12 ms·
The IMEI Code: Your phone’s other number
- BuildTheRobots 2y agoCouple of thoughts > The combination of the ICCID and the IMSI basically tells the mobile network, “hey, this person paid for a plan.” As far as I remember, the ICCID never actually appears in standard network messaging. It might be possible for the network to request it, but it's not part of a standard 2/3/4/5g attach. The piece seemed to miss two major uses for the IMEI (or I missed it when reading), which were working around vendor bugs and allowing emergency calling. Radio firmware and state machines have always had weird bugs, and even when it conforms to standards (some of which are extremely interpretable), does very weird things in the real world. Pre-smartphone, being able to update phone and radio firmware was extremely rare, so it was common for the networks instead to implement workarounds on a manufacturer or handset basis. Having a hardware ID that identified this was extremely useful. GSM (and onward) actually supports a handset attaching to a network, even without a SIM card, for the sake of emergency calling. It needs some form of unique identifier for this to work. As much as it could (potentially, entirely redefining the stack) generated UUIDs, it makes some sense for these unique IDs to persist across roaming/sessions/reboots.
- heilhippo 2y ago[dead]
- lxgr 2y agoThese are AT commands, which specify (one way of) communication between a modem or phone and a PC, or maybe a smartphone OS and a baseband. The phone/baseband doesn’t talk to the network in AT commands.
- heilhippo 2y agoIn theory it doesn’t, in practice it does.
- lxgr 2y agoNo, it doesn't. AT commands also don't make it onto your phone line, after all. They're for communication between a host and a modem/baseband, not between a host and another host or even two modems.
- yencabulator 2y agoWell, there are commands that make the modem talk to the GSM network in specific ways. For example, *SC*123123123# sets up call forwarding to that number.
- sumtechguy 2y agoThe AT commands are usually used at call establish time, but can be used at other times to query the status of the modem. AT commands never go into the network that is a different set of standards. They are only used on the modem in your phone. If you can get on the right serial pin on the modem you can issue AT commands to the modem and it will do all sorts of interesting things. Different companies have their own standards. Think of the AT commands as just telling the modem to put itself in a particular mode or go do something. After that the serial bits will do different things or output different things. It does not specify what will be said in the data mode (that is the GSM/CDMA/LTE/RS232 standards and a different part of the modem). Just that the modem will do particular things. Take for example this old command ATDT,,5555555 That tells the modem attention, go into output DMTF sounds, wait 2 seconds, wait 2 seconds, output the DMTF tones on the speaker line for 5555555, then wait for a sound of response on the receiver and negotiate the highest both ends can talk using the S registers to decide what to do. But the AT commands do not go over the wire. They are purely modem commands. The modems in many cell phones still basically do this. But just with different commands and different registers. There is nothing stopping the modem from sending more AT commands to the other side though but that would be something in the standards to declare.
- lxgr 2y ago> As far as I remember, the ICCID never actually appears in standard network messaging. Yeah, that would be the IMSI (which a given SIM card can have multiple of, e.g. for switching to a more beneficial home network while roaming!) The ICCID is useful for identifying a given physical SIM card (e.g. so that the phone can link a given user-selected profile name to it/the associated phone line for a "preferred line for contact" indicator in dual-SIM phones), and probably also as an identifier when dynamically assigning a new IMSI over the air. > for the sake of emergency calling The IMEI can indeed be an identifier of last resort for emergency calls. I wonder if some countries use it to block abuse/spam calls to emergency services, or more importantly, why some others aren't? In Germany, for example, SIM-less emergency calls are no longer possible, supposedly due to many people calling the local emergency number to test whether a used phone is in working condition without inserting a SIM card... I don't know what they're doing with the IMSI in that case, and if it's locking these callers out, why they can't do the same for the IMEI.
- tjohns 2y agoAt least in the US, the 911 infrastructure is dated. In older systems, your caller ID is sent using in-band DTMF tones, which are decoded by the dispatch computer. On newer E-911 systems they get some additional digital address data from the telephone network, but the record format wasn't designed with VoIP or cellular in mind. So in those cases, the telephone network sends a virtual number and the dispatch computer does a seperate out-of-band lookup with the VoIP/cellular company using that number as a key to get your location. The whole emergency calling system is layers upon layers of hacks. While they can bolt additional functionality on if they're creative, it's more likely a given feature is _not_ implemented. There's a good chance that by the time the call gets to dispatchers, the IMEI/IMSI isn't displayed anywhere and they just see a random virtual number.
- sfx2000 2y agoGosh, yes it's a bit of a mess... The PSAP (E911 end point) likely will receive an MDN/MSISDN (10 digit number you dial for NANP networks) - this is so they can call back if the call is dropped. E911 is a special service, so in the case of deactivated/missing SIM cards, the carrier assigns a temporary MSISDN for duration of the call when the UE exits E911 mode - there are actually of regulatory and carrier requirements around E911 mode. E911 Phase 2 required not only the DN, but also if possible the location of the device - whether thru Cell Base Station Triangulation (if possible) or GNSS with a LAT/LONG based on coarse/fine location info. In any case, as @tjohns mentions, IMSI/IMEI are not typically used outside of the servicing network.
- kevvok 2y ago> Radio firmware and state machines have always had weird bugs, and even when it conforms to standards (some of which are extremely interpretable), does very weird things in the real world. Pre-smartphone, being able to update phone and radio firmware was extremely rare, so it was common for the networks instead to implement workarounds on a manufacturer or handset basis. Having a hardware ID that identified this was extremely useful Now that it’s common for devices to be updated regularly, they will typically send an extended form of the IMEI to the network called the IMEISV, which is the same as the IMEI except the final check digit is replaced with a two-digit code indicating the current software version (SV = Software Version).
- lloydatkinson 2y agoOnly two digits? What could possibly go wrong... again.
- rohansingh 2y agoProbably not a lot. It needs to have a fixed length on the wire, and having 100 updates to the radio firmware for any given model of handset... not likely?
- londons_explore 2y agoThe fact the IMEI is generally not editable seems like a massive privacy hole. Just let people edit it. Then I can be someone new every day and nobody can track me. Mac address randomization does that for wifi. Now do the same for mobile networks.
- kevincox 2y agoI really want mobile networks to accept their role as dumb data pipes. I should be able to just provide a password or certificate and connect. No IEMI, no SIM. And while we are at it stop tunneling my data back "home" when I travel. I don't want increased latency.
- londons_explore 2y agoAnd while we're at it, how come if I have a phone without a sim I can't at least navigate to a carrier webpage to buy an esim? The phone could pop up a menu saying "Here are the available networks", and you pick one, connect and it says "Welcome to AT&T, enter credit card number here", and you type a number and hit OK and you're connected. Oh wait - just like Wifi!! Why are mobile networks so far behind?
- btgeekboy 2y agoKinda like this? https://en.m.wikipedia.org/wiki/Apple_SIM https://en.m.wikipedia.org/wiki/Apple_SIM
- kbolino 2y agoHow would a networking stack with no hardware addresses even work? The next hop needs a way to reach back to you, before you can negotiate anything fancy like passwords or certificates. Even IPv6 SLAAC starts with a hardware address.
- londons_explore 2y agorand()?
- ementally 2y agoYou can use https://github.com/srlabs/blue-merle https://github.com/srlabs/blue-merle if you want to change your IMEI >The blue-merle software package enhances anonymity and reduces forensic traceability of the GL-E750 / Mudi 4G mobile wi-fi router ("Mudi router") >Mobile Equipment Identity (IMEI) changer >Media Access Control (MAC) address log wiper >Basic Service Set Identifier (BSSID) randomization >MAC Address randomization
- soylentcola 2y agoLooks like it only works on their portable router (a separate device) unless I missed something. A sort of proxy for your phone I guess?
- sfx2000 2y agoI don't recommend mucking about with the IMEI, as you risk a collision with another device that is already using that IMEI - IMEI's are supposed to be immutable. I realize that there are some Modem OEM's that might allow the IMEI to be "adjusted", but proper modem vendors will not allow that AT command.
- KenArrari 2y agoIf someone knows your IMEI can they track you?
- kbolino 2y agoNot from the other side of a wide-area network, but if they are continuously in close proximity to you, or can effectively monitor everywhere (three letter agency), then yes. Of course, there are other ways to track you.
- KenArrari 2y agoAh ok I had a police officer force me to unlock my phone and show him my IMEI once so that answers why.
- harshaxnim 2y agoCan you elaborate on what you meant by trackable when they're "continously in close proximity to you"?
- p_l 2y agoSnooping, or hijacking, the radio pathway between you and your network operator.
- aspenmayer 2y agohttps://en.wikipedia.org/wiki/IMSI-catcher https://en.wikipedia.org/wiki/IMSI-catcher
- wiml 2y agoIf they can listen to the radio traffic between your phone and the cell tower, that is.
- lxgr 2y agoI think this is only true for older mobile networks. In 4G and 5G, I don't think the IMEI is part of any unencrypted radio message anymore. Even the IMSI is only used when absolutely necessary, i.e. for the initial attachment procedure when cold starting a device or entering a new routing area; after that, it's replaced by an alias called TMSI to make tracking phone users a bit harder. New Android versions will supposedly have a switch in their settings to show a warning every time the IMEI or IMSI is transmitted in plantext [1]. [1] https://cs.android.com/android/platform/superproject/main/+/main:hardware/interfaces/radio/aidl/android/hardware/radio/network/IRadioNetwork.aidl;l=666?q=cellularidentifierdisclosed%20imsi https://cs.android.com/android/platform/superproject/main/+/...
- spiesd 2y agoI'm interested in the general thrust, but this article is sloppy at best. > Check digit: The final digit is essentially used to validate the prior 14 digits with an algorithm. Similar digits exist in other types of identifier codes, such as the Universal Product Code (UPC) and the International Standard Book Number (ISBN). The algorithm that the mobile industry uses, the Luhn algorithm, is also used for social security numbers and credit card numbers. No, just no. SSNs (in the US) don't have check digits. Also: > Then there are network identifier numbers—the MAC address bestowed upon you by your WiFi network or mobile provider Huh? This nonsense ("bestowed upon") serves only to confuse. This is bad tech journalism: it fails to inform the masses, and is transparently worthless to experts.
- toxik 2y agoMany non-American SSN systems do have check digits.
- cesarb 2y agoThe Brazilian CPF (our equivalent to the SSN) goes up to eleven (literally) by including not one, but two check digits; IIRC, the first one (the tenth digit) is computed over the first nine digits, and the second one (the eleventh digit) is computed over the first ten digits.
- dhosek 2y agoThe geographic aspect of SSNs no longer applies either. My kids have SSNs that start with different digits than my own which was assigned under the old regime where the first digit indicated where the SSN was issued.
- xjay 2y agoAndroid defaults to sending the IMSI (SIM ID) to Google. > SUPL is used as part of the A-GPS (Assisted GPS) system to get a faster Time to First Fix. The problem is that Android's implementation automatically sends the IMSI (ID of the SIM card) to the SUPL provider for no apparent reason. And because Google is the default provider it's a big breach of privacy. https://github.com/Magisk-Modules-Alt-Repo/supl-replacer https://github.com/Magisk-Modules-Alt-Repo/supl-replacer https://en.wikipedia.org/wiki/Assisted_GNSS https://en.wikipedia.org/wiki/Assisted_GNSS
- ale42 2y agoFrom the article: it will generally start with a 35, which is unused as a country calling code It's "unused" because several country codes start with 35: Ireland, Portugal, Luxembourg, Iceland... (This doesn't mean that phones are actually manufactured there... I have a phone with an IMEI starting in 354 and it's definitely not manufactured in Iceland...)
- lxgr 2y agoYeah, they seem to be confusing that with IMSIs or ICCIDs, which are indeed namespaced by mobile country code and international calling code respectively. Based on what other commenters have already pointed out, this seems to be a quite sloppily researched article.
- misstuned 2y agoThis is interesting - I hadn't noticed this, but my Chinese (Xiaomi) phone indeed has an IMEI starting with 86, which is China's dialling code. Perhaps a coincidence. The ICCID starts 8944 - not sure of the significance of the 89, but 44 is the UK, where my SIM card (and me) comes from.
- ale42 2y ago89 is the MII (major industry identifier) according to ISO/IEC 7812 (https://en.wikipedia.org/wiki/ISO/IEC_7812 https://en.wikipedia.org/wiki/ISO/IEC_7812). First digit 8 includes the telecom industry.
- redminote12pro 2y ago[flagged]
- gandalfian 2y agoAlso a rare UK success story in brute force lawmaking. People used to hack phones IMEI all the time, lots of utils available. Then anything relating to changing an imei was heavily punished and it all stopped. Nobody would host a utility or a guide or even mention it on a forum. If you did mention it you were banned. It was almost instant.
- chirau 2y agoIs there any entity or procedure that actually proves what a phone is what it claims to be? Unfortunately, neither IMEI, Serial Number or a combination of both can assert this. I bought a Samsung S24 a week ago off Facebook Marketplace. It was in the box and everything. I cross checked both the IMEIs and also the Serial Number with the #06# test. I even checked them online. Did all the tests, #0# and even downloaded Samsung members. Paid for the phone, convinced it was a genuine one. Upon registering it and using it, it becomes very clear the phone is fake and is at best a clone. The camera is nowhere near the S24 and does not have the features. It heats up after charging and does not keep charge. It runs slower than a 10 year Android once you are signed it. when you run diagnostics, it shows all the specs of an S24 Ultra. How do I know this? I went and got another S24 Ultra from the store and they are worlds apart. So my question is, if you are buying a phone from a reseller or someone, is there any way of definitely asserting whether it is authentic?
- yardstick 2y agoThis is typically where consumer rights laws come into play and a key advantage of buying first hand from a “real” business rather than an individual or third party. At least there you have someone you can easily hold to account. You need to price in the risk factor when purchasing where such legislation doesn’t apply or isn’t easy to enforce.
- tschwimmer 2y agoI’m sorry that this happened to you. The debugging and tear down sound like they would make for an extremely interesting blog post though. I encourage you to write it up and post it here - I’d definitely read it.
- miki123211 2y agoSome YouTuber bought one of these (not specifically an S24) and found a hidden app that "told" the phone what it should be. You could set how much RAM you wanted, how much storage, what CPU and so on, and then that info would be shown in all the "about" screens. They went to a few Tb of ram if I remember correctly. Changing any of these parameters didn't have an impact on what the phone could actually do, just to be clear.
- sfx2000 2y agoInteresting thread - as someone that used to be in carrier space... IMEI - we only really cared about the TAC prefix, as this identifies the device type, which is mapped to capabilities for services. IMSI - this is usually in the SIM card (UICC), and mapped out specifically within the uSIM/SIM application inside the card. This is aligned with the Billing/Rate Plan for services that the subscriber is set up with. TMSI - this is usually what the network uses to page you and also deliver singaling over the NAS via the SGs interface for devices that do not support IMS/VoLTE ICCID - this ID's the card itself, for SIM cards, it always starts with 89 as this designates the card as telephony related as a physical UICC - remember, there are other types of UICC's such as CHIP based Credit Cards, which start with a different number. MSISDN - this is the number that you dial and send SMS to - in legacy systems, it can also be referred to as the MDN Fun Fact that was skipped in the article - IMEI's that start with 99 are special, as these indicate that the Device is both GSM/UMTS/LTE and CDMA/EVDO capable, and generally those IMEI's will align closely with the CDMA MEID's, but they were not required to. The "99" range wasn't just Apple, but was used in the early days of dual-mode across most vendors as it helped facilitate session handovers from C2K to any 3GPP based service. For C2K, on the IMSI front, most devices would use IMSI_T (True IMSI based on the SIM card IMSIef) but some used IMSI_M which was based on the legacy MIN. Legacy - there is the ESN in CDMA, but this is very legacy, and was largely superseded by MEID - for Legacy Support, pESN could be derived from MEID, however at the high risk of collisions...
- thedougd 2y agoMany a year ago, when the iPhone was new and Android was on version 1.6. Sprint offered the SERO plan, an unlimited plan for friends and family. When smartphones hit, they would no longer allow the SERO unlimited plan to transfer to the new phones. The HTC phones had a Qualcomm radio that, with the right tooling, one could write all 0s to the IMEI (or the CDMA equivalent) register. Then you could write any IMEI to the register. That worked well for a few years.
- sfx2000 2y agoSERO was one of the Sprint Rate Plans, the other was the Pioneer Plan for early adopters on SprintPCS HTC got into a bit of trouble with the carriers on the whole IMEI/MEID rewrite mess at the end of the day. With Qualcomm, that was an NVITEM that was supposed to be read-only.
- m463 2y agodidn't I read recently about some manufacturer that shipped many of its phones with the same imei? EDIT: "Over 13,000 Vivo phones found to be using same IMEI number" https://www.techradar.com/news/over-13000-vivo-phones-found-to-be-using-same-imei-number https://www.techradar.com/news/over-13000-vivo-phones-found-...
- mannyv 2y agoI remember some telco guy saying “the IMEI is unique until it isn’t.” We always wondered if you could crash part of a cell network by dropping in 8192 phones with the same IMEI. Everyone needs to deal with non unique identifiers, but the question is how many do they expect? FYI this is a problem on Ethernet, when you get boards that haven’t been initialized. Things don’t like multiple MAC addresses with 0s.
- username135 2y agoI have been looking for information like this for a while. Thank you! Follow up, does the IMEI number get broadcast when you connect, or is it a searchable bit of information accessible by apps, et al? Im wondering how anonymous you can be if youre making all the right privacy moves, but your phone is still essentially giving you up because your IMEI number is traceable back to you.
- ztetranz 2y agoFun fact: Lots of cellular modem/routers have the easy ability to change IMEI. Doing so is a fairly common practice in the rural internet community. i.e., those using cellular for their internet access either because cable / fiber or an official cellular option like T-Mobile home internet is unavailable or they're mobile in an RV. These people are not trying to do anything particularly nefarious but they do it so that they can use a phone or tablet plan in a router. Unlimited or high GB plans for routers and hotspots are expensive and there are not many options. There are lots of reasonably priced, easy to get unlimited phone and tablet plans but if you put a phone SIM in a router it might work for while until the carrier detects that you have the SIM in an unauthorized device. The "solution" to that is to activate on a spare phone and then change the router IMEI to match the phone. Don't use both devices at the same time. The carrier now thinks the router is a phone. The legally of it is somewhat unclear so it's talked about quietly on various forums using words like "magic configuration", "giving your router an identity crisis" etc. It's a bit of a cat and mouse game because IMEI is probably not the only way to identify an unauthorized device but so far it seems to be the main way.
- sambazi 2y agoglorious reminds me of changing mac address to get around data caps in the student dorm network
- vel0city 2y agoI remember back in the 00's on AT&T getting an unlimited data plan addon for a dumb phone was like $15/mo or something while adding it for a smartphone was like $40 or more. They would enforce it by checking your IMEI and seeing if it was one of the smartphones they sold. Buying an unlocked phone of a model AT&T didn't sell seemed to never trigger the "you're using a smartphone" check. Fun times with some cheap 3G back in the day.
- solidsnack9000 2y agoIt is a minor part of the article, but I'm surprised they introduced it only to get it so wrong. The U.S. Gun Control Act of 1968, among other things, requires traceable serial codes on guns, something that has become a key element of forensic ballistics. In some circles, this is seen as controversial, as highlighted by a case involving “ghost guns” that the Supreme Court is hearing this session. First of all, serial numbers don't have much to do with forensic ballistics. Generally, in forensics, investigators are comparing items in their actual possession -- shell casings, bullet fragments, and weapons recovered from the scene of a crime or from a suspect. Serial numbers don't help with that. Serial numbers are useful in investigating gun trafficking -- it's actually very similar to the example of car theft that the author presents early in the article. Regarding the "this is seen as controversial", that is a claim that is absurd beyond belief. What is at issue in the case is when the requirement to serialize adheres and to what it adheres. That is a complex issue. A gun is made of dozens of components. Many are tiny with small surface areas, like springs and pins, and many are replaced over the life of a gun, so serializing them would (a) be ineffective and impractical and (b) could actually confuse the identity of the gun. So when do we serialize and what do we have to serialize? For a long time, the settled practice in the industry has been that there is one component that is "the firearm". This part generally is large, is subject to low mechanical stresses, and can be expected to last the life of the gun. This is generally a part called the "receiver" or "frame". If the receiver is ever damaged beyond repair, regardless of the state of the other parts, then a "new" firearm has to be created and serialized. Although the barrel, trigger, &c, are all the same, it is a different gun now. This system has actually worked pretty well and has allowed for relatively robust tracing of stolen guns and guns found in investigations of international arms trafficking. Collections of parts that make up an incomplete gun are of two kinds -- if the receiver is in that collection, the collection of parts is a firearm and has to be sold according to the rules governing transfer of a firearm; if not, it isn't. A receiver or frame starts life as a large block of metal or plastic. So what if we sell people a parts kit where we have every part of the gun except the receiver, and also an appropriately sized block of metal or plastic? Nothing in this combination has to be serialized and it is not a firearm. Until recently, this was not really an area of much activity because, while a receiver is subject to low mechanical stresses, that is in relative terms -- relative to other parts of the gun. It is nevertheless a component that takes a fair amount of machining and finishing to get made. What brings us to the "ghost guns" discussion and the Supreme Court case linked in the article, is the degree to which home manufacturing with light tools has improved in recent years. It is actually possible now to make a pretty good receiver without a machine shop. Some people came up with a business of selling people almost complete guns, with a block of plastic or metal and some jigs that allowed them to readily complete the receiver. This is an edge case and it will take some thought to establish when, exactly, we apply the rules regarding serialization. The people making blocks of plastic probably will not be required to serialize all blocks of plastic simply because they are potential firearms (along with potentially being many other things); but the people buying the blocks of plastic to put into kits that they then sell to others in order to make guns probably will be seen to have created a "constructive firearm" and so will be required to serialize them.
- deleted 2y ago[deleted]
- 0898 2y agoI prefer to buy second hand iPhones for my family, and usually use Amazon. But the last couple of iPhones haven't been able to connect to the cellular network at all. Digging into it, it seems they've been IMEI blocked – i.e. reported stolen. Sending them back to Amazon is always such a pain because it means a visit to the post office.
- amelius 2y agoInstead of calling it "IMEI Code", perhaps we should call it the "IMEI Cookie".
- Havoc 2y agoAnybody know how frequently these get transmitted? Phones seem to switch off wifi regularly for energy savings, so not particularly useful for detecting iphones at home for home presence automations
- Someone 2y ago”Other” isn’t really correct, is it? The IMEI is your phone’s number, your phone number isn’t tied to a phone, but is your user name/chat handle with your provider.
- calrain 2y agoIs it possible to record IMEI codes of phones around your location? Say... to help identify if a specific phone comes around, or what phone/s were around when a break in occurred?
- eknkc 2y agoIf you buy a phone in Turkey, it's IMEI is registered to a gov authority and you can use / transfer it as you wish. If you happen to buy one from another country, it will be locked after 60 days of use and no carrier will connect it after that. You can use your passport to to prove that it was not imported commercially but you brought it with you and register it. For $1000 (yeah). And it is locked to your ID. Can't transfer it to someone else. IMEI cloning from an already registered donor phone was a thing and maybe it still is but as far as I can tell, high end phones pretty much lock it tightly. BTW, this also affects a lot of other stuff. Can't buy a gps dog tracker from amazon. Can't buy a gsm module for your arduiono etc... My car has a connectivity system where it provides internet to the in car infotainment system and also allows me to open doors etc remotely. It only recently became operational when the distributor finally managed to register the IMEI numbers. A lot of companies do not bother (Mercedes, BMW etc are equipped with similar systems, not operational)
- vegetablepotpie 2y ago> Can't buy a gsm module for your arduiono What do you mean by that? Ostensibly I can. https://www.adafruit.com/product/2687 https://www.adafruit.com/product/2687 Note: it’s on back order, but in theory I would be able to buy a GSM module for my Arduino.
- circuit10 2y agoFrom reading the message, it wouldn't work in Turkey because the IMEI is blocked
- anticensor 2y agoit is a whitelist, not a blacklist
- meeb 2y agoThey mean you can buy the adapter, but it won’t work in Turkey as the EMEI isn’t on the official allowed list and isn’t registered.
- 2y ago
- BXLE_1-1-BitIs1 2y agoThe instructions to changing firmware on a tablet before repartitioning had me backing up and restoring IMEI and MAC address etc.
- lozank 2y agoVery interesting! Super cool to see it can be used against theft. AFAIK some apps misuse it, though. If Snapchat detects a modified phone (root for example) at any point, it might block your IMEI. (As far as the internet is concerned, they're very secretive about it) Which is a horrible decision, since a phone might be re-locked and refurbished, handed down to someone else, etc.