Over 13k Vivo phones found to be using same IMEI number (2020) | Hacker News Reader

Over 13k Vivo phones found to be using same IMEI number (2020)

techradar.com

96 pointswalterbell85 comments

Whatsapp use to use IMEI reversed and md5 hashed as its password on Android (username was the users telephone number) - on iPhone they used a MAC address. I brought it up as a security concern back in 2012.

It would not surprise me if some apps still use IMEI (or MAC address) for similar purposes…

Third party Android apps cannot read the IMEI number. Source:

https://developer.android.com/about/versions/10/privacy/chan...

Since Android 10, released in 2019.

… which means that apps that are working on any kind of modern device can't rely on this behaviour, and thus can't generate passwords or other account critical secrets using this method. Apps written for modern Android phones can't use the IMEI for any legitimate purposes anymore, unless the device is rooted or the IMEI is exposed in some other unofficial way.

https://www.androidpolice.com/googles-latest-android-version... hints that ~49% of Android devices will give out the IMEI to third-party apps. [late 2021]

That's still a majority of devices where you can't assume that the IMEI is available. I'd argue processing the IMEI for legitimate purposes (i.e. generating device passwords) is not something you should rely on and instead you should come up with a solution that works in both cases.

It still works fine if your intent is to stalk users, though.

> That's still a majority of devices where you can't assume that the IMEI is available.

51%. Super strong argument there.¨

If an app can't use a certain logic for half of its install base, and needs a separate flow anyways, why would it bother with having two?

Third party android apps used to be able too 100%, it's a very callable action.

TelephonyManager tm = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);

Neither can iOS apps see identifiers like MAC addresses.

Glad to read that they removed this in iOS 11

In Turkey SIMs must be linked to ID. If you change owner of a phone number it goes trough approval from the government which takes a day.

IMEIs must be registered before sold. If you buy mobile phone from abroad you can use it for few months without registering the IMEI. Then the mobile networks do not respond to the mobile phone, even if you change the SIM. Registering a phone requires a passport, that proves you have visited abroad in that last 6 months. If longer, you cannot register. And the IMEI gets tied to the SIM. Plus, it is very expensive, like half minimal salary.

The device or one-time cost of registering a SIM?

Are there large chunks of the population that just use wifi-only phones?

The half minimum salary cost that I've said is to register IMEI, in other words to register the phone.

There is no wifi only phone or wifi network, if you really mean wifi. There are "only data" plans but for that you also need to register the IMEI.

Can you clarify, do you need a "half-min-salary" for any new phone, or for the ones imported from the abroad?

Last time I visited Turkie, I didn't had any trouble using the phone (except eye-watering 3G tariffs and somewhat spotty reception out of the main areas), bu the moment I tried to use a WiFi network in the mall it requested a SMS confirmation.

They probably filter foreign SIMs so you won't have an issue but people with local SIMs do need to pay a one time fee for phones you bring from abroad. (not for the ones you can buy here)

I've heard some people clone IMEIs from the old phone when getting a new phone from abroad and that it does reduce the cost significantly.

It is only for phones imported from abroad (yourself). You can use it for 120 days without registration. After that you need to register. The cost is 2732 Turkish liras.

They really hate revolutions over there huh.

IMEI is used for surveillance, yes, but also to identify devices. If one of these devices is used to abuse a cell network in any way, the ISP might just simply blacklist the IMEI and all those phones lose connectivity immediately, or, even worse, have their subscriptions connected to malicious behaviour. Some network providers might also block the device after one of those phones gets reported as stolen.

The slight extra hassle this will create for law enforcement isn't worth the massive risk of disadvantages that duplicate IMEIs have.

That's a surveillance problem, not a security problem.

Those phones were probably made for criminals who wanted to not be tracked...

I guess it might have worked for a while, but it was not a great idea...

I wonder if operators will block those IMEI, because in some countries, they might just refuse to block them...

> Those phones were probably made for criminals who wanted to not be tracked...

Not necessarily. It could also have been an employee who knew about the dangers of surveillance.

That's a feature for me, not a bug.

It's all fun and games until one gets reported stoled and 13,000 phones all stop working. I think something like this happened in India before.

Many providers in the EU will also gladly block connections based on IMEI if you can prove you're the owner of said IMEI.

Some providers auto flag repeated IMEIs

Yes, but if 13,000 phones have the same IMEI they all get blocked.

This sounds like a pure benefit to the user. Hopefully the "problem" will continue to grow.

Hope so too. Maybe one day IMEI addresses can be randomized as casually as MAC addresses.

Unless one of these phones has been used by criminals. There are numerous stories of people having the same name as a wanted person and suffering endlessly because of that.

That’s a problem if you’re one of 10 people that happens to. If it happens to 13000 people it’s the polices problem.

fwiw - Certain chipsets, such as Mediatek, make cloning IMEI, WiFi and BT MAC addresses quite easy. There's plenty of tutorials out there.

Perfect for privacy.

A rare case of bug that works in favor of people.

(2020)!

> While IMEI number may sound rather irrelevant for a common user, however, it becomes a grave security concern as it makes it impossible for cops to intercept criminals.

In the same way that not wearing a tracking collar is a security concern, because it makes it harder for the police to spy on you? We really should invent a new word for "security" that is actually "security against the user".

It's called surveillance.

Funny how rarely they call it that, isn't it?

Thought-provoking thread! Maybe I'm being too generous, but I think it makes more sense when you think about it 'top-down': 'national security', in the US 'the Dept. of Homeland Security', etc.

"Security" is a multi-perspective endeavor. When large institutions use the term "security" they are referring to their own security, which is generally at the expense of your own security. And unfortunately most people naively think that "security" is a scalar where more is good, when in reality they themselves are being made less secure by institutions pushing way past the Schelling points.

Surveillance state, digital restrictions management, treacherous computing appliances, "two factor authentication", airport searches, totalitarian schools, prohibitions on mobile phones or pocket knives, no outside food or drink, etc. These are all instances of making some central entity's position more secure, while running roughshod over the ability for individuals to make ourselves secure.

Sometimes people use “respect” to mean “treating someone like a person” and sometimes they use “respect” to mean “treating someone like an authority”

and sometimes people who are used to being treated like an authority say “if you won’t respect me I won’t respect you” and they mean “if you won’t treat me like an authority I won’t treat you like a person”

and they think they’re being fair but they aren’t, and it’s not okay.

— https://flyingpurplepizzaeater.tumblr.com/post/115216522824/...

If this is a legitimate concern to you, you should consider not carrying a phone. I know it sounds crazy, but I remember the times before everyone and their dog had a mobile phone - we somehow survived. Even if there's nobody out there to get you, it's very refreshing and calming to disconnect.

That would help me individually, but will do nothing to address my concern about society becoming a panopticon, and the proliferation of laws that make it illegal to attempt to evade surveillance:

For example, in the United Kingdom, under the Mobile Telephones (Re-programming) Act, changing the IMEI of a phone, or possessing equipment that can change it, is considered an offence under some circumstances. - https://en.wikipedia.org/wiki/International_Mobile_Equipment...

You also can't just change or hide your car's registration plates - it's also illegal. I 100% agree with your concern, but there's always a line to draw.

Sorry for the car analogy, I had to ;)

> possessing equipment that can change it,

On most pixel phones, the "equipment" is any computer with a usb cable and a copy of android SDK (adb). Better arrest every owner of said equipment...

You know this works for literally EVERY concern about privacy for ANY technology?

You should carry your phone, GPS on, with you everywhere all the time. The only exception should be when you need to go out and do something that will be frowned on by the powers that be. In those instances you should leave the phone at home playing a long YouTube video. If you are ever questioned about your whereabouts during that time your phone will supply a good (increasingly bordering on perfect) alibi.

Mouse/accelerometer jiggler?

Tape it over your washing machine and run a cycle.

Must be really easy to distinguish with the modern machine learning.

Nothing all that unusual about setting your phone down, propped up to watch something on it.

You mean a phone sends accelerometer data to CIA all day round?

https://news.ycombinator.com/item?id=26639261

Mobile phone radio basebands have been repeatedly compromised by multiple actors, including non-state.

This is exactly it. I had a friend who attended protests regularly. On protest day, they’d come into work, sign into their computer, set their phone on their desk, and then take the bus to the protest paying cash.

> This is exactly it.

No, it's not. If only people who require protection will try to have privacy, it will be very easy to target them. Everyone should have privacy to protect them. See also: https://news.ycombinator.com/item?id=31695383.

> I remember the times before everyone and their dog had a mobile phone - we somehow survived

We survived because lots of services and relationships didn't rely on people having a mobile phone.

Or just use a phone with a hardware kill switch (Librem 5 or Pinephone), so you can have access to the camera and emergency calls, when needed.

Note: IIUC, on the Pinephone you have to open up the phone to get access to the switches. On the Librem5, the switches are external; i.e. accessible from the outside.

Librem is a sad joke[1] when it comes to actual hardware security, so no, thank you. I don't know what's the situation with Pinephone, but I'd rather use a device vetted by people who understand hardware security better than me (e.g. an iPhone, or anything targeted by GrapheneOS). If I ever find myself needing a physical kill switch, all I need is to wrap it in aluminium foil. The rest of the chocolate bar is a nice bonus.

[1]: https://news.ycombinator.com/item?id=30761886

The claim they can track criminals seem bogus?

I mean in the US IMEI aren’t linked to a person, at least not required.

Neither are SIMs.

So if one really wanted an anonymous cell phone it’s not hard to do.

The IMEI is trackable and triangulatable geographically as it moves around the network. So it still helps determined actors to find the phone, and therefore maybe the user.

The same can be done with just a SIM though.

What IMEI gives you is the ability to track the same phone across SIMs.

Determined actors? Like Tom Cruise? He seems pretty determined.

Yes, but so is the ISMI, from the sim card, which is actually the primary identifier used for most things within the protocol. ISMI determines which phone number gets connected to the phone, who gets billed for phone calls, etc.

The main scenarios where IMEI should be interesting to law enforcement are: stolen phone situations, criminals that keep getting getting new burner sims while continuing to use the same phone, or people that keep prank calling emergency services without having a SIM installed.

In nearly all other cases, the ISMI is far more useful identifier. And obviously the phones in question all have unique ISMIs or the network would be having, err.... great difficulty with all of those phones having the same phone number, and being able to route calls.

US IMEI's potentially are. They are recorded upon purchase - from carrier or reseller.

Sims same, they are immediately tied to your account and if you are post paid, there you go.

Anonymous cell phones also aren't entirely possible anymore because of network effect and the convenience factor.

1. Network effect, who you know, who you call, when they call you - pattern. 2. Internet usage, where do you go? 3. Geolocation - GPS, proximity with other cell phones, and then internal measuring devices. You can disable reporting completely, sure, but triangulation is user carrier side data, and with 5g roll outs and other potential signal repeaters and cell phones, it's still very accurate. 4. Sideline recording of this data is possible, same as a heat map in googlemaps - just looking for repeatable patterns of usage, where you go, etc.

It's not only hard, cell phones nowadays are not designed for anonymous usage. And this is before we even get into adtech, app tracking and other layers of interaction.

Of course, you need to put some effort into staying anonymous. Use it often enough and it's not hard to find out who you are.

But there is no ID requirement in the US. You can buy a SIM for cash, buy a phone for cash.

This is unlike many other countries. Singapore links all SIMs to your ID at purchase. There is a black market for anonymous SIMs (linked to random people's IDs), but the police actively crack down on those.

There is increasing demand for ID upon purchasing - and you are also forgetting that prepaid cell phone purchases must be activated at point of sale - which can trigger a CCTV snapshot from the terminal and record the method of payment.

Sure, you can "walk" to the store, browse to the phone aisle, pick up a prepaid phone, wait in line, ring out and pay in cash and walk out - but that all creates a foot print, geographically at a minimum.

You can try a smaller store, franchised sure - but there will be recording of the transaction. Then the activation itself. Then the recurring topping up of credits to use the service.

As with Singapore/Japan/Indonesia and China, yes - pre-activated sims still are sold w/ government intervention and seizing information and terminating the sim in use - but another thing to note is that the telecom in those countries are also state enterprises. In the USA, they are not - not yet.

But, "effort" into being anonymous, is friction - and the more friction you need to overcome, the more opsec you need to execute to maintain a hygenetic environment. That's where it becomes impossible to maintain.

Maintaining anonymity is hard, but similar to security, you can take steps to make it harder for your average police officer to use it against you.

State level actor? Well then yeah, you’re screwed.

"US IMEI's potentially are. They are recorded upon purchase - from carrier or reseller."

I have two phones - an iphone I purchased with cash at an Apple store and a Pixel 4 that I purchased from Amazon. My Amazon account is not connected to any individual person or personal address ...

The former IMEI ... recorded by Apple as "dude with cash" and the latter recorded by some fly-by-night Amazon third party seller as (dude with Amazon pseudonym) ?

"1. Network effect, who you know, who you call, when they call you - pattern. 2. Internet usage, where do you go? 3. Geolocation - GPS"

Yes - very appropriate to be thinking about these things and their impact on ones ability to pseudonymously participate on the mobile network.

I've been thinking of a raspberry pi access point that advertises a collection of SSIDs that exist elsewhere ... which is to say, I would record my network scan of unique SSIDs next time I am in downtown Denver and then recreate all of them in my office in San Francisco at the push of a button ... I wonder if there is a collection of SSIDs that would transport my phone to a different geography ...

IIRC Apple stores all do permanently stored facial recognition and capture.

> My Amazon account is not connected to any individual person or personal address ...

Except your card and the delivery address? Along anything other you ordered on this account?

Delivery address is not my home address and belongs to a corporation.

I mean, come on - that's like a "must be this tall to ride" minimum for these kind of efforts, right ?

Card number ... sure, if Amazon wants to break every single PCI compliance[1] (and many other) rule in the book and compare my un-hashed credit card number with (card numbers from other vendors and suppliers) then, yes, they could start to paint a picture there ... but in reality, nobody wants CC information - it's radioactive and there is no upside to storing/viewing/comparing it.

[1] https://www.rsync.net/resources/regulatory/pci.html

I have a cell phone, originally postpaid and purchase with cash. I didn't to out of my way to keep it anonymous, paid my monthly bill with a cc. No bank or credit card company I do business with accept it when they request a tell number. I conclude is flagged as not properly ID'd, just like a Google voice number is flagged as quasi anon.

That is not, thankfully, how that works ...

There are, indeed, non-mobile numbers and they are second class citizens with regard to shortcodes and SMS 2FA, etc. You will have difficulties, for instance, if you try to adopt a Twilio number (or similar) as your primary phone number.

But it has nothing to do with identification, per se - the most anonymous, cash-bought, found on the street SIM card is a real mobile number and will work perfectly ...

... and the most fully ID checked, personally identifiable VOIP number will work very poorly with 2FA (and not work at all with shortcodes).

I am not sure about your specific anecdote - what carrier are you using and is your "number" the number on your physical SIM card ?

Tel number was issued by Verizon, as a prepaid number and I supplied my own phone so I imagine the their number and their sim card so the the number should be on the Sim, no? This all happened about 6 or 7 years ago, they didn't ask for ID of any kind at the time.

>I mean in the US IMEI aren’t linked to a person, at least not required. Neither are SIMs.

They are in most of Europe though. Since the terrorist attacks a few years ago, it became mandatory to link an ID to any new and existing SIM cards.

Some carriers (I.e. movistar/telefonica) are trying to capture biometric data as well to activate a sim card. That is pretty sickening.

"They are in most of Europe though."

Weirdly, Orange will sell anyone a "Orange Holiday Europe" SIM card that has no identity attached to it whatsoever.

I am using it now - purchased from Amazon for $40 - and it is an insta-connect SIM with talk/text/data that auto provisions a number and brings up service immediately upon insertion.

And yes, my Amazon account is indeed pseudonymous and has no connection to my name or physical address. That has always been the case.

> And yes, my Amazon account is indeed pseudonymous and has no connection to my name or physical address. That has always been the case.

How did you manage that? Credit cards, shipping addresses?

We have a private postal suite (which is just a mailbox) that we ship to - in a corporate name.

Visa and MasterCard don’t verify cardholder name - you can enter any name you want when checking out with a credit card. Our current “bullshit online retailer” nym is a character from Dune.

"no connection to your name" is not really accurate if you are using a credit card issued in your own name, even if you don't reveal that name directly to Amazon.

They're anonymous to the vendor, but of course not to the credit card company, issuing bank, or their own government.

I wouldn't be surprised if cardholder name was shared by the credit card network with a vendor the size of Amazon. Does anything forbid it?

The major benefit of making embedded devices with exactly same firmware from device to device is that you can pre-order memory chips already flashed.

Network cards do run into extremely uncommon MAC collisions because they just generate a random MAC on first start, which is then read, and printed after manufacturing.

Reply on news.ycombinator.com