3 ms·

>- IMEIs are used to track targets. Can IMEIs be spoofed? Yes. Relatively trivially.

by nkw 11y ago

throwaway7767 11y ago
Off-topic, but do you know any phones that can be easily hacked to change the IMEI? I know technically it's possible, and I know the hacks exist because I've seen shady sites offering the service, but I'd like to get a phone where I could rotate the IMEI myself when I change SIMs, so it would not be quite so easy to map the SIM to a person by watching for common IMEIs. I guess the best bet would be something that runs OsmocomBB, but AFAIK that's not really a good choice for a day-to-day phone.
BuildTheRobots 11y ago
I was going to say the exact opposite; that it's in no way trivial and that possessing the tools and information to do so is illegal in a number of European countries. More information would be greatly welcomed :) Edit: On reflection that sounds extremely dodgy... I got curious a few months ago and couldn't turn up much, so I'd certainly classify it as more difficult than trivial... but then I am still curious.
- venomsnake 11y ago
  First result on search https://play.google.com/store/apps/details?id=com.vivek.imeichanger&hl=en https://play.google.com/store/apps/details?id=com.vivek.imei... Imei changing is trivial. But you are still on the same number. Now - to change numbers on the fly requires telco assistance. And some very very interesting toys.
  - runjake 11y ago
    This only changes the apparent IMEI at the OS level to mask oneself from apps that pry. The hardware is still using the same old IMEI as far as the phone company and SIGINT is concerned. This is not readily, or trivially, changeable.
    - viraptor 11y ago
      I believe it was easier and possible in older phones. For example if you get an SL45 somewhere, I remember you had to flash your IMEI (or any IMEI) after the firmware change - otherwise it failed to register on the network. That would suggest it wasn't only as software level.
      - BuildTheRobots 11y ago
        On those older phones the radio and phone application tended to be highly combined and running on the same processor, so re-writing the firmware would require you to reprogram hardware identifiers (there's a handful of embedded PCs at the moment where the ethernet MAC address isn't actually stored in NV memory so also has to be set on boot). -but yeah, you _need_ IMSI and IMEI as minimum to register on a network. As far as I know, nearly every "modern" or smartphone has distinct separation between OS+applications and the radio world to the point where they're not only running separate firmware (anyone flashing android images will have seen this) but they're running on physically separate CPUs. The other sad thing about the older phones (I've got a 6310 and a 7110 on my desk at the moment) is that they often don't support A5/3 encryption, so you can't actually use them on most modern networks (I believe it's the encryption; if anyone else knows better please tell me) -so if you're desperate to change the IMEI for some reason you can't just use an ancient handset to do it. It also means I can't throw off the shackles of this modern world and re-live 1990's hardware :( I guess my original question could be better phrased as "does anyone know if it's possible on a _modern_ handset -and as it's device specific; which ones?" I also feel I should point out a couple of "good" reasons for the macro operators not wanting people to have the ability. As it's the hardware identifier, it's used to blacklist stolen handsets -and anything that discourages kids from stealing my phone at knifepoint is probably a good thing. Different handsets also have all sorts of odd network quirks too. For macro operators, being able to profile how different handsets behave on their network can be extremely useful just for the sake of keeping the network running properly. My sudden paranoid realisation though is that if you're a TLA, being able to go from IMEI to make/model of handset and therefore know exactly what exploits to use, must be quite useful o_0

>- IMEIs are used to track targets. Can IMEIs be spoofed? Yes. Relatively trivially.

by nkw 11y ago

>- IMEIs are used to track targets. Can IMEIs be spoofed? Yes. Relatively trivially.

Off-topic, but do you know any phones that can be easily hacked to change the IMEI? I know technically it's possible, and I know the hacks exist because I've seen shady sites offering the service, but I'd like to get a phone where I could rotate the IMEI myself when I change SIMs, so it would not be quite so easy to map the SIM to a person by watching for common IMEIs. I guess the best bet would be something that runs OsmocomBB, but AFAIK that's not really a good choice for a day-to-day phone.

BuildTheRobots 11y ago

I was going to say the exact opposite; that it's in no way trivial and that possessing the tools and information to do so is illegal in a number of European countries. More information would be greatly welcomed :) Edit: On reflection that sounds extremely dodgy... I got curious a few months ago and couldn't turn up much, so I'd certainly classify it as more difficult than trivial... but then I am still curious.

venomsnake 11y ago
First result on search https://play.google.com/store/apps/details?id=com.vivek.imeichanger&hl=en https://play.google.com/store/apps/details?id=com.vivek.imei... Imei changing is trivial. But you are still on the same number. Now - to change numbers on the fly requires telco assistance. And some very very interesting toys.
- runjake 11y ago
  This only changes the apparent IMEI at the OS level to mask oneself from apps that pry. The hardware is still using the same old IMEI as far as the phone company and SIGINT is concerned. This is not readily, or trivially, changeable.
  - viraptor 11y ago
    I believe it was easier and possible in older phones. For example if you get an SL45 somewhere, I remember you had to flash your IMEI (or any IMEI) after the firmware change - otherwise it failed to register on the network. That would suggest it wasn't only as software level.
    - BuildTheRobots 11y ago
      On those older phones the radio and phone application tended to be highly combined and running on the same processor, so re-writing the firmware would require you to reprogram hardware identifiers (there's a handful of embedded PCs at the moment where the ethernet MAC address isn't actually stored in NV memory so also has to be set on boot). -but yeah, you _need_ IMSI and IMEI as minimum to register on a network. As far as I know, nearly every "modern" or smartphone has distinct separation between OS+applications and the radio world to the point where they're not only running separate firmware (anyone flashing android images will have seen this) but they're running on physically separate CPUs. The other sad thing about the older phones (I've got a 6310 and a 7110 on my desk at the moment) is that they often don't support A5/3 encryption, so you can't actually use them on most modern networks (I believe it's the encryption; if anyone else knows better please tell me) -so if you're desperate to change the IMEI for some reason you can't just use an ancient handset to do it. It also means I can't throw off the shackles of this modern world and re-live 1990's hardware :( I guess my original question could be better phrased as "does anyone know if it's possible on a _modern_ handset -and as it's device specific; which ones?" I also feel I should point out a couple of "good" reasons for the macro operators not wanting people to have the ability. As it's the hardware identifier, it's used to blacklist stolen handsets -and anything that discourages kids from stealing my phone at knifepoint is probably a good thing. Different handsets also have all sorts of odd network quirks too. For macro operators, being able to profile how different handsets behave on their network can be extremely useful just for the sake of keeping the network running properly. My sudden paranoid realisation though is that if you're a TLA, being able to go from IMEI to make/model of handset and therefore know exactly what exploits to use, must be quite useful o_0