Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WhatsApp is using your IMEI number as password

samgranger.com

Post reply on HN
Print view View original

71–80 of 83 posts

Re: WhatsApp is using your IMEI number as password

#71

Post by andyking »

objclxt wrote: post #7
dfc wrote: post #5

"Dial *#06# for IMEI" Does anyone know any other neat tricks like this?

They're GSM feature codes - implemented features vary from carrier to carrier, but there are lists of commands here: http://www.stereo.org.ua/2007/gsm-codes/ http://www.arcx.com/sites/GsmFeatures.htm There are additionally model specific codes for hardware diagnostics (rather than interacting with the network) on a model-by-model basis.

Yes - on my network, Vodafone UK, these are the ones I can remember off the top of my head:

  *#1345# - gives you your credit balance if you're on a prepaid account
  *#100# - your phone number
  *#101# - the current network date and time
  *#[102-105]# - various network engineering information that I can't understand.
You can also, as long as you're on original GSM and not 3G, use the 'cell broadcast' feature to make it show you the current area code you're in (or more accurately, that your current tower is in). This is a throwback to an ancient price plan which gave cheaper calls to your local area. It's very much deprecated, so some newer cells don't broadcast the area code info, and no 3G cells do so.

Re: WhatsApp is using your IMEI number as password

#73

Post by adole »

objclxt wrote: post #6
Xuzz wrote: post #2

There is no public API on the iPhone to access the IMEI, so at least it is pretty conclusively not using that there.

Good post - although for posterity retrieving a phone number doesn't work as described in all cases. Calling `getLine1Number()` on a GSM phone will return the MSISDN, but not all carriers store the MSISDN on the SIM (for security reasons), so it will in some cases return null. This is a somewhat moot point, because there are other ways to find mobile numbers! As you point out, this is almost certainly an Android spec…

xxx

Re: WhatsApp is using your IMEI number as password

#75

Post by CrazyRobot »

aw3c2 wrote: post #29
CrazyRobot wrote: post #28

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place. And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this…

An unsalted(!) md5(!) is never a perfect solution unless your goal is insecurity. The idea of using the IMEI as unique device dependant string for hash generation is good but you must make it impossible for anyone to find out how the hash is created or it is a glaring security hole (as demonstrated). Many many apps have permissions to read the IMEI. Just as many have access to the internet. Add whatever permission is…

I'm assuming that they (WhatsApp) were trying to make the experience as close as possible to SMS without help from the carriers, so by using the phone number (which they verify, by the way) and the phone itself as the credentials -- only one of which most people replace, and that's mostly once every 2-3 years -- is a great idea for getting users to their platform with a minimal security tradeoff, hence in my opinion a perfect solution.

And again, if an app had fooled a user for permissions to get their phone number they could probably just ask for permissions to send and receive SMS's -- which is what some banks (at least here, in Israel) use to verify online accounts.

Re: WhatsApp is using your IMEI number as password

#76

Post by CrazyRobot »

zurn wrote: post #59
CrazyRobot wrote: post #28

This actually seems to me like a perfect solution (from WhatsApp's side). This way as long the user has the same phone number, he/she doesn't have to remember any credentials, which is probably the main reason (or one of the top 3) for people using WhatsApp in the first place. And as for the "security problem", if someone has access to your phone they can just maliciously use the app itself. I'm not saying that this…

IMEI isn't related to the phone number (IMSI is). And it's a horrible idea since IMEI isn't secret.

I should have said the phone number on the same device. And like I said in my original comment, you need some kind of access to the user for getting the IMEI (unless you work for one of the carriers, but the point still applies) so in lots of cases it would be easier to just physically do something worse on the phone itself.

Re: WhatsApp is using your IMEI number as password

#78

Post by saurik »

Xuzz wrote: post #2

There is no public API on the iPhone to access the IMEI, so at least it is pretty conclusively not using that there.

WhatsApp in fact is using NSClassFromString to get access to the private class UITextEffectsWindow ;P. However, I don't think it doing anything to get access to CoreTelephony and pull the IMEI.

Another piece of evidence for this is an article published on a website I found while searching for the API endpoints that WhatsApp is connecting to; this person pulled apart the Android client.

http://www.mathyvanhoef.com/2012/05/whatsapp-considered-inse...

In this article there are a few API calls that are discussed, including v1/exist.php and v1/code.php: the former takes an argument sim=MSISDN and the latter takes both sim=MSISDN and imsi=IMSI.

However, on my device (iOS), all of the other fields are being sent (including the MCC and MNC, which you can apparently get using the public CTCallCenter API) except those sim and imsi fields.

(Note: the actual service seems to run over XMPP, and I did not bother figuring out how I'd man-in-the-middle that to figure out my password, so maybe they do something really sneaky at a later step.)

Re: WhatsApp is using your IMEI number as password

#79

Post by st3fan »

The more scary part of this is that WhatsApp probably has a database with phonenumber/imei number pairs on their servers.

The fact that their API uses the IMEI is not great but relatively low risk.

Wait until their servers get hacked and that list of how-many-million pairs of phone/imei numbers gets released.

Setups like this are time bombs.

Re: WhatsApp is using your IMEI number as password

#80

Post by dserodio »

deltaqueue wrote: post #17

An "Ask HN" that's somewhat related: Is Facebook doing something similar on Android? I have left an application update pending for weeks because Facebook requires access to Phone Calls , which allows the application to "determine the phone number and serial number of this phone, whether a call is active, the number that call is connected to and the like." This does not sit well with me.

Check if PDroid is available for the ROM you use, it allows you to choose which permissions to allow for each app. I've blocked Facebook access to the GPS and Contacts using PDroid.
Post reply on HN