Wireless Phones, Part 1 by Mr. Icom Updated: 4/17/87 Introduction: ============= While there have been many files dealing with mobile phones, all that I've seen have had inaccurate or incomplete information. This file will inform the phreak about the various telephone systems currently in use: "Cordless" Phones, IMTS, Marine, Cellular, and Satellite trunks; hopefully giving the reader an insight on how they work, and perhaps how to control them. In Part I, I will discuss "cordless" phones. Cordless Phones =============== Cordless phones need no explanation, as most phreaks have one or two. However, there seems to be an unexplainable lack of accuracy as to the frequencies used on them. Cordless phones use two frequencies simultanisly for full-duplex communications. Currently, there are 3 frequency pair ranges used by cordless phones. The first is a 1.7 Mhz./49 Mhz. split. These are used by the first cordless phones. Where the base transponder transmits in the 1.7 Mhz. range, and the handset transmits in the 49 Mhz. range. The 1.7 Mhz. carrier uses the AC power lines in the house as an antenna(This is known as "Carrier Current" transmission). Because of this fact, the range was limited, and the connections generally sucked because of interference from the 60 Hz. power line frequency. While no more of these units are being made. They still can be had at tag sales/flea markets, and rip-off department stores like Caldors, Ames, and Jamesway. The frequencies (in Mhz.)are outlined below: Base Handset ===== ======= 1.705 49.830 1.735 49.845 1.765 49.860 1.795 49.875 1.825 49.890 It is also interesting to note that the above 1.7 Mhz. frequencies are also used by those "Wireless Intercoms" sold by Radio Shack. The second pair of frequencies is 46 Mhz./49 Mhz. All cordless phones today use these frequencies. The elimination of the bothersome 1.7 Mhz. side clears up interference, and also allows for a longer range. Another thing which the FCC did when allocation the 46/49 splits was include more channels to lessen interference from other phones. The frequencies are: Base Handset ====== ======= 46.610 49.670 46.630 49.845 46.670 49.860 46.710 49.770 46.730 49.875 46.770 49.830 46.830 49.890 46.870 49.930 46.930 49.990 46.970 49.970 It is interesting to note that the the 46 and 49 Mhz. range is also allocated for U.S. Government use, specificaly the military. This discrepency stems from two reasons. First, the FCC doesn't handle governmental allocations, an organization called IRAC(Intergovernmental Radio Advisory Commitie) does them. Second, the FCC feels that the range of cordless phones is so limited that it won't cause interference. The third pair of frequencies used is 49 Mhz./70 Mhz. These were used by cordless phones designed for export to foregin countries. While they are illegal, that doen't stop people from using them. "Crusing for dial tones" ======================== Back in the early days of cordless phones, the lack of security features on them made it easy for someone to take his handset, and drive/walk around the neighborhood, finding out how many dial-tones he could bring up. Nowadays, the addition of various things in order to prevent this make it very difficult. There are three major security features used in cordless phones. The first one disconnects the base transponder from the airwaves if the phone is put in its charger slot. While there is no way to circumvent this, keeping the phone in its charger slot appears to many people as a limitation of its mobility. Thus, many prople keep them lying around OUT of the charger slot, right by their side, so they don't have to run for the phone when it rings. Thus, their desire for convienence destroys the security. The second feature is a digital code which the handset sends to the transponder when it is brought off hook. The transponder checks the code, and if it matches, a dial tone is presented. This code is either preset at the factory, or user set by manipulating a couple of DIP switches. While the changing of the code on preset units would reqiure you to go inside the machine, and clip/add a few diodes. With the user set ones, all one would have to do is try every code till you get a dial-tone. Most sets have 4-8 switches for the security code. This comes out from 8 to 255 different combinations. The security code is transmitted via a digital tone, similiar to that used by IMTS signaling.(More on that in a future volume.) To hear what I'm talking about, get your handset and a scanner. Tune your scanner to your handset frequency, and bring your handset off hook. As you bring it off hook, you should hear a bleeping tone. That is the security code being transmitted. Now, if you had a slightly modified 6 meter ham transmitter, and lived fairly close to your neighbor with a cordless phone. You could possibly record his security code, and play it back through your transmitter, thus sucessfully impersonating his handset. While I don't know of any compatibilities between cordless phone security codes at this point, if I hear of any, they will be posted in a revision of this article. The third security feature was designed, and marketed just recently, this security feature is complete digitizing of the phones audio using Pulse Code Modulation, very similiar to what's used on digital trunks. Increasing Your Range ===================== Once cordless phones came out, someone got the bright idea of extending its range. Most people think that some kind of amplifer can be built which would give you more power, and extended range. It isn't that simple. Since a cordless phone is a full-duplex radio link, an isolator is needed to keep the two transmitters seperate. Unless you had a degree in Radio Enginerring, your attempts at making this would most likely ruin the unit, and any sucessful attempts would make your cordless phone about 10 times its current size. However, there is another way to extend your range, and that is by assing an external antenna on your roof. This will only work with 46/49 Mhz. units, as this antenna will only bost the 49 Mhz. side on 1.7/49 Mhz. units. On those phones, the 49 Mhz. side is usually ok, and you'll still have to put up with the interference on 1.7 Mhz. In any event, you'll need 5 lengths of stiff wire(coathangers) 47 inches long, an SO-239 coaxial cable connector, and enough good quality(RG-8) coaxial cable to get from your phone to your roof. The cable should have a PL-259 connector on one end, and alligator clips on the other. Take the wire, and attach it to the SO-239 as shown: | Wire attached->| to center hole | | ^ Wire attached/===\ to outer / * \ holes----> / $ \ (ground) / | \ | | Coaxial | Cable --> | | Down to Base Unit ^ === SO-239 Connector * $ PL-259 Connector At the base Unit, attach the center conducter to the whip antenna, and attach the other connector to the chassis(ground). For those lacking in antenna building skills, there are also commercially availible units availible for about $50. IMTS ==== IMTS, or Improved Mobile Telephone Service is an automated telephone system which used to be the standard of mobile phones until cellular came along. IMTS uses the following frequencies (in Mhz.): Channel Base Freq. Mobile Freq. ------- ---------- ------------ ZO 35.26 43.26 ZF 35.30 43.30 ZH 35.34 43.34 ZM 35.38 43.38 ZA 35.42 43.32 ZY 35.46 43.46 ZR 35.50 43.50 ZB 35.54 43.54 ZW 35.62 43.62 ZL 35.66 43.66 1 152.03 158.49 3 152.06 158.52 5 152.09 158.55 7 152.12 158.58 9 152.15 158.61 11 152.18 158.64 13 152.21 158.67 JL 152.51 157.77 YL 152.54 157.80 JP 152.57 157.83 YP 152.60 157.86 YJ 152.63 157.89 YK 152.66 157.92 JS 152.69 157.95 YS 152.72 157.98 YR 152.75 158.01 JK 152.78 158.04 JR 152.81 158.07 There are also frequencies allocated in the UHF Range. The base frequencies are posted below. The mobiles operate 5 Mhz. above the base frequency. Thus, the mobile frequency for channel 21 is 458.025. 21 454.025 22 454.05 23 454.075 24 454.10 25 454.125 26 454.15 27 454.175 28 454.20 29 454.225 30 454.25 31 454.275 32 454.30 33 454.325 34 454.35 QC 454.375 QJ 454.40 QD 454.425 QA 454.45 QE 454.475 QP 454.50 QK 454.525 QB 454.55 QO 454.575 QR 454.60 QY 454.625 QF 454.675 Of all these frequencies, the VHF-high band ones are the most popular. If you live within 25-50 miles of anything resembling a a moderatly sized town, you will have at least 1 VHF-high band channel availible. VHF-low band channels are used primarilly in rural areas, and those with mountainous terrain. UHF channels are being used in cities where the VHF channels are getting crowded. If you live in a major city, expect to have most, if not all these channels availible to you. IMTS Signaling: IMTS signaling is accomplised by in-band signaling tones from 1,300 hz. to 2,200 hz. Two Single frequency tones are alternated, much like ASCII modem tones, to produce the digits for the ID number, and destination number. The tones are as follows. Base tones: Idle - 2,000 hz. - used to indicate an availible channel. Sieze - 1,800 hz. - sent as an acknowledgement by the base that a channel has been taken. Mobile Tones: Guard - 2,150 hz. - used when the mobile goes off-hook to sieze a channel, as the "space" tone when sending the ID and destination number, and to acknowledge an incomming call. Connect - 1,633 hz. - used to "pick-up" and incomming call, and as the "mark" tone in sending the ID and destination number. Disconnect - 1,336 hz. - used to disconnect. To originate a call, the mobile sends 350 ms(milliseconds) of guard tone followed by 50 ms of connect tone. The base then sends stops sending the idle tone, stays quiet for 250ms, and sends 250ms of sieze tone. The mobile sends 190ms of guard tone, and sends the ID number at 20 pulses per second. The ID number consists of the subscribers A/C and phone number. The pulses consist of 25 ms of connect tone, follwed by either 25ms of silence or guard tone, depending if the digit is odd or even. The interdigit interval is either 190ms of silence or guard tone, depending on weither or not the last digit was odd or even. Once the ID is sent, dialing is accomplished by sending alternating connect and guard tones at 10 pulses per second. A pulse is 60ms of connect tone, followed by 40ms of guard tone. To disconnect, send 750ms of disconnect tone. Getting an IMTS phone: There are many ways to get an IMTS phone. They can be bought from electronic surplus dealers, however these may need some work, and you'll have to figure out how to reprogram the thing. I've also seen the ID circutry torn out of them when sold as surplus in order to keep people from doing what you're about to do. Your best bet is to go to a hamfest/electronic fleamarket, and pick up a business band mobile radio. These are surplus units capabile of transmitting in the 150-174 Mhz. range. While these units are often modified by hams for the 2 meter(144-148 Mhz.), or 3/4 meter (440-450 Mhz.) band. They can be modified back for the business band. All that most of these units require to be brought into the IMTS band is the proper crystal, and the retuning of a capaciter or two. This, along with a cheap VHF-high band reciever makes a full duplex radio setup. (Be sure to use headphones with the reciever to avoid feedback!) Now you need to duplicate the tones. There are two ways to do this. The easiest, and most versatle is to use a computer, and generate the tones, but since few computers with tone generating capabilities are portable, an alternate method must be found. By wiring up an ordinary phone dial to a dual tone audio oscillator, one can duplicate a mobile phone dialer. Plans for this unit can be found in 2600 magazine.(See end of file.) With your "IMTS Box.", you can either tape an ID number off the air, or generate one with your computer. To use your homebrew IMTS phone, find a channel that has an idle tone on it, send your connect and ID tone sequence, dial your number, and you're connected. Marine Band =========== The marine telephone band is for ships at sea to communicate with landbased telephones. A marine band telephone call is put through by finding an unused frequency, calling the marine operator, and giving her your callsign and phone number to call. The frequencies are as follows (in Mhz.). Channel Ship Freq. Shore Freq. ------- ---------- ----------- 24 157.20 161.8 84 157.225 161.825 25 157.25 161.85 85 157.275 161.875 26 157.30 161.90 86 157.325 161.925 27 157.35 161.95 87 157.375 161.975 28 157.40 162.00 Marine Band Radiotelephones: While you could take your business band radio, and put in marine band crystals, Marine Radiotelephones are easily availible, and somewhat inexpensive ($100-$300 for a decent radio with VFO, memories and 25 watts). Some places may ask you for a marine license, which is no problem. Just write to the FCC, and they will send you an application, there are no requirements. Before using your radio, listen on the telephone channels for a contact by another ship, and copy down the callsign used. Wait a while, and then feel free to use the callsign to place a call. DO NOT USE YOUR OWN CALLSIGN IF YOU GOT ONE! If you do, expect to pay for a buck a minute minimmum call. Marine telephone is one of the easiest ways for "wireless" communications, however, it still presents the same dangers as IMTS phreaking. Ham Radio Autopatch and the Simpatch ==================================== Autopatch is a function put on many ham repeaters allowing the use of a phone-line over the air. While one could phreak using an Autopatch, I advise you not to, as there is usually a control operator monitoring the machine. (Some do it 24 hours a day.), and any attempts at hacking an access code will probally be noted. Being a Ham, I'm not going into the subject of Autopatch any further than this, as there are better ways to phreak, and Ham's are helpful people(Some are even phreaks!) whom you can get assistance on technical matters. In short, don't fuck with Autopatches! However, along the lines of an autopatch is something called a Simpatch, which is a simpler version of an autopatch designed for use with a ham transciver. This device makes a wonderful extended-range cordless phone when hooked up into a can. It's major drawback is that it's expensive, but anyone with a little electronics backround can probally build one. A simpatch can also be used with CB's, or just about any other radio. A good idea for an extended range cordless phone would be a simpatch, and two CB walkie talkies. One CB would be connected to the Simpatch connected to the can and accessed via the second walkie talkie. The entire setup could be hidden in a tree and using a wire antenna (dipole of 1/4 wave vertical) for a range of 5-20 miles. Conclusion ========== Acknowledgements: 1) Mobile Phones-Theory and Construction. by The Reasearcher. 2600, April 1986 Availible from: 2600 Magazine P.O. Box 752 Middle Island, NY 11953 Write for latest rates on subscriptions and back issues. 2) Understanding Telephone Electronics. Availible at Radio Shack 3) American Radio Relay League 225 Main St. Newington, CT 06111 (has free information on ham radio) Thanks go to The Datamaster, Peter Pulse, Bellcon, and The Surge for their assistance. -Mr. Icom March 29, 1987, Updated April 17, 1987 End of File.