Hacker News Reader

Comment by bcherny | Hacker News Reader

It’s interesting that IMEI seems to be the primary key that much of these backdoor commands rely on. Collating your IMEI against historical info, the government knows where you’ve been and with whom; collating it against other personal data, it can figure out your address, employer, birth certificate, etc.

I wonder how people might obfuscate or rotate their IMEIs, to prevent this kind of tracking and collation?

View on HN

Oh, I see the misunderstanding; this is fully intentional and by specification. Think "please don't encrypt SNI we need to spy on people" but much more sinister.

The whole 2G thing in this article is really outdated, though. So much so that they featured this kind of tracking in The Wire (remember "Stingrays"). But that only really matters for external actors; if the government controls the mobile providers, all of this and much more remains possible.

Who would have thought that a unique ID required to connect to the cell network would be used to track everyone....

Chile collects your IMEI to get a sim card.

AT&T does too for prepaid cards. If you pull the card out of an iphone to try it in an Android or vice versa it blocks the card.

They also will know your IMEI the moment you connect to the cell network.

But they might not know who it belongs to.

Only if you somehow acquired a SIM card which doesn't 'belong' to anyone.

It’s pretty easy to do in a lot of countries. The US doesn't require ID to buy some pay-as-you-go SIMs.

Of course, you could probably determine identity either from video cameras or, more likely, people using the phone and connecting to various towers, but you if you were diligent you could make it really hard.

I'm pretty sure the USA also collects all IMEIs...

>I wonder how people might obfuscate or rotate their IMEIs, to prevent this kind of tracking and collation?

Spoofing your IMEI won't do much considering it's tied to your IMSI (sim card). You'd need a burner phone + burner SIM for actual anonymity.

Even then it can be relatively easily correlated if you are a high enough value target.

I doubt you can get burner phones and/or SIMs in Iran.

In Singapore when you try to buy a tourist sim, it's recorded to your passport.

There's a rumor that you only get 5 within 1 year before you get flagged. Never tried to verify, but I wouldn't be surprised.

There are stores that will sell you SIMs without ID, but they get busted pretty regularly.

One idea that came to my mind is what stops someone from using a foreign SIM with roaming? Assuming of course the SIM isn't tired to your identity?

A roaming SIM itself would be a red flag. On the other hand, grabbing a man based on SIM ID on the street wouldn't be an easy thing in a large city.

SIM tower triangulation is only accurate to a hundred meters or more in a large city.

It's like that in nearly every country now.

Wouldn't burner sim be enough?

Your IMEI is specific to the phone (or rather the SIM slot), and broadcast to the network operator when you connect.

It could be done manually by swapping sims between each other and storing the phones in random places throughout the day/night e.g in a service apartment under an apartment block.

Still the way the government acts there this would probably just incriminate others who have nothing to do with their cause.

> burner SIM for actual anonymity.

That or leaving your phone at home during protests. Of course, that won't help with automatic face recognition software that the Iranian authorities most certainly have set up in place already, but that's the rough deal of living in a tech-heavy society.

Or do phone + simcard swapping and use a higher level system for communication. So the mobile network as a whole becomes a communication channel where the mobile number itself is irrelevant. It’s only used as a mean to get on the network.

Havent give this too much thought yet but it could work.

That way Cellular Operators / Government can't see what you're doing (assuming VPN, no leaking, etc.) but they still can track where you are, very precisely, every second your phone is not in airplane mode or off. And with location, they know a LOT about you, potentially can infer identity at some point.

You could drop blind tower repeaters everywhere to make signal strength based triangulation useless, but short of that the only solution is to not carry a cell phone or at least keep them in airplane mode.

Apps like Briar can allow people to communicate peer to peer.

Locating cellphones based on towers is based more on the timing advance and less on raw signal strength.

And I'm not sure what you mean by "blind repeaters"? If that's the usual cheap dumb cellular repeaters one can find on ebay, than they will just cause noise on the cellbands if not properly installed and thus be actively hunted down by the telco as they degrade service.

Put the cheap dumb repeaters in vehicles, turned on only when in motion, or in backbacks, so the telcos have a hard time tracking them down.

Where possible, manipulate timing too.

Would this cause total chaos? Yes. Promise telcos the chaos ends when they agree to allow IEMI randomization like most WiFi devices do with MAC addresses today.

We will need some new forms of protest to get our rights to privacy back.

Without wanting to sound negative, as long as the cell network's function is to ensure that when someone dials 1-234-567-8901 my phone rings, won't they always need to know my phone's location, and the number-to-handset mapping?

That much is guaranteed, so people get a second phone number for use during protests.

The problem highlighted in the article is that merely changing your phone number isn’t enough if you continue to use the same physical phone.

This tracking technique is almost as old as spoofing your imei

Reply on news.ycombinator.com