The telephone supports 2 SIM cards. All functions are available for both SIM cards and have independent settings.

Transcription

1 Samsung C6112 telephone for protection of conversations against control via a GSM service provider as well as via active and semi-active GSM interception complexes, catchers. The telephone supports 2 SIM cards. All functions are available for both SIM cards and have independent settings. The telephone contains the following functions: LAC tracking Weak A5 Call ping SMS ping Channels lock Alerts Show TIMSI Clear call log One channel Fake SMS Check C2 Recording Reset settings Information: - automatic change of IMEI, protection against control via a service provider; - creation of a profile for a certain location that prevents a complex operator from catching your phone. - warning of decreased cryptographic protection with respect to A5.1; - detection of soundless calls; - detection of all types of hidden SMS and prohibition of all types of SMS that can harm the phone; - phone operation with the use of remote base stations; - choice of signals for events; - display of TIMSI on the telephone screen; - deletion of information about calls from the telephone memory; - detection of presence of one channel in the network and display of the channel number; - detection of SMS with a fake number; - detection of active complexes and catchers by C2 scanning of base stations; - automatic call recording; - reset to recommended settings; - display of the software version on the screen. If the phone detects one of enabled events, a sound alarm and/or a vibration signal is generated depending on the settings, the screen displays a message about the detected event and the SIM card associated with the detected event, the event is recorded in the log.txt file. The phone has no give-away signs that might have given away presence of the phone special functions. If you input a standard sequence of digits*#06#, the phone s own IMEI will be displayed, the same as on the label

2 of a different combination of digits. You can access a special menu with settings of extra functions only by inputting a special sequence of digits and a password. This has been done for a specific purpose, so that no one can understand that it is not a common phone. Because such knowledge can seriously help those who want to organize control of a subscriber with such a phone. The only thing in appearance that gives away this phone is an icon on the screen that is intended for visual control of the signal encryption level. Description and Purpose of Icons on the Screen. There is an icon on the phone screen that shows whether encryption is on or off and what encryption algorithm is used by the service provider. - A5.0 This icon shows that encryption is off. This may be in case if the service provider does not use signal encryption as a matter of principle or if the phone is inactive currently. - A5.0 This icon indicates that the service provider uses A5.1 encryption. Encryption is on only when the device communicates with the base station, for example making a call, sending an SMS, accessing the internet, etc. - A5.2 The icon turns yellow and number 2 appears to the right of the lock icon, this means that the service provider switched on A5.2 encryption.

3 IMEI IMEI change function* is intended mainly for protection of calls against control via the service provider, but it can also protect against intercept complexes temporarily. *Use of this function is permitted not in all countries. THIS FUNCTION IS EFFECTIVE ONLY IN CONJUNCTION WITH SIMULTANEOUS CHANGE OF THE SIM CARD! When control of your phone is organized, the following identifiers are used: 1. Your telephone number (it is not sent over the air, but the service provider knows it); 2. IMSI a unique name of the SIM card; 3. IMEI a unique name of the phone. If you change the IMEI and the SIM card and use a SIM card that you have purchased anonymously or that is registered in the name of another person, you change all the identifiers that may be used to control you. That is why the service provider does not know who should be put under control. And it will take much effort to find your new SIM card. If you change only your SIM card or only the IMEI, it will not give you the required result and you will still be controlled, as if you did not change anything! If you are controlled by interception complexes, then simultaneous change of the IMEI and the SIM card will allow you to escape from control for a while. Because you change all your identifiers included into the complex selection list and the complex operator will have to make an extra effort to find out your new identifiers, in particular by pinging, pinging will allow detection of the phone. Besides, the complex operator cannot at once realize that it has lost control over your phone. Active interception complexes may work incorrectly with different models of phones and that can result in additional signs for its detection. For example, testing of Samsung G600 device with software released in October of 2014 only with the IMEI change function has showed at one of the active complexes that when the phone enters the complex coverage area, its behaves normally in its appearance, in particular the signal level is visible. But it is not possible to make a call and it does not receive incoming calls. Note: In order to check the factory IMEI of the phone, use a standard combination: *#06# In order to check the IMEI that has been actually sent to the service provider upon the last request, use the following combination: #*1300# A secret combination for access to the EXTRA menu: *#хххххххх#, to be provided by the seller:. Menu of the IMEI Change Function with Five Modes: The phone supports two SIM cards. The IMEI change modes are used for both SIM cards independently. If the phone has only one SIM card, then the IMEI menu will immediately show settings of operation modes. If the phone has two SIM cards, then the IMEI menu will at first show the MASTER and SLAVE windows. Upon generation of a random IMEI, the first and second digits remain constant as well as the seventh and eighth digits, this is done intentionally to make IMEI resemble a real one.

4 Random always: In this mode the phone IMEI changes upon each inquiry by the service provider. An IMEI enquiry by the service provider may be received upon turning on of the phone, upon sending of an SMS, making a call or work in GPRS. The phone IMEI will change upon each enquiry by the service provider. This mode is not recommended for constant use. If you do not change the SIM card, and your IMEI is constantly changing, this will attract attention of those who control your phone, if your SIM card has become the object of attention. It will be seen that you use a new phone for each new call and this looks suspicious. New SIM: In this mode the phone IMEI changes only upon change of the SIM card. The phone IMEI will be generated once, and the phone will send it upon each enquiry by the service provider. This mode is recommended for constant use.

5 Random on first request: In this mode the phone IMEI changes only once after turning on of the device. In the following the phone will send this IMEI in response to all enquiries of IMEI by the service provider. When you turn on the device again, the IMEI will change again and will remain constant until new turning on of the device. This mode is recommended for constant use.

6 User define: In this mode the phone IMEI is defined by the user. For this you need to go down in the menu and in the Custom IMEI field input manually any IMEI. Stay original: In this mode the phone IMEI always remains original. If you go down in any window of the IMEI menu, a window will open, where you can enter the name of the service provider to be displayed on the phone screen.

7 LAC tracking In this mode the user can create a profile for a specific location. When you use this menu command, the phone automatically saves important parameters for a specific location in a profile. The user can select a desired channel depending on its strength. When the user gets back to this location, a hot button allows quick selection of a desired profile, for example a "work" profile. After selection of the desired profile, when an active complex tries to intercept you, it cannot do this. In the Tracking mode menu you can select a desired mode of operation of the phone. Either in the preset LAC or in the preset LAC and preset channel. In the Monitor menu you can see the available channels and the LAC to which they belong.

8 Weak A5 This function is intended for protection of the user from monitoring of his/her calls via active GSM interception complexes. An active interception complex is equipment that emulates a base station and makes phones operate through this equipment (a false base station) instead of a real base station. A real base station considers a false base station as a common telephone. A modern interception complex can obtain full control over an intercepted telephone, in particular: 1. Turn off encryption; 2. Decrease encryption level; 3. Do not change the encryption level, when it has A5.1 processor. There are no any other means, except this device, that would be able to detect such complexes. Currently the most common interception complexes are those which lower the level of encryption either permanently or temporarily for deciphering of the session key, after that encryption becomes the same as that used by the service provider. There are active complexes which do not lower the level of encryption; they have a built-in A5.1 processor. Weak A5 function is not intended for detection of such complexes. For this purpose there are such functions as Channel lock, One channel, Check C2 as well as other means which prevent the operator from interception of the phone. Earlier semi-active complexes were widely spread; they used to turn off encryption only for a specific controlled phone. Operation of an active complex: A car may drive up to the building, in which there is a person to be listened, or equipment may be permanently installed in such a building. A telephone automatically selects the base station with the strongest signal. A false base station becomes such a station for the controlled telephone. The telephone takes it for a real base station and start operating with it. The complex operator obtains full control over your telephone. He can not only listen to your conversations and read your SMS, but also control your phone. The possibilities of the complex to control your phone depend on its model. There are complexes which can remotely turn on the phone microphone. А5.1 algorithm is the most resistant to decryption. A5.2 is weaker and can be decrypted in real-time. Work of Weak A5 function: If you enter the area of coverage of a false base station and the phone receives a command to lower the encryption level relative to A5.1, the alarm method chosen by the user will be used. Thus you will be warned

9 Call ping This function is intended for warning the user about an attack by hidden calls. As an active complex has a limited number of channels, normally it controls only the subscribers included into its selection list. To this end the complex operator needs to know the permanent identifiers of your phone, IMSI, IMEI which are transmitted in the network and which can be included by the operator into the selection list of the GSM interception complex. In order to get these parameters the complex makes hidden calls to your phone. Such calls are interrupted before the phone starts ringing, but after the phone transmits its identifiers. In a real situation from 5 to 15 hidden calls are made in order to make sure that it is the controlled phone that responded. After their receipt IMSI and IMEI are included into the selection list of the GSM interception complex and only after that the complex can perform selective control of subscribers. The menu of the PING function is shown in the picture below. To setup the Ping function, enter the Call ping settings menu and select Mode Enable (Включено). The Pings before alert parameter determines the quantity of hidden calls, which make the phone decide that it is being pinged and turn on a sound alarm. The Interval between pings parameter determines time in seconds, during which pings by hidden calls are to be detected. This mode works as follows: for example, the following settings are input: Pings before alert 1 Interval between pings - 15 This means that only after two hidden calls a sound alarm will be generated, the Ping number displayed on the device screen will increase and the event will be registered in pinglog.txt. The second hidden call must be received within 15 seconds after receipt of the first hidden call. After receipt of the first hidden call the device starts counting seconds and if a second call is received before expiration of 15 seconds, the device considers that hidden calls are made. It turns on a sound alarm, increases the Ping number on the device screen by one and records this event in pinglog.txt file. If there is no such file in the device, it will be automatically created. If a second call is not received within 15 seconds, the device considers that it is not a Ping but a false activation, for example exchange with the base. Therefore, a sound alarm is not generated, the Ping number on the device

10 screen is not increased, nothing is recorded in pinglog.txt and the device again starts counting 15 seconds waiting for the second call. When hidden calls to your phone are made, the interval between calls is usually minimal. Therefore, if the Interval between pings parameter is set to 15 seconds, that will be enough to determine that you are really being pinged and at the same time there will be no false alarms, for example false alarms connected with the data exchange with the base station. The phone also maintains a log.txt file, in which all PING events are recorded. log.txt contains information about the event date, time, the telephone number, from which the attacks of your mobile phone were made, the cell ID, the channel number, the last digit indicates the approximate command, upon which the call was interrupted. In order to view the file, download and view it on a computer. The device may fail to determine the telephone number, from which an attack of your phone is made, for two reasons: 1. A call is made from an unidentifiable telephone number; 2. A call is terminated before the service provider transfers the telephone number, from which a call to your phone is made. SMS ping The function allows detection of pinging of your phone by hidden SMS. GSM standard provides for SMS, which are received by the telephone soundlessly, they are not shown in the list of incoming SMS and no sound is generated upon receipt of such SMS. It is convenient to use such SMS for pinging, because they will be received for sure by any telephone without any give-away signs. In such a case the telephone sends permanent identifiers, such as IMEI and IMSI, to the service provider. Our phone warns the owner of receipt of ALL kinds of hidden SMS. There are also different types of SMS that can potentially harm your phone's security. For example, you can receive an SMS, which will be received openly and with text. But after sending to your phone of a second SMS the first one will be deleted and instead of the text of the first SMS you will see the text of the second SMS. That is your phone is controlled without your knowledge. You can also receive an SMS, after which malicious software will be installed on your SIM card. Our phone detects such SMS and blocks such SMS at the stage of receipt and they cannot harm your phone.

11 Channels lock This function is intended for protection of the user from control via active complexes, in particular those with a built-in cryptographic processor, and via passive GSM interception complexes with a built-in cryptographic processor. In this mode the phone does not warn that is being controlled, but it protects you against control. Passive GSM interception complexes are only receivers, they do not transmit anything. It is impossible to detect activity of a passive complex! Active complexes with a processor are among the best interception complexes. Such a complex does not change the encryption algorithm, it can emulate all characteristics of the real base station, in which it operates and which it emulates. If the real base station operates in a frequency hopping mode (HOPPING), then in the area of coverage of such false base station your phone will operate in a frequency hopping mode. It is difficult to detect operation of such a complex. Only our unique phone can protect you against control! To configure the phone select the Channel lock item in the EXTRA menu. The Channels selection allows selection of one of the four modes of the device operation: 1. Number 2. Position 3. Position + CellID 4. Disable Number is the phone operation mode, when you set a specific channel number, from which the phone will make calls. Attention! This mode becomes active only after restart of the device! In order to select a channel number you need to go to the bottom line Channel number and press the button in the middle of the joystick. You will see a list of channels available in your location. The first channel in the list is the strongest one; it is

12 Select any channel, but it is important not to select the first channel in the list. It is better to select the last channel, but it can happen that you will not be able to make calls from this channel due to poor quality of communication. In such a case select the last but one channel. Click Select and Save in the other window. The settings take effect only after the phone is turned off. When the phone is turned on, it immediately registers not in the strongest channel as in the normal mode, but in the preset channel. Protection of the phone owner in this mode against control. If you are near a false base station, then such a false station is the strongest one for the phone in this location. That is the principle of operation of such a complex to be the strongest cell in a specific location to make a phone operate in it. When you configure your device to operate with a remote base station instead of the strongest base station, prevention of such a control is guaranteed. Even if the complex does not change the encryption level and has A5.1 processor. The operator of the interception complex will see only that you turn off your phone. He will not know that later you turn on your phone and work with the phone, because the phone immediately registers in a remote cell. The complex operator will not see even that you turn off your phone, if you remove the battery from the operating phone. In such a case the operator will realize after a while that he has lost control of the phone and will have to try to find you by pinging. He will not be able to find you because: 1. The phone will warn you about pinging. 2. The device will answer all hidden calls in a remote cell, which is not controlled by the complex. As a result of pinging the complex operator will not receive any information from your phone and the pinging process will be long. This is a very reliable way to escape from control without leaving a trace the in interception complex. A disadvantage of this method is that when you move to another location, the phone may be unable to see the preset channel and the network connection will be unavailable for the device. Therefore, in a new location you will need to select a new channel. In this mode of operation the communications service provider will not be able to determine your location accurately, as the phone is visible to only one base station. Position is the phone mode of operation with the use of a channel with preset strength. Attention! This mode becomes active only after restart of the device! In this mode we can make the phone operate not with the strongest channel, which may prove to be a false base station, but with a weaker channel. For example, we want the device to operate always with the use of the third channel by strength. For this purpose we input settings in the Position menu item, select the third channel by strength and the phone will always operate in the third channel by strength.

13 The device constantly checks what channel in a specific location is the third channel by signal strength. And the phone will automatically select it for use. In order to configure the device for operation in the Position mode, enter Extra - Channels and select Position. Use the phone joystick to go down and select the Channels position. Press the middle button of the joystick. A window opens with a list of channels available to your phone. Select a channel near the end of the list. Click Select and Save in the other window. Now the phone will always operate with the use of the channel selected by strength. Position + CellID is the phone mode of operation with the use of a channel with preset strength. This mode is intended only for outgoing calls. Attention! This mode becomes active only after restart of the device! This mode of operation is fundamentally different from the Position mode. In the Position + CellID mode the device most of the time is in the strongest channel and only for the time of an outgoing call goes into the channel with preset strength. After the end of the call the device returns into the main channel. This mode of operation is intended for making secure calls with the use of a remote channel and thus for creation of problems for the operator of the GSM interception complex. Incoming calls will be in a strong channel, i.e. they will possibly be controlled by the complex. But all outgoing calls will be lost for the operator of the complex, although he will believe that he has everything under control. In the Position + CellID mode the phone automatically compares the ID of the strongest channel with the ID of the channel in which it makes a call. If the ID coincides, the call will be automatically interrupted. This is intended for protection against control by a multi-channel complex. Alerts In this menu the user can set the phone s response to various events. There are four items:

14 Call&SMS ping is used to preset the phone's response to pinging by hidden calls and hidden SMS. One channel is used to preset the phone's response to a situation when the phone receives a list with one channel. The phone every 5 seconds receives a list of channels. In a city this list as a rule includes many channels, if suddenly the phone can see only one channel, while you are in a city, it is strange. As a rule complexes do not allow the phone to see other channels so that the phone did not operate with such other channels. LAC changed is used to preset the phone's response to changed LAC. All active complexes in order to catch a telephone, provide another LAC to it, which is different from the original one for the given service provider in a given location. This mode has lost its significance, when the LAC tracking function has been added.

15 C2threshold is used to preset the phone's response to a situation, when the phone receives С2 parameter exceeding the preset value. Show TIMSI This function can be enabled for displaying a temporary TIMSI number on the screen. Clear call log If this function is enabled, the phone automatically clears the log of outgoing and incoming call numbers. But the information stored on the SIM card at the same remains intact. In order to prevent falling of such information into wrong hands, be sure to use a PIN code set for your SIM card. If a PIN has already been set upon sale of the SIM card, it should be changed to another one.

16

17 One channel Active complexes upon capture of a telephone prevent it from seeing adjacent channels and leave only one channel in which they work themselves to make the phone operate in that channel only. The One channel function allows detection of such a situation. The screen also displays the number of the channel that is the only channel in the list and that is a disguised interception complex. False operation of this function is possible, if you are in a location, where there is actually only one base station, for example in a field or in a basement. Fake SMS If this function is enabled, the phone detects SMS with fake numbers. SMS with fake numbers are often used by fraud artists. Check C2 The phone is able to detect a modern active interception complex before it is captured by such a complex. For this purpose the phone constantly scans base stations and gathers statistics on C2 parameter. The phone estimates this parameter in order to make a decision to move to another channel. The complex operator makes this parameter higher, approximately times higher than the maximum value for a normal cell. That is how a complex with a level of signal even lower than that of a normal base can capture a telephone. Typically the complex operator raises the value of C2 to 80-90, while the normal value is Thus, the phone scanning the base stations is able to detect a complex or a catcher that is somewhere nearby as well as to determine what channel is emulated by the complex.

18 If the phone is captured by a complex, it will show a high value of C2 as well as the number of the channel with that C2 value. If the numbers of channels in items Check С2 and One channel coincide, it means that the phone is for sure captured by a complex. This item contains 4 sub-items: 1. Block C2 is used to set the mode in which the device ignores high value of C2. 3. Reset statistics is used for reset of gathered statistics. 4. Statistics item shows gathered statistics on С2, the first line shows the detected maximum value of C2 as well as the number of the channel with that value of C2.

19 5. Alert threshold is used to set the upper threshold of C2, above which an alarm is generated by the phone. Recording This function is intended for automatic recording of conversations. Records may be made to the built-in memory of the phone as well as to an external memory card. In order to configure the Recording function, select whether the automatic conversation recording function is to be enabled (Включено) or disabled (Выключено) in the Recording mode (Режим записи) field. In the Saving by default (Сохранение по умолчанию) field select the memory for saving of conversation records. You can also enable memory low and memory end warnings.

20 Reset settings This item allows reset of your menu settings to the settings recommended by the manufacturer. Information In this menu item the phone displays the software version and release date. So that the user knows whether an update is required.