Hack CellFone --- The using old Technique

Hack CellFone --- The using old Technique

Namaste



During 90s phones and modems were hacked using "AT" commands.

So i thought if we can hack cellfones using same old technique.



The same "AT" instructions work on cellfones as well, so imagine what if we can call someone or SMS someone using computer system.



Well what is the hack in it?



Imagine if u develop a virus/worm to exploit this functionality! Imagine if u want to earn money by forcing victims to SMS on 5 or 4 or 3 digit special numbers.

Or u want to grab someones password or credit card details in SMS on ur cellfones.



And the possibilities are infinite.



The hack is very simple and is versatile, i mean u can also call any number using just ur command console etc.



So let me demystify it..."vinnu"

Controlling Cellphones

Here in this topic I am not introducing any new technique,

but same old fashioned way the modems were hacked during

nintees.



Every microprocessor has instruction set, likewise, every

modem has AT command set. The AT stands for "Attention Telephone"

or "Attention Terminal".



Here in this topic I'll show u the ways to control the mobile phone

using AT commands. This is the way, u can develop ur own custom applications

to control the device or develop a virus/worm to exploit the mobile devices.



Test Phone : Nokia N72, SAMSUNG F270

For this purpose, it is necessary to treat mobile device as a modem and PC

treats the mobile device as a modem.



We can do it in several ways, from hyperterminal, command console,

vbscript, c/c++ etc and many more.



Now attach ur mobile phone to PC and then fire up hyper terminal from start\run

and type "hypertrm". Otherwise open from Accessories\communication.



when asked type any name and press OK.

Then from next dialogue either select from drop down list either Mobile name or

the com3 (any one, both point to mobile phone).



And from next window selet following settings "9600,8,None,1" and press Apply and OK.



Now in hyperterminal window type AT and press enter. If it shows "OK", it means u r

now connected to mobile device and it is ready to take commands.

General purpose AT commands are same you can search them online (elite hackers already know them),

but some commands are vendor and device specific.



Now, If u want to call any number then use the ATD or ATDT or ATDP command.



Note: Remember to always prefix "AT" to every instruction.



ATDT will use the tone dialing whereas, ATDP will use pulse dialing. ATD will use

the already set dialing either by "ATT" or "ATP". By default, it is tone dialing.



So if u want to call a number 9812312345 then use following:



ATD 9812312345



But this will envoke a data call (usefull for connecting to computer or servers or

dialup connection).



To start a voice call append a semicolon ";" to number as:



ATD 9812312345;



This will start a voice call.

Hack using command console..."vinnu"

But what if u want to call from ur command console, it is even more simple.

Start cmd.exe and fire up following command:



echo ATD 9812312345;>com3



This will start a voice call from command console.



Note: Check for com ports, in ur case, if u already have other devices connected even in USB, then ur com port may differ.

To kcow the signal quality u can use following command:



AT+CSQ



Ok What if i want to do same using a vbscript, open notepad and type following and save as "cellfone.vbs":



set mcom=CreateObject("MSCOMMLib.MSComm")

mcom.Settings="9600,n,8,1"

mcom.CommPort=3

'mcom.InBufferCount=0

mcom.PortOpen=True

If Err Then MsgBox "COnnection at " & mcom.CommPort & ": Failed" Else MsgBox "Dialing" End If

WScript.Sleep(3000)

mcom.Output="ATD 01892202799;" & CHR(13)

WScript.Sleep(2000)

mcom.PortOpen=False

set mcomm=Nothing

Note: Here i have to append integer value 13.

It will be converted into a carriage return (Enter Key---process the command).



Ok hat if we want to call using c code.



Ok from operating system's point of view, every port is a file so let us read com port as a file. And to send it a command we'll write in the openned file as:





/* fone.cpp */



#include < iostream >



using namespace std;



int main(int argc, char* argv[]) {



FILE *fp = NULL;

fp = fopen("com3","a");

if (fp != NULL) {

printf( "Dialing:...\n");

fprintf(fp,"atd 01892202799;\n");

fclose(fp);

}else printf("Failed");

return EXIT_SUCCESS;

}

Another program for reading the output as well:





/* controlfon.cpp */



#include < iostream >

#include < windows.h >



using namespace std;



int main(int argc, char* argv[]) {

char buffer[32];

FILE *fp = NULL;

fp = fopen("com3","a");

if (fp != NULL) {

fprintf(fp,"at+csq\n");

fp = freopen("com3","r",fp);

memset(buffer,0,sizeof(buffer));

for(int a=0;(a=fscanf(fp,"%s",buffer))>0;a=0){

printf("%s\n",buffer);

memset(buffer,0,sizeof(buffer));

Sleep(100);

}

printf( "Dialing:...\n");

fp = freopen("com3","a",fp);

fprintf(fp,"atd 01892202799;\n");

fclose(fp);

}

return EXIT_SUCCESS;

}

HAcking into SMS system..."vinnu"

Now comming on to SMS service:



Cellphones use two modes for operating on SMS:



1. PDU mode

2. Text mode



PDU : Protocol Data Unit but we will not use it for the sake of simplicity:

Text : This is the simplest way and most of developers use this way. We'll also use this way.



So let us start:



First of all, we need to set the sms mode, we can do it wsing AT+CMGF command and setting its value to 0 for PDU otherwise 1 for text mode as:



AT+CMGF=1



Then we'll use the AT+CMGS command then specify the target cell number (recipient) to send SMS to and then after pressing enter a ">" prompt will be shown, then write ur SMS and when finished, press +Z.



AS shown below:



AT+CMGF=1

AT+CMGS="09816163963"

>Type ur message here+Z

Note: In ur case the com port may differ, in my case one one fone is at com3 and another at com5 (Both are connected via USB data cable), check all of com ports like:



com3, com4, com5, com6...etc



And pass a command:

ATI

or ATI1

and check if ur cellphone's brand name is returned as :



NOKIA

or

SAMSUNG etc.

Posted in: mobile tricks