Hacker News Reader

Comment by segfaultbuserr | Hacker News Reader

Looking back, it was unbelievable to see how huge the storm caused by Intel's "processor serial number" in Pentium 3 was, that even forced Intel to withdrew it.

Meanwhile, nobody has ever said anything about the serial numbers of hard drives, GPUs, motherboards, RAM modules, Ethernet MAC address, etc, etc, etc. Nowadays, basically everything comes with one UUID.

Pretty illogical, isn't it?

> We've long lost the war on privacy.

Agree. I understand UUID is important in engineering for many purposes, but the fact that nobody is talking about it anymore (because they are nothing when compared to more severe issues like fingerprinting) indicates we've long lost the war on privacy.

View on HN

Would love to see a YouTube channel or blog where somebody systemically takes apart their computer and starts reflashing every serial number in flash/EEPROM with 0x00.

It’s not like any of these are phoning home (I hope), or married together, so there’s nothing to kill clones.

> It’s not like any of these are phoning home (I hope)

Firmware is largely closed-source, so all you can do is hope.

> reflashing every serial number in flash/EEPROM with 0x00.

It will be an amazing video, but good luck if the device in question has (very likely):

* a mask-ROM / OTP-ROM for a serial number - almost all microcontrollers and EEPROMs sold nowadays has at least one permanent and unchangable UUID for hardware tracking and DRM implementation (security-through-obscurity tricks to prevent rogue competitors from copying your firmware).

* "firmware read-protection" - which means the only way to dump the EEPROM is performing a full-chip erase and destroy the entire firmware, commonly used in embedded systems to stop rogue competitors from copying your firmware.

I just knew that RAM DIMMs usually have a 24 or 93 series chip on them, and figured that could be re-programmed (or replaced with a reprogrammable version if the existing chip is non-compliant).

In many cases, a) the unique id's are in read-only parts of the flash and b) the system firmware won't work if it can't read a unique id that matches a (signed) stored ID somewhere in its system.

In many cases, this isn't for anything user-facing. Unique ID chips can be very useful for detecting factory-overrun counterfeits ("oh, your $widget does this notable, nonfunctional behavior? Where did you purchase it, perchance?").

Changing the IMEI number of a phone is illegal in many countries.

My phone required it.

When purchased, it had an IMEI of all zeroes, and came with a step by step guide to setting the IMEI from my old phone into it.

Apparently that works around phone providers who blacklist or whitelist certain manufacturers.

Can you please expand on your phone? What model is it? It sounds very unusual for the user to be able to change the imei.

A knock-off Umidigi A3 Pro.

It's an awesome Chinese $50 android phone.

Because it hasn't passed all the network tests, most mobile networks would block an entirely random IMEI, so they suggest you type in the IMEI from your old phone (as long as it's 4g - if it isn't, they have a support email address you can contact and they'll give you an IMEI that works in your country)

Even the legit Umidigi A3 Pro's (which cost $80, and have proper certifications) have an 'imei change' tool.

Not for long I'll wager...

I'll wager the opposite. Of course it's not legal anywhere, but I don't expect any customs people to be able to tell that a phone comes with an changeable/unapproved IMEI.

Meanwhile, nobody has ever said anything about the serial numbers of hard drives, GPUs, motherboards, RAM modules, Ethernet MAC address

Let's not forget every single page printed by a color printer.[1]

[1] https://en.wikipedia.org/wiki/Machine_Identification_Code

Furthermore, in many OS those unique numbers are not protected from applications. For example, in Linux any application can read any hardware identifiers without any specific permissions. For comparison, in Android an application needs to have a permission to read phone or IMEI number.

Yes.

BTW, how does Windows hash your hardware serial numbers for DRM nowadays? I haven't used and checked it for a long time. Is it still the harddrive and the motherboard?

Barring an extremely risky, one-off backdoor in the management engine or your board or device firmware; there should be no reason why your hard disk, GPU, board, memory, and NIC UUIDs (MACs are configurable, and random by default in NetworkManager and some other network configuration systems) are available to third parties on a regular basis, unless you put software on your computer to make that happen.

Don't run spyware on purpose.

> unless you put software on your computer to make that happen

Couldn't that be ... any software?

Well, you could start by not installing software that you know exfiltrates these data, like Microsoft Windows, or Adobe Flash...

Even in free software, do you audit everything you install? Information security is only as strong as the weakest link.

Why not start with software which isn't known to deliberately disseminate information about your computer. Sure, if you move the goalposts all day, you'll never score.

Reply on news.ycombinator.com