View source for Engineering:Phone cloning

{{Short description|Copying of identity from one cellular device to another}}
'''Phone cloning''' is the copying of identity from one cellular device to another.

== AMPS cloning ==
Analogue mobile telephones were notorious for their lack of security.<ref name="ucb-1998-04-13">{{Cite web|url=http://www.isaac.cs.berkeley.edu/isaac/gsm-faq.html|title=GSM Cloning}}</ref> Casual listeners easily heard conversations as plain [[Physics:Frequency modulation|narrowband FM]]; eavesdroppers with specialized equipment readily intercepted handset Electronic Serial Numbers (ESN) and Mobile Directory Numbers (MDN or CTN, the Cellular Telephone Number) over the air. The intercepted ESN/MDN pairs would be cloned onto another handset and used in other regions for making calls. Due to widespread fraud, some carriers required a [[Personal identification number|PIN]] before making calls or used a system of [[Radio fingerprinting|radio fingerprinting]] to detect the clones.

== CDMA cloning ==
[[Image:Several mobile phones.png|thumb|right|A selection of mobile phones that can be cloned]]

[[Code-division multiple access|Code-Division Multiple Access]] (CDMA) mobile telephone cloning involves gaining access to the device's embedded [[File system|file system]] /nvm/num directory via specialized software or placing a modified [[EEPROM]] into the target mobile telephone, allowing the Electronic Serial  Number (ESN) and/or [[Engineering:Mobile equipment identifier|Mobile Equipment Identifier]] (MEID) of the mobile phone to be changed. To obtain the MEID of your phone, simply open your phone's dialler and type *#06# to get its MEID number.<ref>{{cite news | last = Bader | first = Daniel | title = How to make sure your phone works on a prepaid alternative carrier | url = https://www.imore.com/how-make-sure-your-phone-works-prepaid-alternative-carrier | work = iMore | date = March 21, 2017 | access-date = October 24, 2017}}</ref> The ESN or MEID is typically transmitted to the cellular company's [[Engineering:Mobile Telephone Switching Office|Mobile Telephone Switching Office]] (MTSO) in order to authenticate a device onto the mobile network. Modifying these, as well as the phone's Preferred Roaming List (PRL) and the [[Mobile identification number|mobile identification number]], or MIN, can pave the way for fraudulent calls, as the target telephone is now a clone of the telephone from which the original ESN and MIN data were obtained.

== GSM cloning ==
<!--SIM cloning redirects here-->
GSM cloning occurs by <s>copying</s> cracking a secret key from the victim [[SIM card]],<ref>{{Cite web|url=https://www.movzio.com/howto/cell-phone-cloning-guide/|title=What is Cell Phone Cloning - Everything You Need to Know|last=Gor|first=Mosam|date=2016-05-20|website=MovZio|language=en-US|access-date=2019-04-05}}</ref> typically not requiring any internal data from the handset (the phone itself).  GSM handsets do not have ESN or MIN, only an [[International Mobile Equipment Identity]] (IMEI) number.  There are various methods used to obtain the IMEI. The most common method is to eavesdrop on a cellular network.

Older GSM SIM cards can be cloned by performing a cryptographic attack against the COMP128 authentication algorithm used by these older SIM cards.<ref>{{Cite web |last=Preuβ Mattsson |first=John |date=Jun 29, 2021 |title=The evolution of cryptography in mobile networks and how to secure them in the future |url=https://www.ericsson.com/en/blog/2021/6/evolution-of-cryptographic-algorithms |url-status=live |archive-url=https://web.archive.org/web/20221221060751/https://www.ericsson.com/en/blog/2021/6/evolution-of-cryptographic-algorithms |archive-date=21 December 2022 |access-date=26 July 2023 |website=Ericsson}}</ref> By connecting the SIM card to a computer, the authentication procedure can be repeated many times in order to slowly leak information about the secret key. If this procedure is repeated enough times, it is possible to derive the [[SIM card#Authentication key|K<sub>i</sub>]] key.<ref>{{Cite web|url=https://www.youtube.com/watch?v=JFpLGDmcx2g|title=The Truth About SIM Card Cloning|last=Cycle|first=Janus|date=2023-01-13|website=YouTube|language=en-AU|access-date=2023-07-23}}</ref><ref>{{Cite web |last=Brumley |first=Billy |date=18 Nov 2004 |title=A3/A8 & COMP128 |url=http://www.tcs.hut.fi/Studies/T-79.514/slides/S5.Brumley-comp128.pdf |url-status=live |archive-url=https://web.archive.org/web/20230606232446/http://www.tcs.hut.fi/Studies/T-79.514/slides/S5.Brumley-comp128.pdf |archive-date=6 June 2023 |access-date=26 Jul 2023}}</ref> Later GSM SIMs have various mitigations built in, either by limiting the amount of authentications performed in a power on session, or by the manufacturer choosing resistant K<sub>i</sub> keys. However if it is known that a resistant key was used, it is possible to speed up the attack by eliminating weak K<sub>i</sub> keys from the pool of possible keys.

== Effectiveness and legislation ==
Phone cloning is outlawed in the {{wipe|United States}} by the Wireless Telephone Protection Act of 1998, which prohibits "knowingly using, producing, trafficking in, having control or custody of, or possessing hardware or software knowing that it has been configured to insert or modify telecommunication identifying information associated with or contained in a telecommunications instrument so that such instrument may be used to obtain telecommunications service without authorization."<ref>{{Cite web|url=http://beta.congress.gov/bill/105th/senate-bill/493|title=S.493 - 105th Congress (1997-1998): Wireless Telephone Protection Act|date=24 April 1998}}</ref>

The effectiveness of phone cloning is limited. Every mobile phone contains a [[Radio fingerprinting|radio fingerprint]] in its transmission signal which remains unique to that mobile despite changes to the phone's ESN, IMEI, or MIN. Thus, cellular companies are often able to catch cloned phones when there are discrepancies between the fingerprint and the ESN, IMEI, or MIN.{{Citation needed|date=March 2010}}

== See also ==
* [[Engineering:Dual SIM|Dual SIM]]
* [[International Mobile Equipment Identity]]
* [[Subscriber identity module]]

== References ==
{{Reflist}}

[[Category:Mobile technology]]

{{Sourceattribution|Phone cloning}}