XCell Basic V3 Advanced

XCell Basic v3 Advanced

€ 1'700.00

Network technology: 2G/3G

BUY NOW

Special Features

Call/SMS interception alert

IMSI Change

Sandbox

cryptoTRACERⓇ

Instant Interception Check

C2 Monitoring

Location Spoofing

Anti Interception

XCrypt MLSP®

Call/SMS interception alert

This feature can detect all types of call/SMS interception. XCell Basic v3 Advanced will continuously monitor and scan in background both mobile networks, checking for network anomalies as LAC changing, RSSI increase, C2 reselection.

XCell Basic v3 Advanced is capable to detect all kind of call/SMS interception, performed by:

– IMSI Catchers.

– Active GSM-Interceptors.

– Semi Active GSM-Interceptors.

– Passive GSM-Interceptors.

– SS7 means (by the help of network provider, called also Lawful Interception).

XCell Basic v3 Advanced will also detect when the other mobile phone involved in the call is being tapped.

IMSI Change

This feature transforms your phone into a sophisticated counter-intelligence weapon by allowing the user to manually change the IMSI number. SIM cloning starts and generates a new valid IMSI to be used for the next call or message. There are no other phones that can perform IMSI changes. No internet connection, third party servers or special SIMs are required. No monthly fees or commitments.

HOW DOES IT WORK?

The phone will clone any SIM card inserted. Once cloned, the real SIM is quarantined and a virtual SIM is used instead, which can change its IMSI by generating valid IMSIs. Please note that the MSISDN (the phone number associated with the SIM card in use) does not change when you use the IMSI change function.

Sandbox

This feature has moved important software components to a separate partition called Sandbox, in order to make them working faster and smoother. System restarting has been suppressed in case of any abnormal network characteristics (i.e. generated by IMSI Catchers/GSM-Interceptors).

cryptoTRACERⓇ

This feature detects lawful interception by SS7 boxes (known as Network Switch Based Interception or Network Operator Assistance Interception). cryptoTRACERⓇ is a unique feature based on XCell’s proprietary algorithms that can instantly detect lawful interception attempts and alert the user when calls and SMS are being intercepted using SS7 (strategic interception solutions).

In addition to IMSI Catchers and GSM-Interceptors, which are small and mobile (sometimes vehicle mounted) interception systems, law enforcement agencies use so-called lawful interception (SS7 interception or operator help interception), a special piece of hardware that is directly connected to the GSM core network (at the level of the network switch).

In order to instantly detect if your XCell Basic v3 Advanced is monitored by SS7 means, you don’t have to make any call or send/receive a message. Just run cryptoTRACER® and wait for results. After checking phone firmware integrity, cryptoTRACER® will start pinging core network at MSC/VLR and AUC/HLR level. Then will calculate network redundancy and compare to standard redundancy. If a ping delay will be detected, SS7 monitoring alert will be triggered by displaying:

– Network redundancy [!]

– Pingdelay [!]

– Phone status [!]

Instant Interception Check

This feature will start checking both active and passive interception, allowing the user to immediately check whether the Stealth Phone is connected to a GSM-Interceptor or is affected by SS7 surveillance.

After the start, the function begins to check the active and passive monitoring, step by step. When monitoring with active and semi-active GSM-Interceptors, the Stealth Phone checks:

1. BTS (cell tower) parameters, allocated by real network.
2. RSSI. High GSM RSSI means other signals (jammers, IMSI Catchers) and unwanted interference.
3. Cell ID. Comparing real Cell ID against surrounding network within same LAC.
4. LAC (Location Area Code). Will check for abnormal LAC changes.
5. ARFCN: will check the pair of physical radio carriers used as uplink and downlink frequencies.
6. Ki (ciphering key stored on the SIM card) retrieving attempts.
7. Baseband attack attempts.

Regarding interception performed by Passive GSM-Interceptors, the phone will check based on real ARFCN:

1. Uplink. The frequency used by the phone to communicate with BTS (cell tower).
2. Downlink. The frequency used by the BTS to communicate with cell phone.

The phone will ping HLR/VLR core network, computing network redundancy and abnormal ping delays. In the end, will generate a Network Security Rating. 100 % means that the network is 100% secure.

C2 Monitoring

This feature monitors the C2 (cell re-selection criterion) parameter used by GSM-Interceptors to force mobile phones to connect. Active and semi-active GSM-Interceptors will force any mobile phone to disconnect from the home network and connect to the rogue BTS that the device is impersonating. This is also known as BCCH manipulation and is used by all modern GSM-Interceptors.

When launching this function, the phone will:

1. Extract C1 value, from serving cell.
2. Will compute C2 value by using a special algorithm, the same used by any GSM network.
3. Will look for at least other 6 neighboring cell towers, ordered by RSSI value.
4. Will compare C1 to C2.
5. Will trigger alert if no neighboring cells are found (a clear indication that a GSM-Interceptor is active within area).
6. Will look for CPICH, RSCP and BCCH.
7. Will display forced handover attempts (if any).
8. Will display Channel lock fails (if any).

Location Spoofing

This feature is true GSM location spoofing. The user can choose which cell tower the phone is connected to. In this way, any triangulation technique used for location tracking will produce false results, resulting in a false location.

Most so-called location spoofing applications are internet-based and only spoof GPS data. This creates a false sense of security because the GSM location is revealed every time the target phone is connected to a mobile network. GSM location data (Cell ID, Location Area Code, etc.) is often used by law enforcement agencies to locate mobile phones.

XCell Basic v3 Advanced is immune to this type of location tracking since connecting to more distant towers will cause false locations to be stored with the providers, leading to false results if analysed.

Caution: The mobile data connection is also provided by the network operator (via cell towers, which are easy to find). If the phone is connected to the internet via a mobile hotspot, the phone can be tracked instantly.

Optimal location spoofing is implemented for ease of use. XCell Basic v3 Advanced will always connect to the most distant cell tower, whether it is stationary or in motion.

Anti Interception

This feature will block voice calls and SMS (both incoming and outgoing) as long as phone is under surveillance by any means (no matter if IMSI Catcher, GSM-Interceptor or SS7).

XCrypt MLSP®

This feature has been added an absolutely new breed of secure SMS which is not just encrypted but use a new patented technology, which makes SMS also non-interceptable.

This is a revolutionary innovation called Multi-Layer Security Protocol – MLSP®, developed and patented by XCell Technologies. Taking advantage on GSM network architecture and SMS Transport Protocol, our SMS encryption technology is capable to send/receive encrypted and non-interceptable messages.

Please note that for exchanging encrypted messages you need at least 2 phones. Sender phone will encrypt the message and receiver phone will decrypt the message.

MLSP® consist in:

1. Physical layer: encrypted text message.

The phone will encrypt text messages by using following protocols:

– RSA

– AES 256

– Elliptic Curve (ECIES) 256

– SHA256

– Protected by ITSEC Evaluation level 3

2. Multi-layer routing and transport protocol. Encrypted SMS data is randomly segmented and distributed in bursts by Application Port Addressing Technology, via discrete GSM channels which usually are not “listened” by mobile interception systems (IMSI Catchers, GSM-Interceptors or StingRays), both in air interface (UM Interface in terms of GSM networks) and Abis, A and C-G mobile network interfaces. This way, SMS data which is usually sent over GSM Layer 1 (and widely intercepted on Layer 1) will be sent by using a combination of GSM Layer 1 and GSM Layer 2 (LAPDm). By consequence, no mobile interception systems (as GSM-Interceptors) and lawful interception systems (SS7 interception also known as network switch based interception or interception by the help of network operator) will be able to intercept the whole message but only a few bursts which are encrypted anyway.

3. Metadata protection. Regular SMS metadata is not saved in a separate file (called a metadata file). XCrypt separate metadata and the data it describes (SMS encrypted text), sending metadata file in bursts over the network, by the same Port Addressing technology. Metadata is of little value without the data file (SMS) it relates too. At the same time, metadata makes the data more usable and therefore, more valuable. An encrypted text message with separate metadata file will reveal nothing about SMS sender and receiver.

Our SMS encryption application use a groundbreaking multi-layer technology to protect SMS from being intercepted and decrypted. As a unique encryption application, beside strong military grade encryption, XCrypt use a brand new patented technology in order to send/receive encrypted messages: discrete GSM channels or Multi-Layer Security Protocol®. That will protect not just encrypted text messages but also metadata which is not encrypted.

Forensic Bullet-Proof

XCell Basic v3 Advanced is protected from forensic investigations by volatile USB filters. No forensic device can extract any data or files from the Stealth Phone. As soon as the Stealth Phone is connected to such a device, a PC or a service box, the volatile USB filters trigger a self-destruction of the motherboard, and the Stealth Phone goes into protected mode (permanent boot loop).

XCell Pro Stealth Phone is able to detect any changes made by a GSM Interceptor on a GSM network to register or attract the phone to the fake network (GSM Interceptor Proximity Alert). The registration of the phone on a new BTS (the fake BTS generated by a GSM Interceptor) is an automated process and this behaviour is absolutely common in any mobile phone. Any mobile phone will automatically select the strongest GSM signal generated by the GSM Interceptor in case of interception. GSM Interceptors (active and semi-active) force the phone to hand over by suppressing the real network signal with a strong signal and by mimicking the network parameters: MCC, MNC and LAC. However, the ARFCN (communication pair channels) and Cell ID are modified to force the phone to send registration requests to the "new" BTS. The XCell Pro Stealth Phone detects these changes and warns you: a discreet open lock icon is displayed on the home screen. The same open discreet lock icon is displayed during an active call in case of call interception (Call Interception Alert). In addition to the home screen alert, the phone alerts you with a sound/vibration alert.

If the network characteristics change, i.e. if a GSM Interceptor, IMSI Catcher or any other method is used to try to trick the SIM into changing to a breakable A5/2 encryption, the phone will detect this and alert the user with an alarm, vibration or display a message on the screen. No calls or SMS's can then be made. The phone will also randomly change the IMEI on each call, or you can specify an IMEI. A good way of confirming that the phone is changing the IMEI and not just giving the appearance of a different IMEI is to assign a known locked or stolen IMEI to the phone.

The phone will also alert you if it receives an abnormal number of requests to re-register with the GSM network (UnPing function), either from the network itself or from a GSM Interceptor attempting to locate the phone or perform a Kc (Communications Ciphering Key) extraction from your SIM card. The phone can be locked to a specific GSM channel number (ARFCN) to avoid BCCH manipulation procedures performed by GSM Interceptors. The XCell Pro Stealth Phone will display the TMSI value on the home screen, which will remain the same if the phone is intercepted. The phone automatically clears the call log after each outgoing or incoming call and all incoming and outgoing call audio is automatically recorded without any background beeps. All recorded files can be played directly from the phone.

How does it work?

XStealth is protected from forensic investigations by volatile USB filters. No forensic device can extract any data or files from the Stealth Phone. As soon as the Stealth Phone is connected to such a device, a PC or a service box, the volatile USB filters trigger a self-destruction of the motherboard, and the Stealth Phone goes into protected mode (permanent boot loop).

XCell Pro Stealth Phone is able to detect any changes made by a GSM Interceptor on a GSM network to register or attract the phone to the fake network (GSM Interceptor Proximity Alert). The registration of the phone on a new BTS (the fake BTS generated by a GSM Interceptor) is an automated process and this behaviour is absolutely common in any mobile phone. Any mobile phone will automatically select the strongest GSM signal generated by the GSM Interceptor in case of interception. GSM Interceptors (active and semi-active) force the phone to hand over by suppressing the real network signal with a strong signal and by mimicking the network parameters: MCC, MNC and LAC. However, the ARFCN (communication pair channels) and Cell ID are modified to force the phone to send registration requests to the "new" BTS. The XCell Pro Stealth Phone detects these changes and warns you: a discreet open lock icon is displayed on the home screen. The same open discreet lock icon is displayed during an active call in case of call interception (Call Interception Alert). In addition to the home screen alert, the phone alerts you with a sound/vibration alert.

If the network characteristics change, i.e. if a GSM Interceptor, IMSI Catcher or any other method is used to try to trick the SIM into changing to a breakable A5/2 encryption, the phone will detect this and alert the user with an alarm, vibration or display a message on the screen. No calls or SMS's can then be made. The phone will also randomly change the IMEI on each call, or you can specify an IMEI. A good way of confirming that the phone is changing the IMEI and not just giving the appearance of a different IMEI is to assign a known locked or stolen IMEI to the phone.

The phone will also alert you if it receives an abnormal number of requests to re-register with the GSM network (UnPing function), either from the network itself or from a GSM Interceptor attempting to locate the phone or perform a Kc (Communications Ciphering Key) extraction from your SIM card. The phone can be locked to a specific GSM channel number (ARFCN) to avoid BCCH manipulation procedures performed by GSM Interceptors. The XCell Pro Stealth Phone will display the TMSI value on the home screen, which will remain the same if the phone is intercepted. The phone automatically clears the call log after each outgoing or incoming call and all incoming and outgoing call audio is automatically recorded without any background beeps. All recorded files can be played directly from the phone.