(U)SIM Examination (Physical) Pt2

(U)SIM Examination (Physical) Pt2

Before we can progress to consider various methods of (U)SIM physical examination there are more standards we need to be aware and there are reasons for that. Transitioning from GSM to 3GPP (*wcdma) standards required rewriting existing GSM standards to make the standards technology neutral to integrate GSM into future mobile developments under 3GPP global standards. Technology-wise, we know that GSM is a defined circuit-switched voice mobile communications system that has evolved with value-added data services (GPRS, HSCSD and EDGE). 3GPP (wcdma) as we know is a defined packet-switched technology and thus would be a pointless exercise to re-invent the wheel, so to speak, and introduce a new voice circuit-switched system and the matured installation base that went with it. That needs to be understood on many levels when dealing with mobile communications. Three examples of GSM and 3GPP working together:

(i) generally, we refer to Release 99 (R99) as a reference point whereby 3GPP could transition and re-write mobile communication technology standards with birthing-periods: GSM only before 3GPP Release 4 (Rel-4); GSM only (Rel-4 and later); 3GPP and beyond / GSM (R99 and later).  This enabled manufacturers, developers and operators and service providers to conintue with GSM standards in a pure GSM environment or evolve to a 3GPP environment but in the knowledge access and inter-connectivity to GSM would continue:

(ii) introduction of 3GPP (*wcdma) would take time and thus should avoid, as best possible, disruption to existing moble services;

(iii) GSM user/subscriber base was still growing at that time and has now reached over 3-billion users, from which we can draw a conclusion that GSM's importance in its relationship with 3GPP should not be under-estimated.GSM is by no means the junior partner.

In the mobile examination environment, we, as examiners, are exposed to multitude and multiple-layers of technical and technology standards many of which impact on (U)SIM, and particuarly so if the technical and technology generates a mobile communication outcome associated to/with a user/subscriber. 

(*) wcdma is one of a family of mobile technology standards under 3GPP and has been used for easy of reference. 

The scope of the tests and the requirements set down in GSM1117 were reproduced under the approved and adopted standard 3GPP TS51.017. In Pt1( usim-examination-physical-pt1.html ) reference was made to GSM11.11, however the approved and adopted standard (and the counterpart to GSM11.11) is 3GPP TS51.011:

PHY:    Physical characteristics - 3GPP TS 51.011 [1], clause 4.
ELEC:    Electronic signals and transmission protocols - 3GPP TS 51.011 [1], clause 5.
AFS:    Application and File structure - 3GPP TS 51.011 [1], clause 6.
SEC:    Security features - 3GPP TS 51.011 [1], clause 7.
CMD:    Description of the commands - 3GPP TS 51.011 [1], clause 9.
CEF:    Contents of the elementary files - 3GPP TS 51.011 [1], clause 10.
APP:    Application Protocol - 3GPP TS 51.011 [1], clause 11.

Whilst GSM11.17 standard is the starting point for ICC/SIM and 3GPP TS51.011 moved the technology to neutral ground to enable 3GPP to evolve 3G environment standards incorportating interconnectivity to and backward compatibility for ICC/UICC, the 3GPP evolution hasn't stopped there. There is, of course, 3GPP TS 31.120 the aim of which is to ensure interoperability between an UICC and a Terminal independently of the respective manufacturer, card issuer or operator. This is the expansion of the 3GPP domain going beyond specific limitations encumbent with a particular proprietory technology.

The run of standards doesn't end there. Attention and consideration should be given to:

ETSI standards
TS 102 230
TS 102 221

International standards
ISO/IEC 7816-pt1 to pt4

The standards referred to above are merely a starting point to identify the complexities involved in dealing with (U)SIM card and tasks involved in considering examination techniques that may not simply relate to recovery of data but other aspects and attributes of a card which may point to evidence. Readers should be prepared to delve into the standards above and release the huge number that haven't been mentioned. There are various analogies that may be used to imagine what I have in mind for this physical series, but I quite like the analogy about forensic vehicle tyre analysis. Evidentially, consideration is given to tyre size, tread, pressure, rubber, moulding, any wheel balacing and so on to assess a skid mark or tracks at the scene of a crime. It is equally possible to use an investigative and examination approach to SIM/USIM card materials, contacts, gold content, embossing etc to identify potential evidence.

(U)SIM Examination (Physical) Pt1

(U)SIM Examination (Physical) Pt1

We begin with GSM as this is the original starting place where examiners first learned about subscriber identity modules (SIM). There are many ways to learn about SIM: using a SIM reader tool is one way, receiving instruction during training that concentrates on the types of user and network data that can be harvested by examiners. An education and training process can equally include a training module or modules on the physical aspects of a card and identify, for the examiner, material parts of the SIM, the known routes to understanding electrical aspects, processing aspects, storage geometry and memory mapping, so on and so forth. The thinking here is analogous to the way in which there is an expectation that a computer examiner would understand HDD disc geometry, clusters and sectors, BIOS etc even before entering into the search and study of the 'content' that may be recorded on the disc. It is or should be the same for (U)SIM.

The SIM Card can be seen as a composition of at least three constituent parts:

- The physical card (the storage carrier).
- An integrated circuit card micro-processing chip (the operating system and content storage device).
- The subscriber identity module; an area of physical memory allocated at manufacturing for pre-market and post-market recording by the mobile network operator and SIM user.
 -  A fourth constituent part could be a Card with an etched antenna for RFID/NFC for use by (US)SIM (but this part is not included or discussed at this stage).
- etc

To enable test and inspection of these constituent parts GSM approved and adopted GSM11.17 to assist manufacturers, operators and service providers help formalise and uniform the test and inspection procedures rather than have a mish-mash of randomly selected tests for SIM cards submitted for use in GSM. The former is highly desirable as the goal of GSM has always be about interconnection-compatiblity and interconnection backward-compatibility. By way of illustration, a GSM SIM Card Phase 1 should still be able to be inserted into a GSM Phase 2+ mobile device and allow communications to take place, unless the operator or device manufacturer has declared and stated otherwise.

From an examiner's viewpoint we would desire to know how those three constituent parts translate to the work we do? Some examples are set out below

Physical Card
Due to the form factors used in GSM we can make assessment to determine the supply chain and manufacturer of the card itself. We look at the card to see if has been cut down for use and any attempts of anonymity by removal of the SIM Serial Number (SSN) compared to manufacture polarisation techniques. Later 3G/LTE USIM Cards have undergone some changes since GSM's inception; the latter will be dealt at a later date.


 Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

ICC Chip
Manufacturer and technical specification are important to determine a range of potential evidence, including release into the marketplace and technological and electronic capability. Clearly the geometry and memory mapping are important. There are various techniques to deal with a card with a damaged chip. One example is called 'acid-etching' used to gain access to the physical chip itself by removal of the outer protective coverings used in the manufacturing process. 

 
  Image courtesy of wikipedia - http://en.wikipedia.org/wiki/Subscriber_Identity_Module

Physical Memory
Determining geometry and memory mapping forms part of the testing and inspection process set out in GSM1117. We can use these procedures to formulate a forensic analysis programme, similar to the way in which computer forensic examiners seek to determine specifically data discovered and recovered from a particular memory location on the HDD and define the data from its binary and encoded states and any formatting that may be applicable to the data. That being so, would it be out of the question in SIM examination terms for the EFBCCH file to be formatted as .bmp?  Below are a set of powerpoint slides I have prepared so that examiners can comprehend procedures approved and adopted for test and inspection for GSM SIM Cards. Later on when we 3G/LTE (U)SIM this GSM starting point assists formulate how to identify differences between the various (U)SIM/LTE cards but equally identify expansion of technology services and content so the examination limit or avoid omissions during the investigative/evidential process.      

PIN Enabled SIM Card

PIN Enabled SIM Card

A recent question raised the notion what data would be revealed if the SIM Card was read but had a PIN enabled. Using a free SIM Card reader the results are below. Do remember, using different readers their output can reveal different results dependent upon how the programmer wrote the software. The results are from an old Phase 2 GSM SIM Card.

Additional tests with the PIN Locked SIM Card conducted with different SIM Readers

Location Area Codes (LAC)

Location Area Codes (LAC)

The desire to create databases containing MCC/MNC/LAC/CellID may seem a good idea but might produce inaccurate or erroenous results depending upon the way in which the information is used. It is known that LACs (and CellIDs for that matter) change and therefore a database becomes out of data fairly quickly.

LACs change for various reasons. Commonly LAC Dimensioning can be implemented due to heavy paging load or many LACs under one BSC causing frequent Location Updates are just two examples. The outcome of Dimensioning can require reprogramming BSC (GSM) / RNC(WCDMA) for each cell. Moreover, reprogramming at the MSC. On some occasions re-parenting at the MSC maybe required that requires re-programming LACs. Cell shapes, size and traffic capacity can change from the material time.

Unlike MCCs and MNCs, LACs are not published. LAC identifiers can by assigned by the network operator. It is essential as with all broadcast data to understand what the data mean and the data relevance to mobile telephone evidence.

Location Area Code (LAC) which is a fixed length code (of 2 octets) identifying a location area within a GSM PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values:

0000, and FFFE

These reserved values are used in some special cases when no valid LAI exists in the MS.

The Location Area Identification is a type 3 information element with 6 octets length.
....8......7......6......5......4......3......2......1....
+-----------------------------------------------+
│ ...Location Area Identification IEI..│ octet 1
+-----------------------------------------------│
│ ....MCC digit 2 │ MCC digit 1..... │ octet 2
+-----------------------+-----------------------│
│ .....MNC digit 3 │ MCC digit 3.....│ octet 3
+-----------------------+-----------------------│
│ ...MNC digit 2 │ MNC digit 1...│ octet 4
+-----------------------------------------------│
│ .......................LAC......................│ octet 5
+-----------------------------------------------│
│ ............LAC (continued)............│ octet 6
+-----------------------------------------------+
Figure 10.5.3: Location Area Identification information element


Table 10.5.3: Location Area Identification information element
+----------------------------------------------------------------------+
MCC, Mobile country code (octet 2 and 3)
The MCC field is coded as in CCITT Rec. E212, Annex A.

If the LAI is deleted the MCC and MNC shall take the
value from the deleted LAI.

In abnormal cases, the MCC stored in the mobile
station can contain elements not in the set
{0, 1 ... 9}. In such cases the mobile station should
transmit the stored values using full hexadecimal
encoding. When receiving such an MCC, the network
shall treat the LAI as deleted.

MNC, Mobile network code (octet 3 bits 5 to 8, octet 4)
The coding of this field is the responsibility of each
administration but BCD coding shall be used. The MNC
shall consist of 2 or 3 digits. For PCS 1900 for NA, Federal
regulation mandates that a 3-digit MNC shall be used.
However a network operator may decide to use only two
digits in the MNC in the LAI over the radio interface. In this
case, bits 5 to 8 of octet 3 shall be coded as "1111".
Mobile equipment shall accept LAI coded in such a way.

Note 1: In earlier versions of this protocol, the possibility to use a one digit MNC in LAI was provided on the radio interface. However as this was not used this possibility has been deleted.

Note 2: In earlier versions of this protocol, bits 5 to 8 of octet 3 were coded as "1111". Mobile equipment compliant with these earlier versions of the protocol may be unable to understand the 3-digit MNC format of the LAI, and therefore unable to register on a network broadcasting the LAI in this format.

In abnormal cases, the MNC stored in the mobile
station can have
- digit 1 or 2 not in the set {0, 1 ... 9}, or
- digit 3 not in the set {0, 1 ...9, F} hex.
In such cases the mobile station
shall transmit the stored values using full hexadecimal
encoding. When receiving such an MNC, the
network shall treat the LAI as deleted.

The same handling shall apply for the network, if a
3-digit MNC is sent by the mobile station to a network using
only a 2-digit MNC.

LAC, Location area code (octet 5 and 6)
In the LAC field bit 8 of octet 5 is the most
significant bit and bit 1 of octet 6 the least
significant bit.

The coding of the location area code is the
responsibility of each administration except that
two values are used to mark the LAC, and hence the
LAI, as deleted. Coding using full hexadecimal
representation may be used. The location area code
consists of 2 octets.

If a LAI has to be deleted then all bits of the
location area code shall be set to one with the
exception of the least significant bit which shall be
set to zero. If a SIM is inserted in a Mobile Equipment
with the location area code containing all zeros, then
the Mobile Equipment shall recognise this LAC as part
of a deleted LAI
+-----------------------------------------------------+

More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

BCCH data uncovered

BCCH data uncovered

.
The data found in the elementary file broadcast control channel (EFBCCH) 7F20:6F74 / 7F21:6F74 can provide useful data relating to a geographical radio area when combined with location area information data.
.
Method for translating BCCH information data. The question is, is the translation below to find the BCCH frequencies correct and what have I not mentioned below? You will need copies of GSM11.11, GSM03.03, GSM04.08 as well as understanding coding schemes.
.
FIGURE 1 What the Standard states:
.
FIGURE 2 What that means:
.

.
FIGURE 3 Harvested data from a Orange SIM Card read:
.


.
FIGURE 4 Translating the hex output to binary:
.


.
FIGURE 5 Converting to decimal digits which translates again and corresponds to GSM assigned uplink/downlink frequencies:
.
BCCH Frequencies (ARFCN)
761 765 766 774 781 782 786 787 789 790 797 799 801 803 806 813 816 825 828 829 838 846 847 849 869
.
FIGURE 6 Corroborating the conversion using another tool:
.
.
More on Cell Site Analysis: http://cellsiteanalysis.blogspot.com

Join MTEB Forum if your are in wireless / telecomms

Join MTEB Forum if your are in wireless / telecomms

.
If you work in forensics and/or examination devices, investigations or deal with evidence then the MTEB forum puts you in contact with other professionals when you need help with technical issues, technical discussions or generally want to stay up to date. Due to the make up of the forum members: experts, high level security, law enforcement and senior investigators requests to join are vetted.
.
.
Invitation to Join Mobile Telephone Examination Board
--------------------------------------------------------
The MTEB forum is dedicated to evidential standards, forensic examination and lawful interception dealing with mobile telephones/SIM/USIM/MMC, bluetooth, IrDA, USB, cell site analysis and mobile networks GSM, CDMA, 3G, 4G.
.
Link if you are NOT a LinkedIn member:

http://www.linkedin.com/groupInvitation?groupID=141739&sharedKey=35E59F107179

Link if you are a LinkedIn member:
http://www.linkedin.com/groupsDirectory?results=&sik=1216135556335

3G USIM-Detective Training Course 2007

3G USIM-Detective Training Course 2007

This core course introduces mobile telephone examiners and computer investigators to foundation information about Universal Subscriber Identity Module (USIM) card computer architecture, operating functionality, file structures and elementary files. The course is intended to assist delegates understand the complexity of 3G USIM cards and potential locations where user and network data can be recorded.

Ideally, delegates on this course should already have undertaken study into GSM SIM cards as the course requires delegates to also examine 3G USIM cards using Quantaq Solutions USIM-Detective software.

Courses: March, April and May 2007

http://rapidshare.com/files/10245341/USIM-Detective_datahseet_2007.pdf.html

Downloading from Rapidshare:
1. Click the above URL link or copy and paste into browser address bar
2. Go to bottom of Rapidshare html page displayed and click box that says FREE
3. Enter the four alphanumeric code into box that says "here"
4. Click Download (that also displays mirror site from which download is being obtained)
5. File download dialogue box appears, choice Open or Save

Mobile Telephone Evidence

MCC AND MNC CODES

As examination of SIM Cards and Handsets is on the increase internationally, thus roaming is relevant, the list below identifies Mobile Country Codes (e.g. 234) and Mobile Network Codes (e.g. 44) for global Mobile Operators. Please note the data are subject to change.

20201 Cosmote Greece
20205 Vodafone Greece
20209 Q-Telecom Greece
20210 Telestet Greece
20404 Vodafone Netherlands
20408 KPN Netherlands
20412 O2 Netherlands
20416 T-Mobile Netherlands
20420 Orange Netherlands
20601 Proximus Belgium
20610 Mobistar Belgium
20620 Base Belgium
20801 Orange France
20810 SFR France
20820 Bouygtel Telecom France
21303 S.T.A. MobilAnd Andorra
21401 Vodafone Spain
21402 Movistar Spain
21403 Amena Spain
21404 Xfera Spain
21407 Telefonica Movistar Spain
21601 Pannon GSM Hungary
21630 Westel 900 GSM Mobile Hungary
21670 Vodafone Hungary
21803 Eronet Bosnia Herzegovina
21805 Mobi's Bosnia Herzegovina
21890 GSM BIH Bosnia Herzegovina
21901 Croatian Telecoms Cronet Croatia
21910 VIP Croatia
22001 MOBTEL Yugoslavia
22002 ProMonte GSM Yugoslavia
22003 03 Yugoslavia
22004 Monet Yugoslavia
22201 Telecom Italia Mobile TIM Italy
22210 Vodafone Italy
22288 Wind Telecomunicazioni Italy
22298 BLU Italy
22299 3 Italy
22601 MobiFon CONNEX GSM Romania
22603 Cosmorom Romania
22610 Mobil Rom DIALOG Romania
22801 Swisscom NATEL Switzerland
22802 Sunrise Switzerland
22803 Orange Switzerland
23001 T-mobile Czech Republic
23002 EuroTel Praha Czech Republic
23003 Oskar Czech Republic
23101 Orange GSM Slovak Republic
23102 EuroTel GSM Slovak Republic
23201 MobilKom Austria A1 Austria
23203 T-Mobile Austria
23205 Connect Austria One Austria
23207 Tele.ring Austria
23210 3AT Austria
23400001 Virgin United Kingdom
23410 02 United Kingdom
23415 Vodafone United Kingdom
23420 3 United Kingdom
23430 Virgin United Kigndom (others)
23430 T-Mobile United Kingdom
23433 Orange United Kingdom
23450 Jersey Telecom GSM United Kingdom
23455 Guernsey Telecoms GSM UK
23458 Manx Telecom Pronto GSM UK
23800001 Debitel Denmark
23801 Tele-Danmark Mobil Denmark
23802 Sonofon Denmark
23820 Telia Denmark Denmark
23830 Orange Denmark
24001 Telia Mobitel Sweden
24002 3 Sweden
24003 Orange Sweden
24007 Comviq GSM Sweden
24008 Vodafone Sweden
24201 Telenor Mobil Norway
24202 NetCom GSM Norway
24403 Telia Finland Finland
24405 Radiolinja Finland
24407 AT&T U.S.A.
24409 Finnet Group Finland
24412 2G Finland
24414 AMT Finland
24491 Sonera Corporation Finland
24601 Omnitel Lithuania
24602 UAB Bite GSM Lithuania
24603 Tele 2 Lithuania
24701 Latvian Mobile Tel. Latvia
24702 Tele 2 Latvia
24801 Estonian Mobile Telephone Estonia
24802 RadioLinja Eesti Estonia
24803 Tele 2 Estonia
25001 MTS Moscow Russia
25002 Megafon Russia
25005 Siberian Cellular Russia
25007 Zao Smarts Russia
25010 Don Telecom Russia
25012 New Telephone Company Russia
25013 Kuban GSM Russia
25039 Uratel Russia
25044 North Caucasian GSM Russia
25099 BeeLine Russia
25501 Ukrainian Mobile Comms Ukraine
25502 Ukrainian Radio Systems Ukraine
25503 Kyivstar GSM Ukraine
25505 Golden Telecom Ukraine
25701 Velcom
25702 MTS
25901 Voxtel Moldova
25902 Moldcell Moldova
26001 Polkomtel PLUS GSM Poland
26002 ERA GSM Poland
26003 IDEA Centertel Poland
26201 T-Mobile Germany
26202 Vodafone Germany
26203 E-Plus Mobilfunk Germany
26207 O2 Germany
26213 MobilCom Germany
26214 Quam Germany
26601 Gibraltar Telecoms Gibtel Gibraltar
26801 Vodafone Portugal
26803 Optimus Telecom. Portugal
26806 Telecom Moveis Nac. TMN Portugal
27001 P+T LUXGSM Luxembourg
27077 Millicom Tango GSM Luxembourg
27201 Vodafone Ireland
27202 O2 Ireland
27203 Meteor Ireland
27401 Iceland Telecom Siminn Iceland
27402 TAL hf Iceland
27403 Islandss Iceland
27404 Viking Iceland
27601 Albanian Mobile Comms Albania
27602 Vodafone Albania
27801 Vodafone Malta
27821 Go Mobile Malta
28001 Cyprus Telecoms Authority Cyprus
28201 Geocell Limited Georgia
28202 Magti GSM Georgia
28203 Geo 03 Georgia
28301 ArmenTel Armenia
28401 MobilTel AD Bulgaria
28405 Globul Bulgaria
28601 Turkcell Turkey
28602 TELSIM Turkey
28603 Aria Turkey
28604 Aycell Turkey
28801 FT-GSM
28802 KALL
29001 Tele Greenland Greenland
29340 Si.mobil Slovenia
29341 Si-GSM Slovenia
29370 Si VEGA 070 Slovenia
29401 MobiMak Macedonia
29402 MTS AD Macedonia
29501 Telecom
29502 Montel
29505 FL1
29577 Tango
30200001 Fido Canada
30237 Microcell Connexions Inc Canada
30272 Rogers AT&T Canada
31001 Pacific Mobile Comms Pap New Guinea
31002 APC Sprint Spectrum U.S.A.
31011 Wireless 2000 Telephone U.S.A.
31015 BellSouth Mobility DCS U.S.A.
31017 Cingular (Pacific Bell Wireless) U.S.A.
31020 T-Mobile U.S.A.
31026 Western Wireless Voicestream U.S.A.
31027 Powertel U.S.A.
31031 Aerial Communications U.S.A.
31038 AT&T U.S.A.
31077 Iowa Wireless Services U.S.A.
33805 Digicel JM
34001 Orange French West Indies
34020 BouygTel French West Indies
36801 C-Com CU
37412 TSTT
40001 Acell Telekom B.M. Azerbaijan
40002 BKcell GSM 2000 Azerbaijan
40101 K-Mobile Kazaksthan
40102 KCELL Kazaksthan
40217 B-Mobile BT
40401 Aircel Digilink Essar Cellph. India
40402 Bharti Cellular Telecom Airtel India
40403 Bharti Cellular Telecom Airtel India
40405 Hutch India
40407 TATA Cellular India
40408 Ushafon India
40410 Bharti Cellular Telecom Airtel India
40411 Hutch India
40412 Escotel Mobile Comms India
40413 Hutch India
40414 Ina Spice India
40415 Aircel Digilink Essar Cellph. India
40419 Escotel India
40420 Orange India
40421 BPL USWest Cellular India
40422 Idea India
40423 Usha Martin Tel. Command India
40424 Idea India
40426 Usha Martin Tel. Command India
40427 BPL USWest Cellular India
40430 Usha Martin Tel. Command India
40431 Bharti Cellular Telecom Airtel India
40432 Ushafone India
40434 BPL USWest Cellular India
40438 BPL USWest Cellular India
40440 INA AIRTel India
40441 RPG MAA India
40442 Srinivas Cellcom India
40443 BPL USWest Cellular India
40444 Spice India
40445 Bharti Cellular Telecom Airtel India
40446 BPL USWest Cellular India
40449 Bharti Cellular Telecom Airtel India
40451,53,54,55 BSNL Mobile India
40456 Escotel India
40457,58,59 BSNL Mobile India
40460 Aircel Digilink Essar Cellph. India
40462,64,66 BSNL Mobile India
40468 Dolphin India
40469 Dolphin India
40470 Oasis India
40471,72,73,74,75,76,77 BSNL Mobile India
40478 IDEA India
40479,80,81 BSNL Mobile India
40486 Hutch India
40490,92,93,94,95,96,97,98 Bharti Cellular
Telecom Airtel India
41001 Ufone Pakistan
41201 AWCC AF
41302 MTN Networks Dialog GSM Sri Lanka
41303 CellTel Sri Lanka
41401 MPTGSM
41501 FTML Cellis Lebanon
41503 LibanCell Lebanon
41601 J.M.T.S Fastlink Jordan
41677 MobCom Jordan
41701 SyriaTel Syria
41702 94 Syria
41709 MOBILE Syrian Telecom Est. Syria
41793 SyriaTel Syria
41801 Iraq Telecom Iraq
41902 Mobile Telecoms MTCNet Kuwait
41903 Wataniya Kuwait
42001 Ministry of PTT Al Jawal Saudi Arabia
42007 Electronics App' Est. EAE Saudi Arabia
42202 General Telecoms Oman
42401 UAE ETISALAT-G1 United Arab Emirates
42402 UAE ETISALAT-G2 United Arab Emirates
42501 Orange Israel
42502 Cellcom Israel
42505 JAWWAL Israel
42601 Batelco Bahrain
42701 QATARNET Qatar
42899 MobiCom MN
43211 TCI Iran
43214 Kish Iran
43400 Uzmacom Uzbekistan
43401 Buztel Uzbekistan
43402 Uzmacom Uzbekistan
43404 Daewoo Unitel Uzbekistan
43405 Coscom Uzbekistan
43407 UZD Uzbekistan
43603 MLT TJK
43605 TajikTel
43701 Bitel Kyrgyz Republic
44010 DoCoMo Japan
45201 Mobifone Vietnam
45202 Vinaphone Vietnam
45400 Hong Kong Telecom CSL Hong Kong
45404 Hutchison Telecom Hong Kong
45406 SmarTone Mobile Comms Hong Kong
45410 New World PCS Hong Kong
45412 Peoples Telephone Hong Kong
45416 Mandarin Com. Sunday Hong Kong
45418 Pacific Link Hong Kong
45422 P Plus Comm Hong Kong
45501 C.T.M. TELEMOVEL+ Macau
45601 Mobitel Cambodia
45602 SM Cambodia
45618 Camshin Cambodia
45701 Lao Shinawatra Telecom Lao
45702 ETLMNW Lao
45703 LatMil Lao
45708 Tango Lao
46000 China Telecom GSM China
46001 China Unicom GSM China
46002 Liaoning PPTA China
46601 Far EasTone Telecoms Taiwan
46606 TUNTEX Telecom Taiwan
46688 KG Telecom Taiwan
46692 Chunghwa Telecom Taiwan
46693 Mobitai Communications Taiwan
46697 Pacific Cellular TWNGSM Taiwan
46699 TransAsia Telecoms Taiwan
46701 Sun KP PRK
47001 Grameen Phone Bangladesh
47002 Aktel Bangladesh
47003 Sheba Telecom Bangladesh
47201 DHI Mobile MV
50202 Binariang Malaysia
50212 Maxis Malaysia
50213 Telekom Cellular TM Touch Malaysia
50216 DiGi Telecommunications Malaysia
50217 TimeCel Wireless Adam Malaysia
50219 Celcom Malaysia
50501 Telstra Mobile Comms Australia
50502 Optus Australia
50503 Vodafone Australia
50503 3 Australia
50508 OneTel Australia
51001 PT. SATelindo C Indonesia
51008 Lippo Telkomsel Indonesia
51010 TelKomSel Indonesia
51011 Pro XL Indonesia
51021 IM3 Indonesia
51501 Isla Comms Philippines
51502 Globe Telecom Philippines
51503 Smart Communications Philippines
51505 DigiTel Philippines
52001 Advanced Info Service AIS Thailand
52010 Orange Thailand
52018 DTotal Access Worldphone Thailand
52023 GSM 1800 Thailand
52099 Orange Thailand
52501 Sing. Tel. GSM 900 Singapore
52502 Sing. Tel. GSM 1800 Singapore
52503 MobileOne Asia Singapore
52504 M1-3GSM Singapore
52505 StarHub Singapore
52811 DST Communications Brunei Darussalam
53001 Vodafone New Zealand
53901 O-Call ton
54101 Smile VUT
54201 Vodafone Fiji Fiji
54601 Mobilis New Caledonia
54720 Vini French Polynesia
55001 FSM Telecom FSM
60201 MobiNil Egypt
60202 Vodafone Egypt
60301 Algerian Mobile Network Algeria
60302 Djezzy Algeria
60400 Meditel Marocco
60401 Itissalat Al-Maghrib IAM Marocco
60502 Tunisie Telecom Tunicell Tunisia
60503 Tunisiana Tunisia
60701 GamCel GMB
60702 AfriCELL GMB
60801 Sonatel ALIZE Senegal
60802 Sentel Senegal
60901 Mattel MR
61001 Matitel ML
61002 Ikatel ML
61201 Comstar Cellular Network Cote d'Ivoire
61203 Orange Cote d'Ivoire
61205 Telecel Cote d'Ivoire
61302 CelTel BF
61402 CelTel NE
61501 Togo Telecom TOGO CELL Togo
61602 TLCL-Ben BJ
61603 Benincell BJ
61604 BBcom BJ
61701 Cellplus Mobile Comms Mauritius
61710 Emtel Mauritius
61801 Lonestar Liberia
62001 ScanCom Ghana
62002 OneToch Ghana
62003 Mobitel Ghana
62120 Econet NG
62130 MTN NG
62140 Nitel NG
62201 CelTel TC
62202 Libertis TD
62401 MTN Cameroon
62402 Orange Cameroon
62501 Cabo Verde Movel Cape Verde
62601 CSTMovel STP
62701 GNQ01 GNQ
62801 Libertis GA
62802 GAB TeleCel
62803 CelTel GA
62901 CelTel CD
62910 Libertis CD
63002 CelTel RC
63004 CellCo GSM RC
63089 OASIS
63102 Unitel AGO
63301 Seychelles Cellular Services Seychelles
63310 AIRTEL Seychelles
63401 Mobile Telephone Company Sudan
63510 Rwandacell Rwanda
63601 Ethiopian Telecoms Auth. Ethiopia
63701 Barakaat SOM
63782 Telsom SOM
63902 Safaricom KE
63903 KenCell KE
64001 Tritel Tanzania
64002 Mobitel Tanzania
64003 Zantel Tanzania
64005 CelTel Tanzania
64101 Celtel Cellular Uganda
64110 MTN Uganda Uganda
64111 UTL Telecel Uganda
64201 Spacetel BI
64202 Busafa BI
64301 mCel MOZ
64501 Celtel Zambia
64601 Madacom Madagascar
64602 SMM Antaris Madagascar
64603 Sacel Madagascar
64700 Orange
64702 OMT
64710 Societe Reunionnaise SRR Reunion
64801 NET*ONE Zimbabwe
64803 Telecel Zimbabwe
64804 Econet Zimbabwe
64901 MTC Namibia
65001 Telekom Network Callpoint Malawi
65010 CelTel Malawi
65101 VCL Comms Lesotho
65102 Ezi Cel Lesothp
65201 Mascom Wireless Botswana
65202 Vista Botswana
65310 Swazi MTN SZ
65501 Vodacom South Africa
65507 Cell C South Africa
65510 MTN South Africa
71201 ICE CRI
72235 Port Hable ARG
72402,03,04 TIM Brazil
72431 Oi Brazil
732101 Comcel Columbia
73401 Infonet Venezuela
73402 Digitel Venezuela
74601 ICMS SR
74602 TeleG SR