Question 1

Unknown Cell Tower Alert

Accepted Answer

Red warning messages are displayed on the home screen when X-ONE detects an unknown cell tower (unknown BTS) that does not have standard GSM encryption enabled (A5/1).   This type of alert is triggered when the phone connects to a lab device that is used for network testing and can also be used for GSM attacks (MITM). Usually, these devices do not have encryption enabled. Moreover, these devices use unknown values (Cell ID and LAC) because GSM interceptors use known values (Cell ID and LAC) collected from neighboring Cell ID and LAC values. In this way, the phone is forced to connect while using a higher RSSI (higher output power).
The above warnings are triggered for SIM 1 (Vodafone), as you can see in the picture above. SIM 2 (Telstra) is still connected to the real network and can be used for secure communication as the green icon is displayed.
No calls can be sent or received as there is no connection to the real GSM network. The same applies to SMS. However, a tapping warning is triggered when trying to make a call.

Question 2

GSM Interceptor Alert

Accepted Answer

Red warning messages are displayed on the home screen when X-ONE detects a GSM interceptor (other than an unknown BTS) that does not have standard GSM encryption (A5/1) enabled to listen to calls.   Outgoing and incoming calls will work and if SIM 1 is used, an intercept alarm will be triggered. The same is true for SMS.
If GSM Interceptor only mimics a cell tower from network 1 (e.g. Vodafone) and not from network 2 (e.g. Telstra), the user can make and receive secure calls using SIM 2. However, nowadays GSM Interceptor can imitate/clone multiple cell towers (up to 5 different networks). In this case, the GSM Interceptor alert looks like this.

Question 3

SS7 Interception Alert

Accepted Answer

Based on our proprietary detection algorithm, X-ONE is able to detect network switch-based eavesdropping, also known as SS7 eavesdropping, in real-time.   SS7 interception and location tracking is not based on disabled network encryption (A5/0), but on network switch exploits. For this reason, the A5/1 indicator remains green (secure) and only the SS7 attack alert is triggered as shown above.
Outgoing and incoming calls work and the call intercept alarm is triggered when SIM 1 or SIM 2 is used. The same applies to SMS.

Question 4

C2 Monitoring Alert

Accepted Answer

X-ONE has a C2 monitoring app that scans the phone's radio modem firmware for abnormal network requests as a C1/C2 reselection criterion, thus detecting any attempt to force the phone to leave the home network (real cellular network) and connect to a GSM interceptor Perform such an attack before intercepting calls/SMS. For ease of use, C2 attack attempts are also displayed on the X-ONE home screen.   The phone monitors the C2 parameter (cell reselection criterion) used by IMSI catchers / GSM interceptors to force a cell phone connection. This is referred to as forced handover. It also searches for the identity of neighboring cell towers. Once the C2 alert is triggered, you should run the C2 monitoring app to learn more about the ongoing C2 attack.

Question 5

Location Tracking Alert

Accepted Answer

As soon as the phone receives a location ping (LTP), a warning is displayed on the home screen.   Please note:   ⚠ The red warning remains on the home screen until the user restarts the phone. ⚠ Receiving one or more LTPs does not mean that your X-ONE has been tracked down and your GSM location has been revealed! It only means that someone (usually law enforcement or intelligence agencies) is interested in detecting your (phone) geo-location at a certain point in time. X-ONE does not only warn you about received LTP. ⚠ X-ONE blocks the response to LTP by default: no location data is sent back to the sender. No additional settings required. If you receive a large amount of received LTP (over 20/hour), you can take action by deleting the SMSC number from the SIM card(s) inserted in X-ONE. Go to Messages > Options > Settings > Service Center SIM 1 > delete the entire SMSC number > press Save. Do the same for SIM 2 (if inserted). ⚠ GPS location tracking is something different from GSM location tracking and is based on a GPS module (on the phone's motherboard) that needs to be accessed remotely by some government (or even commercial) spyware apps to read and send GPS data (via WIFI or data connection) back to the spyware end user. Please go to Settings > Geolocation > select Off.   GPS location tracking works only if spyware is installed on the phone. By default, X-ONE blocks any software installation, even by the user. Only KaiStore apps are allowed to be installed to improve the usability and user experience of the phone.   GSM location tracking is based on an LTP sent over the GSM network to a target phone (identified by its IMEI and the SIMs' IMSIs), triggering an "auto-response" message, which is sent back via SMS (invisible in the list of sent SMS) and contains GSM location data (which is actually the ID of the cell tower the phone is connected to at the time the LTP reached the phone, LAC, MCC, MNC and a list of up to 6 surrounding cell towers that the phone can "see". This data is needed to perform the GSM triangulation procedure, which in the end results in a geolocation of the phone with an accuracy of +/- 3 meters in urban areas).   Location tracking pings are sent over the GSM network, whether via SS7, a network operator or a GSM interceptor (the latter mimics a real cell tower). All have the same code structure: a blank SMS with a special script inserted into the SMS header to report back the GSM data and hide the received LTP, much like an email header. SMS headers are not visible on normal cell phones, but X-ONE can make them visible and trigger alerts when they occur.   How do you differentiate between LTP and Ki extraction alerts?   LTP are usually sent in pairs with a few seconds time difference to determine where the phone is and if it is on the move (the second LTP sends back different cell ID data than the first). If the phone is hit by several pings in a row (10, 20, etc.) 1-2 minutes apart, it means that a semi-active GSM interceptor is trying to extract the encryption key (Ki) stored on the SIM card, which is needed for further call interception and decryption. Ki is calculated by the GSM interception system using a so-called SRES/RAND method: The system sends special pings that generate a special response from the SIM card, which is used to calculate the encryption key (Ki). This is done in a few seconds. So if there are pairs of pings in the text file, it means that X-ONE has received a LTP. If more than 2 pings are received in a few seconds, an attempt at Ki extraction has been made.

Question 6

Continuous Network Scanning

Accepted Answer

The X-ONE Stealth Phone continuously monitors and scans both cellular networks in the background, checking for network anomalies such as LAC changes, RSSI increase and C2 redial. This feature can drain your battery faster than normal.

Question 7

XTerminator

Accepted Answer

This very special feature comes from the XStealth military version and XStealth Battle Station, which are designed for electronic warfare. Now XTerminator is available on the X-ONE Stealth Phone. XTerminator is designed to attack IMSI Catchers/GSM Interceptors OTA (Over The Air) over available uplink channels by LUR flooding, continuously sending connection requests (LUR) over RACCH - Radio Access Control Channel in a short time, similar to DoS network attacks. Random IMEI and IMSI/TMSI pairs are used, draining the battery quickly and using most of the phone's RAM and internal resources. The attack ends after an hour or when you exit the application. This attack cannot be detected by an IMSI Catcher/GSM Interceptor, but it leads to BTS overload in a real mobile network. Because of this, your phone might be "thrown" to another cell tower (depending on local network settings and policies), where the attack will continue. This attack is very disruptive for the real network and deadly for IMSI catchers/GSM interceptors. Use it with caution and only when it is really needed. X-ONE can blow up a cell tower or GSM Interceptor by sending an unlimited number of connection requests every 2 seconds, for 1 hour. The GSM Interceptor will see tons of connection requests from thousands of cell phones. And all this while your X-ONE hides the real IMSI and IMEI. This confuses the operator, who can't do IMEI/IMSI filtering to find the phone he wants to intercept and has to reboot the device to do a new IMEI/IMSI scan. And again, all connection requests are started until you stop the attack on GSM Interceptor (quitting XTerminator). ​ Attack types: ​ Flare Attack: The attack targets only your network BTSs within phone range. For better results, please insert only one SIM card. Real IMEI, IMSI and TMSI are quarantined and randomly generated values are sent. Use Flare Attack if you are sure that an IMSI Catcher/GSM Interceptor is active in your area. To find out, run Instant Interception Check. This attack requires a minimum of internal resources and is similar to the decoys dropped by a jet fighter.   Full Attack: Before launching this attack, please remove all SIM cards! This way your phone can "see" all surrounding cell towers (up to 6) from all available networks. The attack targets the first 2 cell towers at the same time, ordered by distance from your phone. Real IMEI, IMSI and TMSI are quarantined and randomly generated values are sent. This attack is similar to a DDoS attack, which severely disrupts the local cellular network all the way to the HLR/VLR servers and is also deadly for IMSI Catcher/GSM Interceptor. Since there is no SIM card, your phone cannot be "thrown" to another cell tower due to network settings and local policies. The full attack will continue against both cell towers simultaneously.   Kick Out: Your phone can remotely disable an IMSI catcher/GSM interceptor by continuously sending LUR requests on the same RACH. In this way, your phone repeatedly connects and disconnects from an IMSI catcher/GSM interceptor, resulting in malfunctions and fatal errors. Please use a single SIM card. Real IMEI and IMSI are quarantined by using randomly generated numbers.

Question 8

IMEI Change

Accepted Answer

The phone complies with the latest law changes that occur in more and more countries nowadays regarding the ban of IMEI changes. The phone uses a software generated IMEI to make calls and send SMS, quarantining the original IMEI displayed by dialing *#06#. By using this method, no traces of the changed IMEI are left behind. In addition, dialing *#06# will only display the original IMEI. No law enforcement agency will know that the IMEI has actually been changed, even if they have the phone in their hands. The original IMEI can be restored at any time by pressing the "Restore original" key. ⚠ By software, both IMEIs are changed at once.   Manually changing the IMEI: Press the "Get IMEI" button (or "Change IMEI" on the latest versions) and new valid IMEIs will be generated. Then send the app in the background by pressing the phone's back button (not the app's back button!): from now on, all phone calls and messages will use this newly generated IMEI. To generate new IMEIs, repeat the process. The IMEI will not be changed automatically after each call or SMS. To restore the original IMEI, select Restore original IMEI. Do not quit the application! This will reset the phone to the previously generated IMEI.

Question 9

IMSI Change

Accepted Answer

This function works only for SIM 1. If there is no SIM card in SIM 1 tray, IMSI change function works only for SIM 2. If there is no SIM card inserted, IMSI change does not work. This function turns your phone into a sophisticated counterintelligence weapon. The IMSI change feature does not require internet connection, third-party servers or monthly subscriptions. This special feature runs locally on the phone (sandbox partition) and is a unique feature that no other phone currently offers. The IMSI change function allows the user to change the IMSI value (SIM registration number stored on the SIM card) while keeping the same phone number (MSISDN). How does IMSI Change work? The phone clones any inserted SIM card (please use only MNO SIM cards) using an app located in the sandbox: IMSI Virtual Engine. After cloning, the real SIM card is quarantined and a virtual SIM card is used instead, which can change its IMSI by generating valid IMSIs.   ⚠ This function can generate a SIM network rejection (network-dependent). Use it with care.   IMSI change does not work automatically. You should start IMSI change every time a new IMSI is needed, generate a new virtual IMSI, and then run the application in the background. The newly generated IMSI will be used for all calls and messages until the user exits the application, generates a new IMSI or restarts the phone. If a new IMSI is needed, the entire process should be repeated. Please note that the MSISDN (the phone number associated with the SIM card used) does not change when using the IMSI change feature. Before using the IMSI change function, you should know the values of your local network: MCC and MNC (Mobile Country Code and Mobile Network Code) are unique values that do not change once they are assigned to a specific mobile network. You can visit the mcc-mnc.com website for up-to-date information. To help the user, an additional app called MCC MNC List is installed on the X-ONE. You can use this app to retrieve the correct MCC/MNC values. This app requires a data connection to access mcc-mnc.com.   You can change the IMSI as many times as you need, but note the following: The IMSI change feature will turn your X-ONE Stealth Phone into one of the most powerful communication weapons: you will literally have a new SIM (IMSI) for every single call. Use this function with caution! Misuse of the IMSI change feature may result in permanent SIM registration rejection (network dependent). Then you have to request a SIM change from your network operator to keep the same phone number.

Question 10

IMEI Generator

Accepted Answer

This is an additional IMEI change app that helps the user to manually enter a valid IMEI into the IMEI Change app. Use it in conjunction with IMEI Change app. Just press Get IMEI and a new valid IMEI will be generated.

Question 11

MCC MNC List

Accepted Answer

This is an additional application that will help you to get the correct MCC and MNC values for the IMSI change function.   You can use this app to retrieve the correct MCC/MNC values. This app requires a data connection to access mcc-mnc.com.

Question 12

Call Interception Alert

Accepted Answer

Whenever a call (outgoing or incoming) is intercepted by any means (GSM Interceptor or SS7), a listening alarm is triggered before the call is made or answered. The intercept alarm is triggered for both IMEIs.   Fig. 1: Interception warning before the call is placed Fig. 1.1: Interception warning during an active call    Fig. 2: Warning when intercepting an incoming call.
Fig. 2.1: Interception warning during an active call.   Will I be alerted if the other caller's cell phone is tapped? Yes, if the other party is intercepted by any means (GSM Interceptor or SS7), X-ONE will warn you with the above mentioned alerts, because the phone checks the security of the whole network and not only locally, at X-ONE level or at the level of the connected BTS. However, there is one case when neither a call nor an SMS eavesdropping alert is triggered: when commercial or government spy software is installed on the other caller's cell phone. This is because network security is not compromised in any way.     How to avoid call interception?   Using the IMEI Change and IMSI Change features is just enough to avoid call interception. If you enable the Anti-Interception feature, your phone will also be kept away from interception by blocking all incoming and outgoing calls and messages while X-ONE is under active monitoring.
If X-ONE users need to develop complex defenses that intoxicate the end user from intercepted calls and messages with various information, the anti-interception feature should be disabled.   ⚠ The incoming call interception alarm will not be triggered if the other caller's cell phone is intercepted by spyware installed on this cell phone.

Question 13

SMS Interception Alert

Accepted Answer

If an SMS (outgoing or incoming) is intercepted in any way (GSM Interceptor or SS7), an SMS interception alarm is triggered immediately before the message is sent. Incoming intercepted SMS messages cannot be marked as intercepted before they arrive on the phone, as intercepted incoming calls are signaled before the call is answered. The SMS interception alarm is triggered for both IMEIs.     What is a secure SMS?   It is something different from an encrypted SMS. A secure SMS is an SMS sent over a regular mobile network (which uses A5/1 stream cypher by default). The SMS itself is not encrypted, only the network connection (from the cell phone to the tower), which prevents interception. The same applies to secure calls.   ⚠ The alarm for intercepting incoming SMS will not be triggered if commercial or government spyware is installed on the sender's cell phone.

Question 14

Instant Interception Check

Accepted Answer

After starting, the function starts checking active and passive eavesdropping, step by step.   In terms of tapping with active/semi-active GSM taps, the phone checks: BTS (mobile tower) parameters assigned by the real network. RSSI. A high GSM RSSI means other signals (jammers, IMSI catchers) and unwanted interference. Cell ID. Comparison of the real cell ID with the surrounding network within the same LAC. LAC (site area code). Checks for abnormal LAC changes. ARFCN: checks the pair of physical radio bearers used as uplink and downlink frequencies. Ki (cipher key stored on SIM card) retrieval attempts. Baseband attack attempts.   In the case of interception attempts by passive GSM interceptors, the phone checks against the actual ARFCN: Uplink. The frequency the phone uses to communicate with the BTS (cell tower). Downlink. The frequency used by the BTS to communicate with the cell phone. The phone pings the HLR/VLR core network and calculates network redundancy and abnormal ping delays. At the end, a network security score is generated. 100% means that the network is 100% secure.   ⚠ [ok] or 0 means no threat. ⚠ [!] means threat detected.

Question 15

C2 Monitoring

Accepted Answer

The user can launch this application when a C2 monitoring alarm is displayed on the X-ONE home screen, or it can be launched whenever the user wishes. By forcing cell dialing (C2), active and semi-active GSM interceptors force all cell phones to disconnect from the home network and connect to the BTS embodied by the device. This is also called BCCH manipulation and is used by all modern GSM interceptors. When this function is started, the phone: Extracts the C1 value from the serving cell. Calculates the C2 value using a special algorithm used by each GSM network. Searches for at least 6 other neighboring cell towers, ordered by RSSI value. Compares C1 with C2. Triggers an alarm if no neighboring cells are found (a clear indication that a GSM interceptor is active in the area). Searches for CPICH, RSCP and BCCH. Displays forced handover attempts (if any). Displays failed channel blocking (if present).

Question 16

cryptoTRACER®

Accepted Answer

cryptoTRACER® is a feature that can detect lawful interception by SS7 boxes (known as Network Switch Based Interception or interception with the help of the network operator). cryptoTRACERⓇ uses an algorithm developed by XCell Technologies that triggers a wiretap alert when your calls are intercepted by SS7 means. To immediately detect if your X-ONE Stealth Phone is being monitored by SS7 means, you do not need to make a call or send/receive a message. Just run cryptoTRACER® and wait for the results.   After verifying the integrity of the phone firmware, cryptoTRACERⓇ starts pinging the core network at MSC/VLR and AUC/HLR level. Then the network redundancy is calculated and compared to the default redundancy. When a ping delay is detected, an SS7 monitoring alarm is triggered and displayed: Network redundancy [!] Ping delay [!] Phone status [!]

Question 17

Sandbox

Accepted Answer

Both the IMSI engine and the IMEI engine and other software components have been moved to a separate partition called Sandbox for faster and smoother operation. System reboot has been suppressed when abnormal network features occur (which are generated by IMSI catchers/GSM interceptors).

Question 18

Anti Interception

Accepted Answer

Once activated, the anti-interception application blocks all incoming and outgoing phone calls and messages while X-ONE is actively monitored (call and SMS monitoring).   X-ONE appears to be connected to the mobile network, but silent (no calls and messages).

Question 19

Location Spoofing

Accepted Answer

Cell phone tracking is based on the cell towers to which the phone is connected. A cell phone can "see" 6 neighboring cell towers at a time (or less, depending on the area), and law enforcement agencies use this information to accurately calculate (+/- 5 meters) the location of the cell phone using so-called GSM triangulation techniques.   Contrary to popular belief about mobile location tracking, geolocation of a cell phone has nothing to do with the GPS phone module, which is only a radio receiver (which does not send data from the phone, but only receives satellite data). GPS phone data can only be collected over the air if the phone in question has spy software installed that enables GPS tracking. Law enforcement and intelligence agencies do not use this tracking method because it has numerous technical drawbacks. Instead, they use the most common GSM tracking, which is based on the location of cell towers and triangulation methods. With this special feature, X-ONE can effectively hide (disguise) the real location of the phone. The phone fakes its location when it is stationary or moving by randomly connecting to cell towers. In this way, the phone appears to be 1 to 10 km away from its actual location (depending on the density of cell towers in the network).   The XCell Stealth Phones does not require an Internet connection and/or third-party servers for location obfuscation, as it is a built-in feature. If you select Current BTS, the phone will stay connected to the nearest cell tower. If you select Other BTS (cell towers), the phone connects to increasingly distant cell towers. Optimal Location Spoofing: X-ONE always automatically connects to the most distant cell tower that the phone can "see", whether it is stationary or moving.   ⚠ If cell tower density is low (e.g., in rural areas), X-ONE may experience signal problems or even signal loss when BTS 4 or Optimal Location Spoofing is activated. If there is no signal, reverse the settings to BTS 1 and then to Current BTS.

Question 20

Secure tethering (Internet sharing)

Accepted Answer

You can use the X-ONE Stealth Phone to securely connect other devices (PC, tablet, other cell phones) to the Internet via a Bluetooth connection.   ⚠ USB tethering is disabled and cannot be enabled due to the volatile USB security filters.

Question 21

Forensic bulletproof

Accepted Answer

This special feature protects X-ONE from forensic memory capture and data extraction. X-ONE comes with hardware volatility filters and software filters. No connection via the micro USB port to another device is possible. Thus, no data transfer is possible, no file system can be read or copied.

Question 22

Self-nuke

Accepted Answer

If USB data extraction is forced in any way by trying to bypass USB security filters or using JTAG procedures, a self-destruct mechanism is triggered. All data will be erased and the phone and the entire motherboard will be destroyed. No chance of unlocking, the phone's motherboard must be replaced.   ⚠ Do not connect X-ONE to a forensic device or a service box!