IMEI and privacy

Discussion in 'privacy technology' started by Stefan Froberg, Jan 4, 2017.

  1. quietman

    quietman Registered Member

    Joined:
    Dec 27, 2014
    Posts:
    511
    Location:
    Earth .... occasionally
    @ roger_m

    That is very interesting , indeed . Thanks for posting .
    Did you first try the phone with no IMEI ?

    @ Stefan Froberg

    In the project I was looking at there is a Sim900 GSM/GPRS module.
    My guess is that the module already has an IMEI ( although it is not mentioned in the specs ) .
    But the manual for it does not seem to have the " AT+ SIMEI " command listed .
    Was this a factor in your choice of the SIM5320 module ?

    Back to the legal issues -
    It begs the question " Can a GSM/GPRS module be considered a phone , in itself ? "
    Logic says "No" , but regulatory bodies and LEAs may think otherwise !

    I can not find anything specific , but these articles are worth a look -
    http://www.engineersgarage.com/articles/gsm-gprs-modules
    http://electronicsforu.com/resources/what-is-gsm-module/
    https://imeidb.gsma.com/imei/index
     
    Last edited: Jan 6, 2017
  2. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    8,626
    I don't think it could be used until I manually created an IMEI number.
     
  3. deBoetie

    deBoetie Registered Member

    Joined:
    Aug 7, 2013
    Posts:
    1,832
    Location:
    UK
    Here's some information on IMEI assignment from the GSMA:

    http://www.gsma.com/newsroom/wp-content/uploads/2012/06/ts0660tacallocationprocessapproved.pdf

    It looks like there's a 2 digit "reporting body identifier", and a 4 digit type identifier. A "reporting body" is an organisation that has been approved as such by the GSMA. The type allocation is the process by which the IMEI has been assigned (aka namespace I think). There's also a testing IMEI space.

    Quietman has referenced the IMEI database maintained by GSMA above.

    Manufacturer/Brand Owner
    The brand owner is required to register with the GSMA before submitting an application for a Type Allocation Code.

    So, as a manufacturer of mobile phones, you'd need to register with the GSMA and get a code from them. I do not know what IMEIs are assigned to the GSM modules you can purchase on the market, I take it whoever makes them has a code.

    Obviously, criminals who are laundering stolen mobiles will have an incentive to change IMEIs in the same way that stolen car vehicle identifications are modified, and this is why both are illegal.
     
  4. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    747
    No no no, of course it's possible without imei (please see https://www.wilderssecurity.com/threads/imei-and-privacy.391118/#post-2643166).

    What I mean to tell is that IMEI as a mean of tracking is useless. Take your sim card out, put it into a new phone, bam! you have a new IMEI (every phone reports it's own IMEI to operator when SIM card is successfully registered to operator network)

    That wikipedia article posted above also makes a good point how governments like UK (not really a surprise) who already are more or less prison state use IMEI mainly only for tracking it's citizens and not for the other purpose that makes more sense, blacklisting lost/stolen phones. IMEI is really just your device serialnumber it has nothing to do with your service, it's not binded into your service, you will not get billed by it and nobody can "hijack" your phone by accidentally or intentionally putting your IMEI to their own phone.


    Also, any law that makes it illegal (USA by the way has no law against it but they tried to pass one in 2013 and again in 2015 https://www.congress.gov/bill/113th-congress/senate-bill/1070) is useless.
    Why? Because the people who those law (or law suggestions) target are already criminals. Any average brain phone thief with technical skill does not give one d*mn if it's illegal to change IMEI or not.

    Lastly, in nowadays day of smartphones IMEIs should be irrelevant. Case in point: I once had Samsung 3 Mini Phone for a while. And then lost it. Was I ******? Of course. Was I worried? No, because It was encrypted and password protected. Completely useless device for any phone thief, and note, without the use of any IMEI at all.
    And also the prepaid SIM inside (pin protected of course) had only $3 dollars left when I lost it so not a big lost really (another advantage, besides pseudo anonymity, for prepaid SIMs)

    Also aren't there apps for smartphones that you can brick/wipe your own lost/stolen device remotely by using computer? Does that use IMEI?

    So what's left? Nothing except obsolete, useless law that does nothing to stop actual criminals for doing what they would do anyway and the ability for government for spying & tracking technically unskilled users.
     
    Last edited: Jan 6, 2017
  5. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    747
    SIM900 is 2G module. And despite it's number it's actually older than SIM3520.
    So maybe Simcom introduced it only in their 3G modems ?
    Also your module should show the default factory IMEI in somewhere printed.

    Not at all. I chose it because it was 3G and wanted my (hopefully) soon to be finished "smart"phone to be future proof in case operators here shutdown 2G (some operators are already shutting down their 2G networks)

    It's really hard to find the definitive legal status for this IMEI change thing (can't find any legistation for my own country, UK seems to ban it, and USA seems to allow it at least for now)
     
  6. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    747
    Did that actually worko_O?? If it did then I would be very surprised.
    Because not every IMEI is valid.

    IMEI is 15 digit numer in format of AABBBBBBCCCCCCD or easier for eyes AA-BBBBBB-CCCCCC-D where:

    AA = Reporting Body Identifier (https://en.wikipedia.org/wiki/Reporting_Body_Identifier). This is public info.
    http://www.gsma.com/newsroom/wp-content/uploads/2013/12/TS.06-v7-Approved.pdf

    BBBBBB = is the TAC (Type allocation code) that really is nothing more than manufacturer and model of device (at least Nokia has public list of TACs for it's devices)

    CCCCCC = is a serial number between 000000-999999

    And D is a Luhn checksum (https://en.wikipedia.org/wiki/Luhn_algorithm)

    Everything public info
    You can check from here http://www.imei.info If the IMEI you just randomly picked is actually valid.
     
  7. deBoetie

    deBoetie Registered Member

    Joined:
    Aug 7, 2013
    Posts:
    1,832
    Location:
    UK
    While MAC address duplication would give problems on a local network and DHCP, is the IMEI used in any way for GSM network signalling (e.g. by the radio tower)? Or is that all done on the basis of the SIM?
     
  8. roger_m

    roger_m Registered Member

    Joined:
    Jan 25, 2009
    Posts:
    8,626
    It did work. Maybe I was just lucky.
     
  9. clubhouse1

    clubhouse1 Registered Member

    Joined:
    Sep 26, 2013
    Posts:
    1,124
    Location:
    UK
    Confession session, last year I was messing with a rooted android and managed to accidentally delete the imei numbers, after looking through xda forums I came across a apk called toolhero, boy does that have some nice utilities including saving\restoring imei (I hadn't saved obviously) but also creating and installing a random imei and it worked...The downloaded version I used was in English albeit a bit broken...

    https://s27.postimg.org/ucpov39ub/screen_3_x800.jpg
     
  10. Stefan Froberg

    Stefan Froberg Registered Member

    Joined:
    Jul 30, 2014
    Posts:
    747
    I believe it's done by the SIM. Your SIM has IMSI that survives no matter how many time one changes devices.

    That wikipedia article about IMEI says this:

    "The IMEI number is used by a GSM network to identify valid devices and therefore can be used for stopping a stolen phone from accessing that network. For example, if a mobile phone is stolen, the owner can call his or her network provider and instruct them to "blacklist" the phone using its IMEI number. This renders the phone useless on that network and sometimes other networks too, whether or not the phone's SIM is changed.

    The IMEI is only used for identifying the device and has no permanent or semi-permanent relation to the subscriber. Instead, the subscriber is identified by transmission of an IMSI number, which is stored on a SIM card that can (in theory) be transferred to any handset. However, many network and security features are enabled by knowing the current device being used by a subscriber."

    So, it's an old relic, from pre-smartphone era, to stop phone thief (and it really is just an speed bump for technical thief). But it can be used for tracking and also can be used to deny services if the operator wishes to cash for some extra service.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.