Cellphones IMEI public exposed?

Question

Currently I'm in the middle of a developement process, and I have some security questions for you. I have a webservice, asp.net which is configured to run over https. The first authentication step for the cellphone is to retrieve the certificate from the server, public key ofc. The next step is to send the IMEI to a service to be sure that this particular phone is registered and allowed to send transactions to this webservice. My questions are:

• Is it possible for someone to get the IMEI without having physical access to the phone?
• Should I require the a client certificate from the cell phone?

Thanks!

Answer 1

On Android and Blackberry, applications can access the IMEI with no special privilege. On iOS, there is no documented API, and you may or may not get away with using undocumented APIs.

The IMEI isn't a terribly good way to identify a phone. Some exotic locales like North America have CDMA phones with no IMEI. All major platforms have a way to report a supposedly-unique identifier which doesn't change during the phone's lifetime (Android, iPhone), but they aren't always reliable. You can never know whether the reported ID is genuine (unless you make additional assumptions, such as your application being used on a non-jailbroken phone), so it isn't a method of authentication.

Unless you need a device identifier that survives uninstalling and reinstalling your application, generate a client certificate at provisioning time. You'll need something like that for authentication anyway, so you might as well use it to identify the device too.

If you want the ability to install your application to be tied to a particular piece of hardware, most smartphones today don't offer this. On any rootable phone, users can back up their installed applications and restore them on another device.