Hacker News Reader

Comment by Cantbekhan | Hacker News Reader

Off-topic but IMHO what is really needed these days is a privacy feature allowing all the UIDs to be changed freely by the user (without the need for rooting and firmware thinkering).

Including randomized IMEIs and randomized Android ID (In addition to the already offered randomized MAC and Ad tracking ID changes). Especially IMEIs which are commonly used by many applications and law enforcement to track users (see Banking apps for instance that all require your phone permissions to read such IDs).

Nor Librem nor Pinephone offer this functionality from what I know.

And no, it's not (yet) illegal (but might be against some ToS) in many countries to change your IMEI including the US (see https://en.wikipedia.org/wiki/International_Mobile_Equipment...).

View on HN

I don't have the reference, but I am pretty sure that in order to meet requirements for type-approval (e.g. FCC approval in the US) phones have to show they are resistant to IMEI modification.

You may actually be very interested in the work here:

https://xnux.eu/devices/feature/modem-pp.html

https://xnux.eu/devices/feature/modem-pp-reveng.html

They were able to get root access within the modem. Depending on how the IMEI value is stored, it may actually be feasible here.

Not sure if it’s possible from running Android on app CPU, but people with copies of QXDM all knows how to do it from PC

Respectfully, I think you misunderstand the page. The Quectel EG25-G is the modem only, the main CPU on the Pinephone is an Allwinner A64 ARM Quad core Cortex-A53. The modem itself has its own linux kernel, app space, etc.

Oh I expected Qualcomm MDMs to run some proprietary RTOS with some NVRAM write protection, but if Linux is already in control then certainly an on-the-fly IMEI switch without resets or QPST/QXDM sounds more feasible.

They do. These types of Qualcomm modems run QuRT, a proprietary RTOS, on the Hexagon processor which handles the baseband and the LTE stack. There is also a shitty little core that runs "psuedo-Android" - you have adb and things like that, but it's mostly a more traditional embedded Linux environment- and handles certain AT commands (they actually go to the baseband first, but get IPCed over to Linux for handling after parsing if they match a registered command).

With root on psuedo-Android, you can probably get code exec on Hexagon - especially for the cheaper modems, they have an older version of the Hexagon architecture and to work under this architecture things like ASLR are relatively rare. But it's more work - there's no obvious "execute arbitrary shellcode" IPC message, you need to do more RE/VR.

In Germany it's punishable by law indirectly (https://tipps.computerbild.de/hardware/firmware/imei-nummer-...), in UK it is a direct crime that may yield 5 years of jail time (https://www.legislation.gov.uk/ukpga/2002/31/notes?view=plai...).

Be fucking careful when you are traveling with a phone that has an IMEI in the software that does not match the one on the sticker.

I don't really see an issue for manufacturers there. We have the same regulatory issue with Wi-Fi power which will adjust transmission power differently based on the country it's sold in. The phone could easily enable to disable a feature depending on where it is. Remember Bolivia dBm limits ? :)

Regarding your German link. It's about tampering with evidence which I suppose means it's about changing the IMEI after a crime to hide yourself. I suppose that would be illegal everywhere?

Regarding your UK example, the law in question (https://www.legislation.gov.uk/ukpga/2002/31/section/1) mentions circumstances and gives exceptions:

" But a person does not commit an offence under this section if—

(a)he is the manufacturer of the device, or

(b)he does the act mentioned in subsection (1) with the written consent of the manufacturer of the device. "

So I guess it's okay in the UK if the manufacturer allows it and is okay with it?

But of course I'm not trying to promote this feature for illegal use but mostly to hinder "inescapable" tracking from Advertisers , Mobile Operators, ISPs, Phone Manufacturers and ...

True, in some regions this is not allowed. It was mainly for the purpose of blocking stolen IMEIs though which is not really a thing anymore (since Apple/Google's activation lock is so good there's no more need).

Also, for avoiding tracking purposes there is really no point in changing your IMEI. There's many other ways they can track you. In fact I don't see any real reason to do it at all.

The german link has no source.

How would a cop even know about this and arrest you? Being serious.

Easy: check if the imei on the back matches the one shown in the software as part of a theft check. Threaten the user with seizing it for suspected theft or whatever if they refuse.

That would only work if you are already under suspicion for something. I don't think many random cops knew how to check the IMEI, also because you'd have to open the phone up. (I think so?)

You're mixing a few different concerns together. With a properly designed permission system, applications do not get access to identifiers such as IMEI and MAC addresses. If an application demands some information as a condition of running, a proper permissions system should return appropriate mocked data.

The only place the actual IMEI should remain a concern is when talking to the cell network. Mitigating this is an unsolved problem, and it needs to be worked on. Some ideas - staying in contact mostly via Wifi (and only turning on the cell radio for dire situations), or a carrier that deployed sims that periodically rotate IMSI.

> to change your IMEI

Not exactly the same, but in Librem 5 you can at least replace the whole modem.

I was almost certain changing your IMEI was a serious federal crime in the US.

Absolutely not (yet).

Also, swapping the modem chip would (well, should) be a permitted use, as the IMEI is meant to be bound to the modem. When a separate modem module is used, the modem is the communication device, not the phone.

The pinephone is more similar to a laptop with an optional LTE module rather than an integrated setup like an smartphone where the CPU contains the baseband. It's not illegal to swap out modem cards in a laptop anywhere AFAIK.

That is a persistent myth, because it is blanket illegal in other countries. In the US, it is only illegal to change an IMEI in furtherance of some other crime - eg theft or unauthorized access.

Not yet illegal, agreed.

The old fashioned way was using QPST/QXDM to modify the ESN/IMEI of phones but that was questionable enough. This also includes bluetooth mac address too and other UID's in the baseband. :)

Changing the IMEI is illegal in the UK FYI and has been since 2002. https://www.legislation.gov.uk/ukpga/2002/31/introduction

Perhaps this legislation gives you a clue about how on the ball some Govt's are when it comes to security matters?

What you are suggesting is a phone that changes its obvious identifiers, but the problem with that is some services may not work, maybe an app purchased from an app store, or the network services you get from your cell provider, like answer phone facilities when you are in a dead zone. So if your phone is acting like a character out of Scanner Darkly, just how will it operate? How will your friends know its you calling if they dont recognise your number?

To have a cellular network that allows random identifiers, you would need a system which accepts prepaid communication time, but in todays age, just like bitcoins is a public ledger how would you convince someone to build a cellular network that accepted untraceable communication time tokens?

Whether you like it or not, Science stole your privacy the day you were born and continues to steal your privacy including your thoughts. Perhaps your best bet for some privacy is to limit your contact with other entities whilst also trying to change the laws for the better but as this requires interaction with other entities, it seems like you want a paradoxical situation to exist.

> Whether you like it or not, Science stole your privacy the day you were born

I don't follow.

I think you have 3 paragraphs describing that the problem comes from irresponsible government agencies, entrenched private companies, and existing public infrastructure. But then you conclude that the reason GP can't have privacy is because science is in the way. I don't see how you got from point A to B.

> your best bet for some privacy is to limit your contact with other entities whilst also trying to change the laws for the better but as this requires interaction with other entities, it seems like you want a paradoxical situation to exist.

This is a somewhat strange way to think about privacy. Privacy isn't binary, and personal information isn't fungible. It's possible to reveal some information about yourself in some contexts, and then hide other information in other contexts.

Of course, lobbying is harder if you're trying to be private (heck, voting in the US is harder if you're trying to be private). But engaging with the system doesn't immediately mean you lose all of your privacy across the board. Yes, we do sometimes talk about privacy in bits -- but the full scope of privacy ultimately can't be represented by a single number in a math equation.

The IMEI just identifies your phone. The IMSI identifies your number.

So it's perfectly possible to change the IMEI if you leave your IMSI alone. The network will think you just stuck your SIM in another phone. Everything will work fine. You can't change your IMSI as it's hardcoded on the SIM (technically you could with an eSIM but it simply would be unrecognised and just not work then).

Of course they still know who you are, and they need to to connect your calls. But apps that look at the IMEI for identification will be confused. Not sure how much it helps in terms of privacy. I doubt it helps a lot as any app can just make up a random number and dump it in their long-term storage to know it's you (just like a cookie).

And yeah the illegality of changing it is an issue in some countries. Also, if you 'clash' with another live IMEI weird things happen :)

PS: IMEI changing was outlawed in those days to stop people stealing phones and changing IMEIs to resell them and bypassing carrier blocks of the stolen phone. It was never that successful as thieves are lawbreakers by nature and don't care at all whether they break an extra law or two. Apple and Google's activation lock were much more successful. I'm personally not a big fan of laws when there are technical solutions that are equally or more effective.

AFAIK, a SIM card itself has a card id (ICCID), which should not be changed and is not used often. The subscriber id (IMSI) is in the "application" layer of the card and theoretically could be changed by the provider, or as a speciality, multiple ones installed.

That being said, I've never actually seen a card's IMSI changed. They usually give you a new sim and IMSI, even for a replacement card.

Most SIM cards are one-time programmable, so they can’t change anything on the card. They do still have a small RW area, but thats generally for user data (contacts).

You can get SIM cards that have large amounts of storage for running applets and have better support for OTA, but most carriers don’t like the extra expense.

Aren’t most SIM cards today use over the air provisioning since networks employ thin provisioning theses days?

Yes they do almost all support it (with many security vulnerabilities as a result, Karsten Nohl did a really great presentation on this at OHM2010). But the IMSI is almost always provided at manufacture time.

I think it's also because the card would not be able to be provisioned over the air without getting connected to the network first, and without an IMSI there is no network connection :)

> How will your friends know its you calling if they dont recognise your number?

Apps could handle this sort of thing quite easily. The app itself could have its own ID (i.e. the username you use to sign into that service) and then that's what's presented to your friends and kept in their address books. You could change that whenever you wanted to as well (and then your friends would have to update their address books), but you wouldn't have to in order to change the other IDs, and that ID would only be used for that one service rather than allowing correlation between different services.

> To have a cellular network that allows random identifiers, you would need a system which accepts prepaid communication time

Not at all. If you wanted to change your IMEI, you would just have to give your carrier the new one, which could be an automated process. And your carrier could be a MVNO you trust not to share the correlation between your current IMEI and your account information with anyone. Meanwhile the towers then only have to know that that IMEI is authorized as a customer of that MVNO and send the bill to the MVNO.

But wait, is that changing the on-device IMEI, or just spoofing it when communicating with some random app?

I assume changing the device IMEI would have the same affect of directly spoofing it when connecting to mobile networks, which may be illegal; but If I leave all that alone, and only give a false IMEI to some random app, while connecting to mobile networks with the legitimate one, then what's the issue?

This is the way to do it for legally mandated identifiers like that. Only the baseband knows the actually IMEI, otherwise the OS just blanks it out or randomizes it, down to kernel calls.

Still isn't a very good solution, since you need to have a consistent identifier for some parts of networking to work, such as MAC addresses, IPs, bluetooth MACs, etc.

You can use software crypto keys to prove your identity.

Reply on news.ycombinator.com