Editing Advanced Mobile Phone System (section)

==Cloning==
[[File:2007Computex e21Forum-MartinCooper.jpg|thumb|[[Martin Cooper (inventor)|Martin Cooper]] of Motorola in 2007, reenacting the first private handheld mobile-phone call on a larger prototype model in 1973.]]
In the 1990s, an epidemic of "cloning" cost the cellular carriers millions of dollars.<ref>{{cite news |last1=O'Malley |first1=Kathy |title=COSTLY CELLULAR PHONE FRAUD RISES WITH NUMBER 'CLONING' |url=https://www.chicagotribune.com/news/ct-xpm-1995-03-19-9503190163-story.html |access-date=June 18, 2019 |work=Chicago Tribune |date=March 19, 1995}}</ref> An eavesdropper with specialized equipment could intercept a handset's [[Electronic Serial Number|ESN]] (Electronic Serial Number) and MDN or CTN (Mobile Directory Number or Cellular Telephone Number). The Electronic Serial Number, a 12-digit number sent by the handset to the cellular system for billing purposes, uniquely identified that phone on the network. The system then allowed or disallowed calls and/or features based on its customer file. A person intercepting an ESN/MDN pair could clone the combination onto a different phone and use it in other areas for making calls without paying.

Cellular [[phone cloning]] became possible with off-the-shelf technology in the 1990s. Would-be cloners required three key items :

# A radio receiver, such as the Icom PCR-1000, that could tune into the Reverse Channel (the frequency on which AMPS phones transmit data to the tower)
# A PC with a sound card and a software program called Banpaia
# A phone that could easily be used for cloning, such as the Oki 900

The radio, when tuned to the proper frequency, would receive the signal transmitted by the cell phone to be cloned, containing the phone's ESN/MDN pair. This signal would feed into the sound-card audio-input of the PC, and Banpaia would decode the ESN/MDN pair from this signal and display it on the screen. The hacker could then copy that data into the Oki 900 phone and reboot it, after which the phone network could not distinguish the Oki from the original phone whose signal had been received. This gave the cloner, through the Oki phone, the ability to use the mobile-phone service of the legitimate subscriber whose phone was cloned – just as if that phone had been physically stolen, except that the subscriber retained his or her phone, unaware that the phone had been cloned—at least until that subscriber received his or her next bill.

The problem became so large that some carriers required the use of a [[Personal identification number|PIN]] before making calls. Eventually, the cellular companies initiated a system called RF Fingerprinting, whereby it could determine subtle differences in the signal of one phone from another and shut down some cloned phones. Some legitimate customers had problems with this though if they made certain changes to their own phone, such as replacing the battery and/or antenna.

The Oki 900 could listen in to AMPS phone-calls right out-of-the-box with no hardware modifications.<ref>Takedown, {{ISBN|0786862106}}, Tsutomu Shimomura John Markoff – Shimomura describes demonstrating a shrink-wrapped the Oki 900 during courtroom testimony</ref>