The Hindu Business Line : Shake off that shadow

Yasin was running an exchange illegally wherein he `cloned' Code Division Multiple Access (CDMA)-based mobile phones. He used software for the cloning and provided cheap international calls to Indian immigrants in West Asia.

Late last year, Ashwini Gaur was arrested by Punjab Police. Gaur copied the unique electronic security number used by a CDMA technology-based phone to another handset using a computer and data reader.

This enabled a second handset to have the same telephone number as the original set.

Welcome to, or rather wake up to, a new technology fraud, `mobile cloning'.

If you are receiving exceptionally high bills that cannot be explained, there is a very good chance that you are a victim of this activity.

The `how' of it

The modus operandi adopted by these criminals is not very complicated. Every mobile handset has a unique factory-coded Electronic Serial Number (ESN) and a Mobile Identification Number (MIN).

The crime starts when someone working for a mobile-phone service provider agrees to sell these security numbers to grey market operators such as Yasin.

The buyer then programs them into new phones which will have the same number as that of the original subscriber.

While Yasin used software called Patagonia to clone only CDMA phones (Reliance and Tata Indicom), there are software packages that can be used to clone even Global System for Mobile or GSM (e.g. Airtel, Hutch, Idea) phones.

There are also Internet sites that provide information on how one could go about hacking into cell-phones.

The man who is trying to clone your GSM phone just needs to know your International Mobile Equipment Identity (IMEI) or instrument number. The result is devastating for genuine mobile subscribers.

You could run up huge bills, and worse, your mobile phone number could be misused for criminal activities. The `cloned' mobile phone makes it all the more difficult for the investigating agencies to detect the crime. The worst is that the subscriber will have no inkling his number is being misused.

Delhi Police, for instance, recently caught a businessman who cloned the GSM phone of his rival and sent a hoax SMS to the police saying a Delhi VVIP would die in a blast.

Tip of the iceberg

While mobile cloning is an emerging threat for Indian subscribers, it has been happening in other telecom markets since the 1990s, though mostly with regard to CDMA phones. Pleas in an US District Court in 1997 effectively ended West Texas authorities' first case of `phone cloning.'

Authorities in the case estimated the loss at $3,000 to $4,000 for each number used. Southwestern Bell claims wireless fraud costs the industry $650 million each year in the US.

Some federal agents in the US have called phone cloning an especially `popular' crime because it is hard to trace.

Back home, police officers say the Yasin case is just the tip of the iceberg and have asked operators to improve their technology.

But the operators claim they can't do much for now.

"It's like stealing cars or duplicating credit card numbers. The service providers cannot do much except keep track of the billing pattern of the users.

But since the billing cycle is monthly, the damage is done by the time we can detect the mischief," says a Reliance executive.

Qualcomm, which develops CDMA technology globally, says each instance of mobile hacking is different and therefore there is very little an operator can do to prevent hacking.

"It's like a virus hitting the computer. Each software used to hack into the network is different, so operators can only keep upgrading their security firewall as and when the hackers strike," says a Qualcomm executive.

GSM-based operators maintain that the fraud is happening on CDMA, for now, and so their subscribers wouldn't need to worry.

Operators in other countries have deployed various technologies to tackle this menace.

There's the duplicate detection method where the network sees the same phone in several places at the same time.

Reactions include shutting them all off, so that the real customer will contact the operator because he has lost the service he is paying for.

Velocity trap is another test to check the situation, whereby the mobile phone seems to be moving at impossible, or most unlikely speeds.

For example, if a call is first made in Delhi, and five minutes later, another call is made but this time in Chennai, there must be two phones with the same identity on the network.

Some operators also use Radio Frequency fingerprinting, originally a military technology.

Even identical radio equipment has a distinguishing `fingerprint', so the network software stores and compares fingerprints for all the phones that it sees.

This way, it will spot the clones with the same identity, but different fingerprints.

Usage profiling is another way wherein profiles of customers' phone usage are kept, and when discrepancies are noticed, the customer is contacted.

For example, if a customer normally makes only local network calls but is suddenly placing calls to foreign countries for hours of airtime, it indicates a possible clone.

The Central Forensic Laboratory at Hyderabad has developed software to detect cloned mobile phones. The laboratory helped Delhi Police identify two such cloned mobile phones recovered recently. Called the Speaker Identification Technique, the software enables one to recognise the voice of a person by acoustics analysis, using a computerised speech laboratory machine. For the process, developed by Dr S.K. Jain, a voice sample of four seconds is adequate for an accurate result.

However, all these methods are only good at detecting cloning, not preventing damage. A better solution is to add authentication to the system. But this requires upgrades to users' and operators' equipment before they can be used.

This means upgrading the software of the operators' network, and renewing the SIM-cards, which is not an easy or a cheap task. Adding to users' woes is the fact that the sale of Patagonia or other software used for cloning is legal in the country. Consumer outfits want the Telecom Regulatory Authority of India to issue a directive that will make the operator responsible for any duplication of mobile phones.

For now though, while the operators and security agencies grapple with the menace, one would do well to watch out for that unexplained surge in the bill.

tkt@thehindu.co.in

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
Safe for use?

Shake off that shadow

Connect... when and where you want

No neat fit for definitions

Get the sole entry ticket

Come into my parlour...

YPOPs and Outlook Express errors

`My outsourcing experience'

You'll cotton on to this

Quiz

No eulogies to e-learning

Cartoon