I originally found this link in a thread on radioreference.com, to give credit where it's due. New software available to SmartNet & SmartZone system administrators to identify cloned radio ID's. It can even determine cloned radios on a SmartZone system without requiring simultaneous transmissions! Yet another reason to get a scanner...
http://mrtmag.com/news/genesis_motorola_clones_082405/
Todd
New clone detection software
Moderator: Queue Moderator
New clone detection software
Last edited by wavetar on Mon Oct 24, 2005 4:12 am, edited 1 time in total.
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.
Welcome to the /\/\achine.
Welcome to the /\/\achine.
Clone detection software..
Greetings:
That software has been in use for over a decade in the cellular industry to identify cloned cellphones by the RF signature of the legitimate cellphone's 'RF ID' that the software has 'on file' at the switch.
When I was a cellsite tech oh-so-many years ago, they were bringing this software into play in the large MSA's like NY and Atlanta and LA to identify the large numbers of cloned ESNs from bootleg phones.
The ESN readers (when they were available) were quite portable and the bootlegger could stand on an overpass and log ESNs, MINs and a host of data simply by picking the signals out of the ether and the victims never knew they were targeted until the huge bill arrived that is.
What was done was to place a call with the legit handset, then the software had a baseline signature to store that can be used as a reference throughout the network, and when a cloned phone placed a call, the software would automatically register the ESN and MIN of that phone and 'look up' the stored signature and compare it to the in-use phone's signature.
If the stored file does not match the in-use phone's signature, the phone was locked out of the system permanently and that number was blacklisted until it was cleared by the legit user making contact with the carrier and explaining what happened.
The drawbacks were many as customers began phone swapping more often, and the sotware was never designed for handset churn, so many people started getting shut down and never knowing how or why they were being cut off.
New handsets required a new signature being stored, and carriers did not like to go through the hassle of this every day with hundreds to several thousands of users on their networks.
It was a great idea and still is for SMR as well as any TRS, but not cost effective for large carriers like Alltel or Sprint Etc......
Too many troubles with almost no rewards, plus the software was difficult to get updates for and cost more than the value of dropping one or two bootleggers off the radar screen of the network/switch operators.
That software has been in use for over a decade in the cellular industry to identify cloned cellphones by the RF signature of the legitimate cellphone's 'RF ID' that the software has 'on file' at the switch.
When I was a cellsite tech oh-so-many years ago, they were bringing this software into play in the large MSA's like NY and Atlanta and LA to identify the large numbers of cloned ESNs from bootleg phones.
The ESN readers (when they were available) were quite portable and the bootlegger could stand on an overpass and log ESNs, MINs and a host of data simply by picking the signals out of the ether and the victims never knew they were targeted until the huge bill arrived that is.
What was done was to place a call with the legit handset, then the software had a baseline signature to store that can be used as a reference throughout the network, and when a cloned phone placed a call, the software would automatically register the ESN and MIN of that phone and 'look up' the stored signature and compare it to the in-use phone's signature.
If the stored file does not match the in-use phone's signature, the phone was locked out of the system permanently and that number was blacklisted until it was cleared by the legit user making contact with the carrier and explaining what happened.
The drawbacks were many as customers began phone swapping more often, and the sotware was never designed for handset churn, so many people started getting shut down and never knowing how or why they were being cut off.
New handsets required a new signature being stored, and carriers did not like to go through the hassle of this every day with hundreds to several thousands of users on their networks.
It was a great idea and still is for SMR as well as any TRS, but not cost effective for large carriers like Alltel or Sprint Etc......
Too many troubles with almost no rewards, plus the software was difficult to get updates for and cost more than the value of dropping one or two bootleggers off the radar screen of the network/switch operators.
When I was working at Alltel Mobile as a switch God, there was a nifty trick that would work in all of the EMX series Motorola switches.
If you told the SWITCH that the ESN for MID NPA-NXX-XXXX was [all zeros], all bandit checks (that's what clones were called back then) were disabled for that mobile-ID.
I had 4 phones programmed up on my mobile-ID. One in my work truck, one in my personal car and two a 6000 in a "Tuff-Talker" chassis and a flip-phone. When a call came in, they would all four ring. Whichever one was answered first got the call. Worked kinda like routing a VOIP call to multiple SIP phones works. The first one to answer gets the call.
Anyway, just brought back memories.
John
If you told the SWITCH that the ESN for MID NPA-NXX-XXXX was [all zeros], all bandit checks (that's what clones were called back then) were disabled for that mobile-ID.
I had 4 phones programmed up on my mobile-ID. One in my work truck, one in my personal car and two a 6000 in a "Tuff-Talker" chassis and a flip-phone. When a call came in, they would all four ring. Whichever one was answered first got the call. Worked kinda like routing a VOIP call to multiple SIP phones works. The first one to answer gets the call.
Anyway, just brought back memories.
John
-
wazzzzzzzzup
- Batboard $upporter
- Posts: 751
- Joined: Thu Oct 04, 2001 4:00 pm
- What radios do you own?: XTS3000/astro spectra/
way back in the early 90's one of the local analog cell providers offered a special option for maybe a year or so this was prob 1993-1994 they offered the option of having a customer to have 2 phones with the same number, but couldnt use the phones at the same time. and example as it was explained to me. a relator has a mobile and a portable cell, they use thier mobile when they are in the car, and when they get out, they shut off the mobile and turn on the portable and vice versa, but couldnt have both on at the same time. we sold this option generally to relators.k4wtf wrote:When I was working at Alltel Mobile as a switch God, there was a nifty trick that would work in all of the EMX series Motorola switches.
If you told the SWITCH that the ESN for MID NPA-NXX-XXXX was [all zeros], all bandit checks (that's what clones were called back then) were disabled for that mobile-ID.
I had 4 phones programmed up on my mobile-ID. One in my work truck, one in my personal car and two a 6000 in a "Tuff-Talker" chassis and a flip-phone. When a call came in, they would all four ring. Whichever one was answered first got the call. Worked kinda like routing a VOIP call to multiple SIP phones works. The first one to answer gets the call.
Anyway, just brought back memories.
John
think about how to ENCOURAGE Motorola learning safely with GRACE.....NOT condemnation.
Most definitely purchased seperately. For one, it's developed by a third party, not by Motorola. Also, regardless of how large a system you buy, Motorola won't even freely provide something as simple as 'system watch' software, let alone specialty 'clone catching' software.Gman wrote:Interesting.......I always wondered how they did that with cell phones.I wonder if this software is going to be part of the standard motorola admin package or it will have to be purchased seperatly...
Todd
No trees were harmed in the posting of this message...however an extraordinarily large number of electrons were horribly inconvenienced.
Welcome to the /\/\achine.
Welcome to the /\/\achine.
-
RADIOMAN2002
- Posts: 1102
- Joined: Thu Apr 04, 2002 4:00 pm
- What radios do you own?: More than I can count
I seen this software up close, at Dayton in 1996 or 7. They even showed the waveform on a spectrum analyzer. You could see the ring, that is the VCO searching back and forth untill a stable lock. Thats the signature. I wonder if it's really in use anymore. As far as finding you without affiliating, no go. the radio has to transmit to be found out as a bootleg.
I figured that since our software was being talked about, I might chime in! It is called CloneWatch. Ity really does work well. Yes, cellular has had it in a different form for a number of years and yes, it is far more complex than our solutiuon. It is also far more expensive than our solutiuon.
In SmartNet, we look for about 10 things to determine if a radio is cloned. In SmartZone, we add several more. The most significant addition to CloneWatch for SmartZone is IDD (Impossible Drive Distance). In other words, if a radio affiliates and keys on site 1 and 15 minutes later keys on site 5 that is 300 miles away.... duh! Yes, we have taken planes and helicopters into consideration.... but not teleporters
.
You can see more at:
http://www.genesisworld.com/cw/ This is not complete information, but it will give you an idea. It is in relase for SmartNet (and has already caught real clones and 'fat finger' clones that are programming mistakes) and will be out of SmartZone beta by Nov. 1st.
IMPORTANT FOR REBANDING:
You may THINK you have 1000 radios. CloneWatch along with our Rebanding reports will prove it to you. We helped find over 20 extra radios for one customer! Had he not checked, those 20+ radios would not have been reprogrammed!
In SmartNet, we look for about 10 things to determine if a radio is cloned. In SmartZone, we add several more. The most significant addition to CloneWatch for SmartZone is IDD (Impossible Drive Distance). In other words, if a radio affiliates and keys on site 1 and 15 minutes later keys on site 5 that is 300 miles away.... duh! Yes, we have taken planes and helicopters into consideration.... but not teleporters
. You can see more at:
http://www.genesisworld.com/cw/ This is not complete information, but it will give you an idea. It is in relase for SmartNet (and has already caught real clones and 'fat finger' clones that are programming mistakes) and will be out of SmartZone beta by Nov. 1st.
IMPORTANT FOR REBANDING:
You may THINK you have 1000 radios. CloneWatch along with our Rebanding reports will prove it to you. We helped find over 20 extra radios for one customer! Had he not checked, those 20+ radios would not have been reprogrammed!
~~~~~~~~~~~~~~~
Phil Burks, Pres.
Burks GenCore Co., Inc.
http://www.genesisworld.com
~~~~~~~~~~~~~~~~
Phil Burks, Pres.
Burks GenCore Co., Inc.
http://www.genesisworld.com
~~~~~~~~~~~~~~~~
-
afterimage84
- Posts: 151
- Joined: Mon Apr 14, 2003 5:09 pm