13,500 Vivo Smartphones found running on same IMEI number
androidrookies.com
androidrookies.com
IMEI is not required when placing calls or transferring data since this is securely managed by the GSM chip.
For the "more reasonable" HNers...how about an opt-out of the feature?
If one of these devices gets IMEI blacklisted, now all 13.5K devices are blacklisted... Not so good.
I believe network-IMEI-registration isn’t the primary mechanism by which modern phone anti-theft works by, though, since the device-owner is free to change the phone’s network-reported IMEI (much like you can change an Ethernet controller’s network-reported MAC address.) I might be wrong here, though; the phone’s baseband might come up with its burned-in IMEI and check for validity with the server, before switching to any application-processor-requested IMEI. (You can get around that by just booting up the phone in a Faraday cage—but having to do that every time would definitely decrease the black-market resale value.)
For iOS, at least, I think the anti-theft works by getting onto wi-fi each time the SIM changes and asking some activation server about the validity of [some other internal static device-ID that can’t be tampered with in this way]. Not so sure what, if anything, Android does (Android’s case is harder, since for phones with an unlocked bootloader, you can always flash an altered firmware that has no anti-theft logic.)
Also for most phones it's trivial to change the IMEI to resell the phone, or simply part it out. Which sure, are more things manufacturers see as bugs, to the frustration of legitimate activity - hence Right to Repair. The majority of the world is honest. Let's not build ourselves into a prison just to fallaciously protect against the few who aren't.
Errr, to be clear, the reason that phones don’t get stolen is that there are anti-theft measures in place.
People steal similar types of item (e.g. car stereos, game consoles, Blu-ray players) all the time. There’s no reason other than anti-theft measures that phones as a type of item would be stolen any less than these other categories. (They’d actually be stolen far more, since they’re small/easy to slip into one’s clothes/not a weird thing to be carrying around; and are often found just left on tables at cafes or hanging out of people’s back pockets. They’re like cash, basically.)
It’s the same reason that people steal bicycles more often than they steal cars. Bicycles, despite being worth much less, are just much easier to steal.
> The majority of the world is honest.
Do you live in a city? I’ve had my bicycle stolen five times now. I’ve also been mugged twice. I’ve never had my phone stolen, though—because it’s worthless to the sort of dumb criminals who steal things just to hawk them on the street, rather than to fence them.
It doesn’t require a large fraction of the world to be dishonest, to result in most people in the world having crimes committed against them. A thief will steal from far more than one person in their thieving career. Especially in regimes where the computed ROI for going after certain types of thief (e.g. homeless, drug-addicted thieves) is negative (i.e. their prison housing costs society more than their thieving does, apparently), and so they’re never held for more than a day or two.
Most thefts are committed by thieves who operate alone. (This is verifiable at least for my own country; I asked a crime-statistics analyst friend of mine.) Thus, most deterrence is focused on deterring the thieves who act alone.
This is the same reason that “security locks” aren’t actually proof against professional thieves. They’re not meant to deter thieving rings; they’re just meant to deter the thieves who are acting alone. Such thieves might have watched a tutorial or two on YouTube on lock-picking, and they might have picked up a lock-picking set from AliExpress; but they don’t have (and aren’t willing/able to invest in) the sort of lock-picking skills/tools that professionals have (e.g. slide-hammers, impact drivers, etc.) so an average security lock will be enough to stymie them.
Same with clubs on cars: no proof against professional thieving rings, but good enough to make a thief acting alone look elsewhere.
Just like there is a qualitative difference in how people treat things that are “free” vs. “$0.01”, there is a qualitative difference in theft rates between “no security” and “trivial security.” Most property crimes are spur-of-the-moment, committed by people who didn’t come prepared to steal something, but just see an opportunity to take something and feel the need to have it. Put a trivial barrier in the way of taking things, and those spur-of-the-moment crimes committed by “amateur thieves” go away.
In any case, maybe that is not so much the case in the US. But this certainly is the case in Europe; a very, very large percentage of stolen phones are sent to facilities that will part them out or unlock them.
It also is true that someone selling a locked phone on Kijiji is likely to end up selling it to someone who has the skill or who knows someone that can unlock it.
But again, that's post-hoc statistics. You're looking at the world that already has the trivial disincentive against amateur thieving. So of course you'll see most stolen phones being stolen by professionals—the amateur thieves are already not bothering, so if a phone is being stolen at this point, it's being stolen by a professional thief!
In a world without that disincentive, the statistics would skew very differently.
I again compare to the market for stolen bicycles. Yes, there are professional thieves with "bicycle chop shops" et al. But there are also crackheads carrying around bolt-cutters who just want to take a bike they walk by, ride it back to the ghetto, and then sell it for $20 to a street passerby to buy their next fix. Most cities have a large bike-theft problem, and it's mostly from this kind of thief, not from professional thieves. Any "security bike lock"—i.e. any bike lock you can't just snip through with bolt cutters—stops this kind of thief.
Look at New York City, for example. There are two types of bikes in NYC: those with security locks, and those that get stolen the instant they're left alone for ten minutes. The security lock wouldn't deter a professional thief—but a professional thief prioritizes, stealing fancy bikes from e.g. university sports department bike parkades, and won't bother with your average commuter bike. The crackhead does not prioritize. They just want $20, and your bike is probably worth $20.
The selection process for phones is already there: unless you are a very good thief, you're not stealing cellphones. That's because realistically your two ways of stealing a cellphone is either skillful pick-pocketing/misdirection, or muggings. Now if you're a crackhead, mugging people is not a very good idea for obvious reasons, and the subtler ways of stealing a cellphone already select for experienced thieves.
The number one reason why bikes are stolen so much is not because they are easy to steal, it is because there is essentially no risk of getting caught. No one will give a shit if you're stealing a bike, and so even professional bike thieves will simply pop your lock with a Ramset gun without a care in the world and be on their merry way hours before you even notice. Whereas stealing a cellphone, unless very skillful, requires direct confrontation, which is not an issue.
>But again, that's post-hoc statistics. You're looking at the world that already has the trivial disincentive against amateur thieving. So of course you'll see most stolen phones being stolen by professionals—the amateur thieves are already not bothering, so if a phone is being stolen at this point, it's being stolen by a professional thief!
I seriously disagree for the reasons I outlined above. The kind of people that would steal phones are the kind of people that know how to offload it. Again, maybe this is different in the US, but anyone with shady friends here could figure out how to fence a stolen phone. It's really not nearly as exclusive as you might think. I personally know two people I could offload a stolen phone (that I entered into contact via my elementary school of all places), and I am very, very, very far from being the kind of person that needs to steal phones in order to subsist. The hardest crime I ever did was to give my friend a USB key with mp3s of Akon in 2011.
And even if it wasn't the case, do you really think a crackhead would not try to steal a phone anyways? Of course they would, and they could probably figure out a way to fence it for 20$ or so. They just don't want to because stealing something that is either in your pocket or in your hands 24/7 is way too much risk for way too little reward.
The only thing IMEI blacklisting has succeeded in doing is making it a bitch to buy phones on the used market. At any time the seller could do insurance fraud and claim the phone is stolen and now that phone is (domestically) a tablet at best and the purchaser is left with no recourse. At least with a vendor system like iCloud, there's a fast way to make sure the phone's signed out when you do a purchase on Craiglist or other third party site.
At some point we're going to be looking at titling phones (I'm amazed Apple hasn't done so yet) if we ever want to see a used phone market without insurance requirements happen again.
Right now, if you buy a phone and it ends up on the blacklist after the return period, you can find a service that changes the IMEI or figure it out yourself if you can stand to wade through forum FUD. Since a significant number of blacklisted phones are from broken finance contracts, a phone simply being in the blacklist does not imply that it was stolen - a broken finance contract is a civil matter purely between the carrier and the original owner. Therefore, rewriting the IMEI on such a phone is completely legal, at least in the US.
Whereas if phones had titles, then a financed phone could have a legal encumbrance recorded on that title after you thought you'd bought it outright, and changing the IMEI to get out from that would be illegal. Phones are not incorporeal, immovable, expensive, or dangerous devices. Lacking all of the usual justifications for existing title systems, heading away from draconian registration makes more sense than heading towards it.
Bikes are actually a great analogy. Even though bike thefts are a concern, I still wouldn't want any of my bikes to have a built in location tracking to discourage theft! I'd rather suffer the mitigations I mentioned above, and consider losing a beater bike as part of the cost of transportation, than have my movements permanently recorded.
Similarly, I did and still do have no problem carrying a few hundred dollars cash. In general, remaining an autonomous individual requires being in possession of things of value that you control. Relying on some overarching system to take care of them for you results in that system inherently controlling you.
Activation lock actually helps to reduce phone theft, but IMEI blacklisting is basically totally worthless. It's way too easy to change a phone's IMEI for it to be useful, and you often don't even have to do that, since just taking the phone to a foreign country is often enough to evade the blacklist.
You will notice this happen - If your phone is stolen in Europe, it will almost invariably end up later in North Africa, then disappear entirely shortly after. Similar stories for stolen phones in NA, I'm sure.
As for iOS anti-theft, that also can be defeated in various ways.
In any case, anti-theft is not a proper justification for IMEIs being unique. Any anti-theft in a device that has been integrally stolen will be bypassed. These phones get fenced to people in third world countries with very very good reverse-engineering and electronics skills, and it only takes one to find out how to bypass any given issue. And worse comes to worst, they will sell the parts and still make a few hundred dollars out of your phone.
For MAC addresses (also mfgr-allocated) mistakes like this are “fine”, because MAC addresses are layer-2 (switch-local) and therefore a collision will translate to a direct, customer-visible problem: they’ll buy two of the same device, and then their LAN will start acting wonky. As such, market forces will address dumb Ethernet equipment mfgrs, pushing them out of the market as customers stop buying them.
But the people buying cellular handsets aren’t the same people running the network, so there are no market forces in play to push back against dumb handset mfgrs. Instead, the network operators must just play with the hand they’re dealt; and that means coming up with alternative strategies for managing handset connectivity that don’t involve the theoretical primary key (IMEI) but instead make use of other unique keys (e.g. IMSI) that are also included in the connection handshake.
> mfg came from manufacturing; its existence meant that some people started using it for manufacturer as well; but having a g in the abbreviation without one in the word bothered people, so they added an r to make it mfgr.
This leads me to wish there was a well-researched blog for abbreviation/initialism/acronym etymologies, the way https://grammarphobia.com/ is for English word etmologies. But I guess there aren't that many of these that are in need of explanation; usually they're pretty obvious.
Something that always amuses me is that the two-letter abbreviation for Shanghai is SH. I find this funny because it seems so natural from an English perspective.
In fact, of course, nobody cares what English speakers think about a Chinese abbreviation of a Chinese name, and the H in the abbreviation refers to the second H in the word, not the first.
The identifiers actually used over the air are the IMSI (normally written once at the SIM factory and never changed, used as a fallback if no other identity is available), the TMSI (assigned by the core network when the user attaches, can be reassigned at every attach, service request (return from idle to active state), or mobility event that the core knows about), and RNTI (assigned by each cell, changes at each handover, used to address each downlink transmission to the mobile and I think included in the CRC in each uplink transmission from the mobile).
If you just receive a random transmission off the air, you can get the RNTI; if you receive an initial signaling message to the core network you'll get the current TMSI if assigned; you'll see the IMSI only in case of a new SIM or a SIM where the core network has forgotten who it assigned that TMSI to.
There are also some temporary identifiers between the cell and the core network allocated when the cell starts talking to a mobile and released when the mobile goes idle, but these never reach the mobile.
The core knows the IMSI and optionally IMEI of everyone connected. In normal operation, each cell only knows some temporary identifiers (it has the opportunity to record IMSI if the mobile sends it, but the mobile doesn't normally do that).
All the details are available from 3gpp.org, and I can be more specific about which section of which doc if anyone actually cares.
Though with 13000 devices affected either it was a problem in manufacturing or someone in the Service Center was not doing the job too well...
Hard to imagine for me how this could have happened. I don't know precisely how IMEIs are provisioned or stored, but I suspect they can be changed in software.
Trying to sell a used phone on line is tricky. Legitimate buyers may want the IMEI to check it's not a reported stolen phone. Illegitimate buyers may want a known good one to replace one on a reported stolen phone.
Carriers can blacklist IMEIs from their network (that's a threat they use for certification; they want to make sure families of devices are well behaved).
One of my phones was blacklisted from a carrier a few years ago. They said it was reported stolen. I brought them the receipt; I bought it new in box. They said it was reported stolen by a carrier in a foreign country. I'd been there, maybe ten years earlier, and never with that phone. The local carrier I was a customer of said they couldn't remove the block, since it was reported stolen by a foreign carrier. Seems fishy how carriers work together to ban IMEIs but do nothing to verify reports of stolen devices.
I'm not sure carriers would ban this IMEI if it's tied to 13.5k phones, but I'm sure they're not happy.
If you buy the $150 dongles, they have valid addresses like you would expect.
I wonder: is there a dialect of English in India in which this post follows rules of grammar? I found it uncanny-valley hard to read.
IMSI then can be taken to the carrier and the account holder details will be released by a warrant.
An IMEI (which in most countries it will be illegal to change/clone) only identifies the hardware.
So swapping SIMs between phones don’t help to do anything apart from identifying a number of phones that you have access to.
3/4/5G phones will always drop back to 2G if it sees a 2G service whilst 3/4/5G frequencies are jammed.
So you need to realise that phones by design are tracking devices, and stock up on those burner phones and never switch them on near your home :)
It’s easy to get a burner phone in some countries, but many you need a passport or government-issued ID to even get a prepaid SIM! Let alone a phone!
Governments really don’t like citizenry to be anonymous.
*#*#4636#*#*
This also works for most android phones, with small exceptions.
[1] : https://ibb.co/JvZVHXF
No idea yet how widespread the implementation is as I’m teaching myself all of this in my spare time!
A *# code doesn’t count here also ;)
This is not always true. For example, Jio is an LTE-only network and phones are set to "LTE only". They will never switch to 3g/2g.
And if the state has access, you’re one social engineering step away from the keys to the kingdom shrug
PS: I wonder why you'd call one of the world's largest LTE networks "obscure". Number of Jio users is probably comparable to entire population of USA.
> GSM security, is everything. Getting the metadata of who you are and where you are, and being able to capture that passively is pretty sensitive metadata, I’m sure you’d agree.
Does that mean they bribed somebody working at a factory? I'm not sure what could be gained by this. Having an "untraceable", replaceable phone? Wouldn't those be easily blacklisted once it's discovered?
At a mobile game dev company we had a hardcoded list of bogus IMEI numbers. If a device returned an IMEI that was on the blacklist, we'd use another method to identify the device.