|
|
|
|
Phones ATF-1
B-Netz car telephone
The Becker AT160S was a car telephone
for the German B-Netz, the first
automatically-switched analogue mobile telephone network in the country.
The device was made by Telefunken
– as the 4015 – and was also sold by
Bosch
as the OF4 and by SEL
as the SEM96. B-Netz operated in the 150 MHz
band and was compatible with the systems in the Netherlands, Austria
and Luxemburg.
|
The device consisted of a black handset with a coiled cable, a
control box
with push-buttons and an LED display, and a main unit –
the actual transceiver
– which was so large and heavy that it had to be mounted
in the trunk of the car.
As the device was interoperable with the
Dutch ATF-1 network, many Becker
units were stolen or purchased in Germany, and illegally exported to the
Netherlands, where they were hacked and sold to
(mainly criminal) users.
The image on the right shows a nice example of a Becker AT160S, housed in a
black Samsonite suitcase of the era.
|
|
|
ATF-1 was the first automatically-switched mobile telephone network in the
Netherlands. It was introduced on 1 March 1980 as the successor to the
manually-switch OLN — Openbaar Landelijk Net (Public National Network).
Based on the German B-Netz, it operated in the 150 MHz band [1].
|
ATF-1 was interoperable with the networks in Germany, Austria and Luxemburg,
and had a maximum capacity of 2500 subscribers, that were served by 30
base stations throughout the country, as shown in the map on the right.
For outgoing calls, the mobile subscriber no longer had to to be patched by
an operator, but could simply enter the number on the numeric keypad of
the car phone. For incoming calls the situation was slightly more complicated,
as the country was divided into three regions – north, south and west –
and a caller had to know in which region the mobile user was located.
Apart from business users, ATF-1 also became very popular amoung inland
navigation skippers, as it could be used throughout a large part of western
Europe, along the entire trajectory of the river Rhine. For a long time
however, the use of mobile phones aboard ships was prohibited in the
Netherlands, and skippers risked a fine when they were caught.
The ban was lifted in 1988.
|
|
|
In 1985 and 1986 it became clear that the ATF-1 network was hacked
by so-called phreakers, who managed to make phone calls on
someone else's expence, or even free of charge, by using
number spoofing (see below).
When this was discovered, PTT
decided to upgrade all existing mobile stations with a BEMOTEL
authentication unit. Although this was reasonably successful, it was
a one-way authentication, that worked on outgoing calls only. After a
while, the phreakers discovered that it was still possible
to call free-of-charge by making collect calls [2].
The maximum capacity of 2500 users was reached in 1983, just three
years after the launch of the network, which prompted PTT to add a
new network
that had to be ready within a few years. In 1985,
ATF-1 was succeeded by ATF-2
which worked in the 450 MHz band and was based
on the NMT-450 standard of the Nordic countries. The ATF-1 service was
terminated in 1995.
➤ More about ATF-1
|
ATF-1 was a fully analogue FM system with in-band signalling, and no form
of encryption
or authentication whatsoever. Speech conversations were sent
over the air in clear, and could be picked up by anyone with a
suitable receiver
or scanner that covered the 150 MHz band (2m).
|
In the same vain, the telephone numbers of the calling party and the mobile
subscriber were sent over the air in clear, and it wasn't before long
that hackers discovered a way to
decode the data and display
it on a computer screen.
The weakest point in the system however, was the fact that the
telephone number of the mobile subscriber was only held inside the mobile
telephone, programmed on a so-called code-board inside the
main unit. The codeboard was usually configured by the telecom service engineer
who installed the device in the subscriber's vehicle.
|
|
|
By altering the arrangment of the wiring on the codeboard, it appeared
to be possible to change the telephone's subscriber number, after which it
was possible to make a call on someone else's expense. This led to complaints
from users who got huge bills for unmade phone calls.
|
Worse even: hackers also discovered that any phone number that had not yet been
issued by the PTT,
was unblocked, allowing them to make phone calls for which
nobody could be charged.
This soon led to a growing illegal business, in which many carphones were
ripped from the cars of genuine subscribers, converted by the hackers, and put
to use for (criminal) activities. The stolen telephones were built inside
common briefcases,
so that they could be carried around inconspicuously.
An example of a Becker phone housed inside a briefcase is shown on the right.
|
|
|
By adding a set of DIP-switches,
the user of the stolen phone was able to select any possible subscriber number.
As there was no authentication, all that PTT could do once the malicious
use if its network was discovered, was block the number indefinitely.
It could never be issued again.
|
All the malicious user had to do, was 'invent' a new number, enter it on the
DIP-switches, and continue. And this appeared to be easier than anticipated:
any telephone number that had not yet been issued to a legitimate subscriber,
was recognised by the ATF-1 network as a valid one.
Around 1985, PTT noticed an enormous rise in the clandestine use of its
network and – at the same time – an increase in the number of car phones
that were stolen from the vehicles of legitimate subscribers.
This prompted the Dutch National Police to start a criminal investigation.
|
|
|
Finally, in October 1986, after numerous observations throughout the entire
country, the police arrested 13 people in seven Dutch cities,
all of which were somehow related to the theft of the phones or their
conversion for clandestine use [4]. In 1987, the PTT started a call-back
operation, in which all existing mobile telephones were upgraded with
a Bemotel authentication module.
This solved most of the problems, but could not avoid that phreakers
later successfully managed to circumvent the authentication and use the
network free of charge, by making collect calls [2].
➤ More about clandestine use of ATF-1
|
Becker AT160S Bosch OF4 SEL SEM-96 Telefunken 4015
|
ATF
|
|
Autotelefoon
Name for the Dutch automatically-switched analogue carphone networks,
of which three generations have existed (nown as ATF-1,
ATF-2
and ATF-3.
Succeeded in 1994 by GSM.
|
B-Netz
|
|
B network
First automatically-switched analogue mobile telephone network in Germany,
compatible with ATF-1 in the Netherlands, and with the
networks in Austria and Luxemburg.
|
GSM
|
|
Global System for Mobile Communication
Digital mobile telephone network, with built-in encryption and authentication.
Introduced in 1991 and rolled-out in most European countries in 1992.
In the Netherlands, GSM was introduced in 1994.
➤ More
|
KPN
|
|
Koninklijke PTT Nederland
Royal PTT of The Netherlands. This was the name of the former Dutch
state-owned telecom monopolist PTT after its privatisation in 1989.
|
OLN
|
|
Openbaar Landelijk Net
First Dutch public radio network for mobile telephony in the 80 MHz band,
introduced in 1949 and operated by the PTT (now: KPN). The network was
manually-switched, which means that the subscriber
had to be patched by an operator. Terminated in 1985.
➤ More
|
PTT
|
|
Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecommunications monopolist from 1881 until its
privatisation in 1989.
Responsible for the development and operation of the post, telegraph
and telephone networks in the Netherlands. Also responsible for monitoring
the radio spectrum and for enforcing the telecom laws.
|
|
|
Any links shown in red are currently unavailable.
If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Sunday 02 June 2019. Last changed: Tuesday, 03 March 2020 - 16:30 CET.
|
 |
|
|
|