Click for homepage
Phones
ATF-1
  
Becker AT-160S
B-Netz car telephone

The Becker AT160S was a car telephone for the German B-Netz, the first automatically-switched analogue mobile telephone network in the country. The device was made by Telefunken – as the 4015 – and was also sold by Bosch as the OF4 and by SEL as the SEM96. B-Netz operated in the 150 MHz band and was compatible with the systems in the Netherlands, Austria and Luxemburg.

The device consisted of a black handset with a coiled cable, a control box with push-buttons and an LED display, and a main unit – the actual transceiver – which was so large and heavy that it had to be mounted in the trunk of the car.

As the device was interoperable with the Dutch ATF-1 network, many Becker units were stolen or purchased in Germany, and illegally exported to the Netherlands, where they were hacked and sold to (mainly criminal) users. The image on the right shows a nice example of a Becker AT160S, housed in a black Samsonite suitcase of the era.
  
Becker car telephone converted for clandestine use on the Dutch ATF-1 network

The code-board – which normally holds the subscriber's telephone number, is modified with a 26-wire ribbon cable that is connected to a removable black panel with 10 DIP-switch packs with 10 switches each, mounted at the far right of the suitcase's interior. The DIP switches were used for setting the spoofed telephone number, but the exact operation is currently unknown.

Large Samsonite suitcase with hacket Becker car telephone set, and smaller beauty case with external power supply unit.
Becker car telephone converted for clandestine use on the Dutch ATF-1 network
Control unit and handset
Antenna and power sockets
DIP-switches for setting the subscriber number
DIP-switches for setting the subscriber number
Interior
Code-board socket with wiring to the externally mounted DIP-switches
A
×
A
1 / 8
Large Samsonite suitcase with hacket Becker car telephone set, and smaller beauty case with external power supply unit.
A
2 / 8
Becker car telephone converted for clandestine use on the Dutch ATF-1 network
A
3 / 8
Control unit and handset
A
4 / 8
Antenna and power sockets
A
5 / 8
DIP-switches for setting the subscriber number
A
6 / 8
DIP-switches for setting the subscriber number
A
7 / 8
Interior
A
8 / 8
Code-board socket with wiring to the externally mounted DIP-switches

ATF-1 network   B-Netz
ATF-1 was the first automatically-switched mobile telephone network in the Netherlands. It was introduced on 1 March 1980 as the successor to the manually-switch OLN — Openbaar Landelijk Net (Public National Network). Based on the German B-Netz, it operated in the 150 MHz band [1].

ATF-1 was interoperable with the networks in Germany, Austria and Luxemburg, and had a maximum capacity of 2500 subscribers, that were served by 30 base stations throughout the country, as shown in the map on the right.

For outgoing calls, the mobile subscriber no longer had to to be patched by an operator, but could simply enter the number on the numeric keypad of the car phone. For incoming calls the situation was slightly more complicated, as the country was divided into three regions – north, south and west – and a caller had to know in which region the mobile user was located.

Apart from business users, ATF-1 also became very popular amoung inland navigation skippers, as it could be used throughout a large part of western Europe, along the entire trajectory of the river Rhine. For a long time however, the use of mobile phones aboard ships was prohibited in the Netherlands, and skippers risked a fine when they were caught. The ban was lifted in 1988.
  
Map of the Netherlands with ATF-1 base stations in 1980.

In 1985 and 1986 it became clear that the ATF-1 network was hacked by so-called phreakers, who managed to make phone calls on someone else's expence, or even free of charge, by using number spoofing (see below). When this was discovered, PTT decided to upgrade all existing mobile stations with a BEMOTEL authentication unit. Although this was reasonably successful, it was a one-way authentication, that worked on outgoing calls only. After a while, the phreakers discovered that it was still possible to call free-of-charge by making collect calls [2].

The maximum capacity of 2500 users was reached in 1983, just three years after the launch of the network, which prompted PTT to add a new network that had to be ready within a few years. In 1985, ATF-1 was succeeded by ATF-2 which worked in the 450 MHz band and was based on the NMT-450 standard of the Nordic countries. The ATF-1 service was terminated in 1995.

 More about ATF-1


Clandestine use
ATF-1 was a fully analogue FM system with in-band signalling, and no form of encryption or authentication whatsoever. Speech conversations were sent over the air in clear, and could be picked up by anyone with a suitable receiver or scanner that covered the 150 MHz band (2m).

In the same vain, the telephone numbers of the calling party and the mobile subscriber were sent over the air in clear, and it wasn't before long that hackers discovered a way to decode the data and display it on a computer screen.

The weakest point in the system however, was the fact that the telephone number of the mobile subscriber was only held inside the mobile tele­phone, programmed on a so-called code-board inside the main unit. The codeboard was usually configured by the telecom service engineer who installed the device in the subscriber's vehicle.
  
ATF-1 codeplug (unprogrammed)

By altering the arrangment of the wiring on the codeboard, it appeared to be possible to change the telephone's subscriber number, after which it was possible to make a call on someone else's expense. This led to complaints from users who got huge bills for unmade phone calls.

Worse even: hackers also discovered that any phone number that had not yet been issued by the PTT, was unblocked, allowing them to make phone calls for which nobody could be charged.

This soon led to a growing illegal business, in which many carphones were ripped from the cars of genuine subscribers, converted by the hackers, and put to use for (criminal) activities. The stolen telephones were built inside common briefcases, so that they could be carried around inconspicuously. An example of a Becker phone housed inside a briefcase is shown on the right.
  
Becker car telephone converted for clandestine use on the Dutch ATF-1 network

By adding a set of DIP-switches, the user of the stolen phone was able to select any possible subscriber number. As there was no authentication, all that PTT could do once the malicious use if its net­work was discovered, was block the number indefinitely. It could never be issued again.

All the malicious user had to do, was 'invent' a new number, enter it on the DIP-switches, and continue. And this appeared to be easier than anticipated: any telephone number that had not yet been issued to a legitimate subscriber, was recognised by the ATF-1 network as a valid one.

Around 1985, PTT noticed an enormous rise in the clandestine use of its network and – at the same time – an increase in the number of car phones that were stolen from the vehicles of legitimate subscribers. This prompted the Dutch National Police to start a criminal investigation.
  
DIP-switches for setting the subscriber number

Finally, in October 1986, after numerous observations throughout the entire country, the police arrested 13 people in seven Dutch cities, all of which were somehow related to the theft of the phones or their conversion for clandestine use [4]. In 1987, the PTT started a call-back operation, in which all existing mobile telephones were upgraded with a Bemotel authentication module. This solved most of the problems, but could not avoid that phreakers later successfully managed to circumvent the authentication and use the network free of charge, by making collect calls [2].

 More about clandestine use of ATF-1


Nomenclature
  • Becker
    AT160S
  • Bosch
    OF4
  • SEL
    SEM-96
  • Telefunken
    4015
Glossary
ATF   Autotelefoon
Name for the Dutch automatically-switched analogue carphone networks, of which three generations have existed (nown as ATF-1, ATF-2 and ATF-3. Succeeded in 1994 by GSM.
B-Netz   B network
First automatically-switched analogue mobile telephone network in Germany, compatible with ATF-1 in the Netherlands, and with the networks in Austria and Luxemburg.
GSM   Global System for Mobile Communication
Digital mobile telephone network, with built-in encryption and authentication. Introduced in 1991 and rolled-out in most European countries in 1992. In the Netherlands, GSM was introduced in 1994.  More
KPN   Koninklijke PTT Nederland
Royal PTT of The Netherlands. This was the name of the former Dutch state-owned telecom monopolist PTT after its privatisation in 1989.
OLN   Openbaar Landelijk Net
First Dutch public radio network for mobile telephony in the 80 MHz band, introduced in 1949 and operated by the PTT (now: KPN). The network was manually-switched, which means that the subscriber had to be patched by an operator. Terminated in 1985.  More
PTT   Staatsbedrijf der Posterijen, Telegrafie en Telefonie
Dutch state-owned telecommunications monopolist from 1881 until its privatisation in 1989. Responsible for the development and operation of the post, telegraph and telephone networks in the Netherlands. Also responsible for monitoring the radio spectrum and for enforcing the telecom laws.
References
  1. Wikipedia, B-Netz
    Retrieved May 2019.

  2. Wikipedia, Collect call
    Retrieved May 2019.

  3. Wikipedia, Phreaking
    Retrieved May 2019.

  4. Provinciale Zeeuwse Courant, Wijdvertakte zwendelzaak met autotelefoons ontdekt
    28 October 1986, page 5.
     Direct download

  5. Peter Poelman & The Key, Autotelefoonnet 1 gehackt
    Hack-Tic Magazine, Issue 2, 1989. Page 7 (Dutch).

  6. Stephan Hessberger, Becker AT-160S
    Retrieved June 2019.
Further information
Any links shown in red are currently unavailable. If you like the information on this website, why not make a donation?
© Crypto Museum. Created: Sunday 02 June 2019. Last changed: Tuesday, 03 March 2020 - 16:30 CET.
Click for homepage