This feature allows the user to change the IMEI in different ways. When this feature is enabled, calls and SMS cannot be intercepted, and location cannot be tracked. Also, the target correlation methods of modern GSM-Interceptors that match the IMEI of the phone with the IMSI (SIM card used in this phone) will fail. The Dynamic IMEI feature has four options:
a. Random always: The phone’s IMEI (phone identity) changes randomly after each call or SMS.
b. Random on first request: The phone IMEI is changed when the SIM card is changed and the GSM network requests phone details for registration. In this mode, the phone IMEI will change only once after the device has registered with the network (after restarting the device).
c. User defined: The phone IMEI can be set manually by the user. Please read the user manual before using this feature.
d. Stay original: Phone IMEI remains original on every call and SMS. Also used as IMEI restore function when you have already used the other IMEI change functions.
Dynamic IMEI feature is designed to protect conversations against control and interception by GSM-Interceptor. To intercept your calls, a GSM-Interceptor will capture and use the following phone identifiers:
1. Your phone number (not transmitted over the air but known to the operator).
2. IMSI – unique SIM registration number.
3. IMEI – unique phone registration number, other than the phone number contained in the SIM.
If you change the IMEI and insert a newly purchased SIM (a prepaid one), then all the phone identifiers are different. Therefore, the system operator does not know who to put under surveillance. If you have only changed the SIM or the IMEI, you will get nothing and your calls will continue to be intercepted as if you had not changed anything.
If you change the IMEI and SIM at the same time, you can avoid any GSM-Interception. Since all your phone identifiers have changed (which were previously registered in the target selection list of a GSM-Interceptor), the GSM-Interceptor operator has to make additional efforts to receive and register your new identifiers. In addition, the system operator cannot understand that he has lost control of your phone.
This feature can detect ANY active, semi-active and passive GSM-Interceptors, regardless of type, manufacturer or other technical characteristics. Designed to protect against interception by active and semi-active GSM-Interception devices.
Active interception systems emulate a base station (BTS), forcing phones to connect to the GSM network through this device – a fake base station – rather than through the real base station. Mobile phones cannot distinguish between a fake base station (a GSM-Interceptor) and a real one. All mobile phones choose to register with a cell tower based on its power level. As long as a GSM-Interceptor has the strongest signal in a particular area, all mobile phones in that area will connect to that fake base station cloned by the interceptor. A rogue cell tower (base station) can:
– switch off A5/1 GSM standard encryption.
– lower A5/1 encryption to the weaker A5/2 one.
– not change ciphering (fully passive GSM-Interceptors).
The most common interception systems are those that reduce the encryption level from A5/1 to A5/2, either permanently or for the time needed to calculate a session key (Kc) and an encryption key (Ki) stored in the SIM.
This feature is an advanced detection algorithm based on GSM network variables that detects call interception by new GSM-Interceptors using the latest interception technology, including encryption level and network type downgrading.
During a call, the phone displays an open lock icon. This icon means that your calls and messages are no longer protected by the usual GSM A5/1 encryption and that your calls are being intercepted. All warning icons are displayed together with a sound/message/vibration alert.
The phone displays an open lock icon and alerts you with an audible alert and vibration. The same alert icon is displayed in the event of interception by your GSM service provider.
This feature is the location tracking alert. This feature generates alerts whenever the phone’s geolocation is tracked by location pings, a widely used method by law enforcement agencies to locate a cell phone.
GSM-Interceptors, or the GSM network operator itself, may request your phone’s geolocation by sending location tracking pings at a higher rate to attempt to triangulate your mobile phone’s location, or by requesting additional identity information from your handset, such as Ki and Kc. If a ping is detected as coming from the network or a GSM-Interceptor based on the associated variables, the user will be alerted.
This feature has two different uses: 1. anti-interception, 2. location spoofing. The primary function of Channel Lock is to prevent your phone from ” migrating ” from the real network (the real cell tower it is connected to) to a fake one, which in our case is a GSM-Interceptor acting as a legitimate cell tower from the point of view of your phone. A GSM-Interceptor uses a stronger signal than any neighbouring cell tower (through BCCH manipulation) and makes certain changes to network identifiers (especially LAC) to force the phone to connect to it. Once enabled, this feature will lock the phone to a particular cell tower, preventing the phone from ‘slipping’ to an IMSI Catcher. In this way, the phone cannot be intercepted because it will not connect to a GSM-Interceptor.
Location Spoofing. This feature can spoof your phone’s location by connecting to the weakest cell tower signal. No tracking procedures will lead to your real location. Once connected to the farthest BTS, all pinging and triangulation procedures will give a false location, usually 1-5 km away from your real location (depending on BTS density – urban or rural area).
This feature is a handy and quick way to find out if the phone is already connected to an IMSI Catcher. The TMSI is the temporary identification that the GSM network assigns to your SIM card and changes when the phone is switched off/on or when the phone loses complete network coverage. The TMSI value can remain the same or be limited to a very few values when the phone is connected/registered to a GSM-Interceptor. See the user guide for more information.
This feature will self-delete the call log after every single phone call. No call history will be recorded. This includes all logs such as outgoing/incoming call details. Can be useful if the phone happens to get into the wrong hands.
This feature records and stores the audio content of all phone calls on the phone’s internal memory or SD card (recommended). Recorded calls can be used in court, for example, if the user suspects that their calls have been deliberately edited by malicious hands.
This includes the following features: Sandbox, Instant Interception Check, C1/C2 Monitoring and IMSI Change.
The IMEI engine and other software components have been moved to a separate partition (sandbox) for faster and smoother operation. Suppressed system reboot in case of abnormal network characteristics (i.e. generated by IMSI Catchers/GSM-Interceptors).
This feature will start checking both active and passive interception, step by step allowing the user to immediately check whether the Stealth Phone is connected to a GSM-Interceptor or is affected by SS7 surveillance. After the start, the function begins to check the active and passive monitoring, step by step. When monitoring with active and semi-active GSM-Interceptors, the Stealth Phone checks:
Regarding interception performed by Passive GSM-Interceptors, the phone will check based on real ARFCN:
The phone will ping HLR/VLR core network, computing network redundancy and abnormal ping delays. In the end, will generate a Network Security Rating. 100 % means that the network is 100% secure.
By forcing cell reselection (C2 parameter), active and semi-active GSM-Interceptors force all mobile phones to disconnect from the home network and connect to the rogue BTS that the device is impersonating. This is also called BCCH manipulation and is used by all modern GSM-Interceptors. When this feature is activated, the phone will:
This feature transforms your phone into a sophisticated counter-intelligence weapon by allowing the user to manually change the IMSI number. SIM cloning starts and generates a new valid IMSI to be used for the next call or message. There are no other phones that can perform IMSI changes. No internet connection, third party servers or special SIMs are required. No monthly fees or commitments.
HOW DOES IT WORK?
The phone will clone any SIM card inserted. Once cloned, the real SIM is quarantined and a virtual SIM is used instead, which can change its IMSI by generating valid IMSIs. Please note that the MSISDN (the phone number associated with the SIM card in use) does not change when you use the IMSI change function.
This feature allows the user to switch between Hunting mode (call and SMS interception detection) and Anti Interception mode (no calls and messages can be sent or received while interception is active, regardless of whether GSM-Interceptor or SS7 means are used).
XCell Pro is protected from forensic investigations by volatile USB filters. No forensic device can extract any data or files from the Stealth Phone. As soon as the Stealth Phone is connected to such a device, a PC or a service box, the volatile USB filters trigger a self-destruction of the motherboard, and the Stealth Phone goes into protected mode (permanent boot loop).
XCell Pro Stealth Phone is able to detect any changes made by a GSM-Interceptor on a GSM network to register or attract the phone to the fake network (GSM-Interceptor Proximity Alert). The registration of the phone on a new BTS (the fake BTS generated by a GSM-Interceptor) is an automated process and this behaviour is absolutely common in any mobile phone.
