Issuu on Google+


ARROW - GSM Interception System

• • • • • •

Real time interception of GSM traffic Supports both A5.1 and A5.2 deciphering Totally transparent and undetectable by the Mobile Operator and the subscriber Support for all frequency bands Gathering intelligence information even when target is not using the mobile phone User-friendly operation


The ARROW is designed for off-air interception for cellular communication in GSM networks. It provides the interception of 4/6/8 ( or more) simultaneously subscribers that are operating close to the system. The system intercepts and records all outgoing and incoming calls, voice and SMS, to and from the target. The ARROW is using an active system that captures the IMSI and IMEI of the targets but as it is an active system it is proved fully non detectable modes of operation. The ARROW operates in Random mode as well as in Target mode. It can filter, track and record only the target operation.

Advantages: •Totally undetectable by the operator and by the user •Intercepts and records all outgoing and incoming calls, voice and SMS •All target calls are registered in the Mobile Operator billing systems •Pass the caller ID to the target mobile phone. •All traffic (voice and data) is fully encrypted in the air. •Multi Mobile Operators functionality •Easy change of Mobile Operator by changing a parameter only •Interception distance up to 1Km, •Interception operation starts in less than 15 seconds •Correlation tools to detect targets •Analysis tools to search for events •VPN configuration allows operation in different locations and common control center. •Operate with GSM DF system – remote silent activation of a target

Options and extra features •Optional- interception of 3G cell phones. •Optional – target Direction Finder – Homing system •Optional- ARROW Split operation: controlling remote interception points via wireless communication •Standard operation – controlling of interception mission via Internet •Standard target communication manipulation. Block, redirect or change information to or from the target. Change SMS content, Voice call manipulation

ARROW Overview


The ARROW Purpose • Detecting GSM-standard mobile stations, located within the zone controlled by the System, • Registering traffic (incoming and outgoing communications) from these mobile stations, • Manipulating the state of mobile stations, which have been registered by the system. The System operates in stealth mode in GSM networks, which use various encoding types (А5.2, А5.1)

The ARROW system supports • Defining mobile station key parameters - IMSI, IMEI, Kc, etc, which are required for System operation; • Full control over mobile station incoming and outgoing traffic within the System’s reach zone; • Manipulating the state of mobile stations, including the possibility of identifying the location of a mobile station (target) by activating its transmitter.

The ARROW range


The ARROW is the only system in the world that can operate in a range between 1-2 Km (with long range option). The system default configuration supports up to 1 Km. The actual system range will be depending on the environment where it is being used. Typically in a heavily built-up urban area the range will be about 150 meters that is because BTS in an urban area covers small area influence on the real capture area of the ARROW. In more open areas where the cell coverage area is larger the actual interception distances. Optional models can be provided for increased range.

The ARROW special features The ARROW can perform several manipulations to provide more information about the targets. • The system can force the activation and the transmission of the target phone to feed the Direction Finder (DF) system • Early Kc evaluation is performed by the MS unit. It helps to shorten the authentication call process. It helps only if Mobile Operator change the Kc every few calls. • The system force the target mobile phone to a certain ARFCN traffic channel to correlate with the operation of a DF system • The system shows constant indications of the reception level from the Mobile subscriber as well as constant level display of the BTS. • PLMN detection – The ARROW includes a very important function that called "Get Public number". It detects the Mobile Subscriber telephone number (PLMN number) by capture its number when sending the callerId over hidden incoming call. • Tracking and analysis tools by saving subscribers lists that include fade out subscribers, rejected subscribers and " target presence " subscriber lists, • Target history tracking list - to view the information stored in the database on a subscriber with IMSI identification

•Backup utilities - Convert Voice recording to standard .WAV files to be recorded on removable storage media. Database can be exported due to Microsoft Access MDB format. •Intelligence Analysis functions helps the operator to search for specific conversation or SMS. The operator can apply many filters to search for an event. SQL query language also provide means to search for events •Easy way to detect if Target replaces SIM cards. Each HLR list displays the IMSI (SIM Id number) and the IMEI (Equipment Id number). Using the correlation function the operator finds the changes of new IMSI/IMEI combinations. •The system applies transmission level control to determine the Tx level of the BTS. •Intelligence gathering when the target does not participate in incoming/outgoing calls (call standby). •Quick Mobile Operator change. The operator may change to a new operator by changing the LAI ( MCC + MNC) in the system BTS parameters setup.

ARROW operating modes


“Catcher” mode • IMSI and IMEI catching. (Secretly obtaining mobile station main identification parameters (IMSI, IMEI, TMSI, Kc etc). • Detection, controlling of mobile stations entering and leaving, turning the power on and off in the System's coverage zone. • Preventing operation of a certain mobile station (Target) or of station groups, which are in the System's coverage zone. The System initializes the operation of the base station. Thus, one cell is formed (further - internal network) for which the MCC, MNC and ARFCN values will correspond to the parameters of a cellular communication operator, operating in a given district (further - external network), and the LAC is set to a different value from what is used in the real network. The mobile phones, which are within its operation radius (further - subscribers), will acknowledge activation of a strong channel and will start the registration procedure. They will transmit to the System their IMSI, IMEI, TMSI (received in real GSM networks), classmark, KCN. The program’s “BTS control” window will display a list of registered subscribers (called in the system - HLR). For the subscribers, registration in the internal network does not differ from registration in the external network.



Maintaining full control over mobile station incoming and outgoing traffic within the System’s coverage zone; Two control modes: Random mode Interception (all mobile stations)- Capture and record all incoming and outgoing traffic within the System’s coverage zone; Tracking mode Interception – IMSI and/or IMEI (only targets) The System supports subscriber (target) selection by the known IMSI and/or IMEI identifiers and also has the given identifiers search tools based on the registered subscribers’ statistical list processing results.

COMPRA NUESTROS The System operates in stealth mode and it cannot be detected by the mobile stations’ users. The system PRODUCTOS AHORA!! does not create interference for external mobile GSM networks. “Target correlation” mode. The “Target Correlation” function helps to identify the Targets specific parameters from a list of all subscribers that were registered in the system. This function is intended to search for the target’s IMSI/IMEI identifiers with the purpose of their subsequent use as selection parameters. This technique is based on comparing the lists of subscribers, registered in the internal network, obtained from various sources (at different addresses) during various time periods

“Local network” mode The System supports mobile station operation (restoring the radio coverage zone) in critical situations (natural or technogenic disasters); Hostage situations - search, detection and possible contact with the GSM mobile station owners in disaster areas, accidents (supporting exclusive System’s operator’s contact with pre-determined mobile stations). It can be used as a local area network for a small office.

“Detection” Supports detection by the usual (standard) radio control resources of the location of a given mobile station, located within the System's coverage zone, by concealed activation of the mobile station’s transmitter.

ARROW structure


The following units are included with the System: • Paging channel stations - to receive from one external network’s LAC incoming subscribers’ call messages, registered in the internal network; • Mobile stations - to support authentication procedure, initiated by the external network, during incoming and outgoing subscribers’ calls, registered in the internal network. The mobile stations are automatically tuned to the internal network base station’s arfcn channel; • Active stations - to interact with the external GSM network on behalf of the subscriber, registered in the internal network. • Notebook PC to perform the control, storage, information production and analysis tools. The Notebook Pc is handling the real time deciphering function.

COMPRA NUESTROS PRODUCTOS AHORA!! •BTS cloning system includes:  A base station (BTS), tuned to one of the GSM -850, GSM-900 or GSM-1800 frequency bands (with preliminary agreement); Multi BTS (multi bands and multi Mobile operators support) connection could be ordered A base station transmitting channel amplifier (AMP) Two (or more) channels of mobile stations (MS) for Kc calculation. •Target cloning unit includes:  A complete set of up to 6 active stations (AS). A paging channel station (PGS) 1 unit; •A notebook with the corresponding software (PC) IBM ThinkPad T60 or better Processor 1.86GHz 80Gbyte hard disk 2.048 Gbyte RAM;


•A set of power supply units (PS1-PS3) (3 units); •Directional antenna (A1) for the GSM frequency multi band size 154X134X46 mm; •Directional antenna (A2) for the GSM frequency multi band size 154X134X46 mm; •A set of connection cables. •Long distance optional components Yagi antennas Long distance amplifiers units


ARROW GUI The ARROW Graphic User Interface (GUI) is composed of main window and some sub programs that enables the process of the information that was captured during the interception process: The main windows enable the full and easy control of the field interception mission. It provides an easy setup of the system parameters and a full automatic capture and presentation of the communication protocols of the subscribers.

The ARROW main windows

The main window presents the status of the 4 channels receivers and voice recorders. Via the main windows the system operator manages the target list parameters and controls the modes of operations. The target correlation window enables to isolate the target IMSI/IMEI parameters by correlating of subscribers lists with or without the target presence. The targets correlation window enables also to detect the replacing of SIM cards in mobile handsets by correlating the IMSI and IMEI data.




Number of channels

4 full duplex optional 6 channels

Kc calculation

2 separate channels for prior calculation.

Interception direction

Incoming and outgoing calls

Interception content

Voice, , SMS SS-message

Frequency bands

850MHz/900 MHz /1800 MHz /1900MHz IMSI/IMEI catching Random interception mode Tracking Target mode Target PLMN (phone number) detection "Local Network" Target correlation mode Early Kc evaluation

Interception setup time

Within 10-20 seconds

BTS information


Interception method

Fully transparent active

Tones interception


Real time decipher

A5.1 and A5.2

Voice and data recording

80 Gbyte hard disk

Target filter


PLMN number detection


Event real time status

Incoming/Outgoing call Emergency call Incoming/Outgoing SMS SS operation IMSI attach Power off Registration period timer Periodic /Normal Location Update

HLR display

Local subscriber Fade out Subscribers Rejected subscribers

Display design

Color change for each message type

Protocol filter


Processing software

Correlation target lists Detecting SIM replacements


Microsoft Access DB

Query method Search parameters

Voice features

SQL queries by

date, time, IMSI, IMEI,TMSI, Target name location LAC DTMF SMS word content, partial number using * and ?

Target detection Alarm Automatic voice activation Possible to listen to one speaker side

Replacing Operator

Change MCC +MNC parameters

Connectivity to DF system



Optional - Dual band Operation modes

More details: Transmission Power

10 Watt



Notebook PC

IBM ThinkPad T43 or equivalent Processor 1.86GHz 80Gbyte hard disk 2.048 Gbyte RAM;

Power supply

115/230V AC 47 Hz to 63 Hz or 12V DC

Power Consumption

AS - 72watts

(14v -16v 3a)

MS+BT -120watts (24-27v 3a) LPT - 72watts Unit connections

LAN cable

Unit 1 Dimensions (W x H x D)

290 x 260 x

Unit 2 Dimensions (W x H x D)

290 x 280 x

Small Directional Antenna

GSM Multi Band

(14-16v 3a)

9.4 dBi in 900MHz 49째 Horizontal plane 154 x 134 x Directional high gain or Yagi Antenna


External power amplifier


Total Weight (2 units)



high power (optional)





Seguridad en Comunicaciones