The fact the IMEI is generally not editable seems like a massive privacy hole. Just let people edit it. Then I can be someone new every day and nobody can track me. Mac address randomization does that for wifi. Now do the same for mobile networks.
I really want mobile networks to accept their role as dumb data pipes. I should be able to just provide a password or certificate and connect. No IEMI, no SIM. And while we are at it stop tunneling my data back "home" when I travel. I don't want increased latency.
The IMEI Code: Your phone’s other number
101–110 of 174 posts
Re: The IMEI Code: Your phone’s other number
#102Earlier quoted context omitted.
> As far as I remember, the ICCID never actually appears in standard network messaging. Yeah, that would be the IMSI (which a given SIM card can have multiple of, e.g. for switching to a more beneficial home network while roaming!) The ICCID is useful for identifying a given physical SIM card (e.g. so that the phone can link a given user-selected profile name to it/the associated phone line for a "preferred line for…
I have heard of people calling emergency numbers to test if a phone is working, but never a country making that impossible. Here, I had always assumed that repeated nuisance callers would be investigated to see if there's an actual problem, and charged with a crime if they're doing it for no good reason. Always thought it would make more sense to have a dedicated "test number" for this purpose. Probably with some rat…
Re: The IMEI Code: Your phone’s other number
#103Earlier quoted context omitted.
> Surely the uniqueness is only required at the bottom end of the stack before the first 'router' ie the cell tower Not if you need to send a message to $thatUniquePhone. Over simplifying considerably, but if a land line places a call to a mobile, the "220-1234 calling for 220-7890" message enters the network. The `220-7890` phone number needs to map to the unique modem address so you can look up which tower the call…
Assuming something like VoIP is in use, you reach other devices with their IP addresses, not MAC addresses.
If you have a wired connection, this makes the MAC completely superfluous. The concept is sort of still valid for wireless connections (or of course for "wired" connections where you have multiple devices physically connected by the same wire, a bus, where the concept originated). It should be rethought.
Re: The IMEI Code: Your phone’s other number
#104Also a rare UK success story in brute force lawmaking. People used to hack phones IMEI all the time, lots of utils available. Then anything relating to changing an imei was heavily punished and it all stopped. Nobody would host a utility or a guide or even mention it on a forum. If you did mention it you were banned. It was almost instant.
Re: The IMEI Code: Your phone’s other number
#105Earlier quoted context omitted.
[dead]
These are AT commands, which specify (one way of) communication between a modem or phone and a PC, or maybe a smartphone OS and a baseband. The phone/baseband doesn’t talk to the network in AT commands.
Re: The IMEI Code: Your phone’s other number
#106Also a rare UK success story in brute force lawmaking. People used to hack phones IMEI all the time, lots of utils available. Then anything relating to changing an imei was heavily punished and it all stopped. Nobody would host a utility or a guide or even mention it on a forum. If you did mention it you were banned. It was almost instant.
Re: The IMEI Code: Your phone’s other number
#107The U.S. Gun Control Act of 1968, among other things, requires traceable serial codes on guns, something that has become a key element of forensic ballistics. In some circles, this is seen as controversial, as highlighted by a case involving “ghost guns” that the Supreme Court is hearing this session.
First of all, serial numbers don't have much to do with forensic ballistics. Generally, in forensics, investigators are comparing items in their actual possession -- shell casings, bullet fragments, and weapons recovered from the scene of a crime or from a suspect. Serial numbers don't help with that.
Serial numbers are useful in investigating gun trafficking -- it's actually very similar to the example of car theft that the author presents early in the article.
Regarding the "this is seen as controversial", that is a claim that is absurd beyond belief. What is at issue in the case is when the requirement to serialize adheres and to what it adheres. That is a complex issue. A gun is made of dozens of components. Many are tiny with small surface areas, like springs and pins, and many are replaced over the life of a gun, so serializing them would (a) be ineffective and impractical and (b) could actually confuse the identity of the gun.
So when do we serialize and what do we have to serialize? For a long time, the settled practice in the industry has been that there is one component that is "the firearm". This part generally is large, is subject to low mechanical stresses, and can be expected to last the life of the gun. This is generally a part called the "receiver" or "frame".
If the receiver is ever damaged beyond repair, regardless of the state of the other parts, then a "new" firearm has to be created and serialized. Although the barrel, trigger, &c, are all the same, it is a different gun now.
This system has actually worked pretty well and has allowed for relatively robust tracing of stolen guns and guns found in investigations of international arms trafficking.
Collections of parts that make up an incomplete gun are of two kinds -- if the receiver is in that collection, the collection of parts is a firearm and has to be sold according to the rules governing transfer of a firearm; if not, it isn't.
A receiver or frame starts life as a large block of metal or plastic. So what if we sell people a parts kit where we have every part of the gun except the receiver, and also an appropriately sized block of metal or plastic? Nothing in this combination has to be serialized and it is not a firearm.
Until recently, this was not really an area of much activity because, while a receiver is subject to low mechanical stresses, that is in relative terms -- relative to other parts of the gun. It is nevertheless a component that takes a fair amount of machining and finishing to get made. What brings us to the "ghost guns" discussion and the Supreme Court case linked in the article, is the degree to which home manufacturing with light tools has improved in recent years. It is actually possible now to make a pretty good receiver without a machine shop. Some people came up with a business of selling people almost complete guns, with a block of plastic or metal and some jigs that allowed them to readily complete the receiver. This is an edge case and it will take some thought to establish when, exactly, we apply the rules regarding serialization. The people making blocks of plastic probably will not be required to serialize all blocks of plastic simply because they are potential firearms (along with potentially being many other things); but the people buying the blocks of plastic to put into kits that they then sell to others in order to make guns probably will be seen to have created a "constructive firearm" and so will be required to serialize them.
Re: The IMEI Code: Your phone’s other number
#108Re: The IMEI Code: Your phone’s other number
#109Fun fact: Lots of cellular modem/routers have the easy ability to change IMEI. Doing so is a fairly common practice in the rural internet community. i.e., those using cellular for their internet access either because cable / fiber or an official cellular option like T-Mobile home internet is unavailable or they're mobile in an RV. These people are not trying to do anything particularly nefarious but they do it so tha…
reminds me of changing mac address to get around data caps in the student dorm network
Re: The IMEI Code: Your phone’s other number
#110Android defaults to sending the IMSI (SIM ID) to Google. > SUPL is used as part of the A-GPS (Assisted GPS) system to get a faster Time to First Fix. The problem is that Android's implementation automatically sends the IMSI (ID of the SIM card) to the SUPL provider for no apparent reason. And because Google is the default provider it's a big breach of privacy. https://github.com/Magisk-Modules-Alt-Repo/supl-replacer…