, the cellular companies initiated a system called RF Fingerprinting, where it could determine subtle differences in the signal of one phone from another and shut down some cloned phones. Some legitimate customers had problems with this though if they made certain changes to their own phone, such as replacing the battery and/or antenna. The Oki 900 was the ultimate tool of cell phone hackers because it could listen in to AMPS phone calls right out of the box with no hardware modifications.