6

In the UK the process for unlocking a mobile phone (cellphone) usually involves either buying an "unlock code" from ebay which you then have to put into the phone to unlock it, or taking the phone to a back-street phone shop (where I presume they just generate the same code and enter it for you). Either way it seems to take several minutes to generate the code.

The phone does not have to be present to generate the code (just the IMEI number is needed), so the unlock process isn't reprogramming the phone itself. I first thought it was brute-forcing some kind of security key, but this doesn't seem tenable because the manufacturers could simply increase the strength of the key and render this impossible.

It seems that unlocking must be done with the manufacturers consent, but why does it take so long and why does it only seem to be available via the grey market.

What I'd really like to know is what is the technical process behind generating the unlock code. Can anyone throw any light on this?

Improve this question
2
  • 1
    Are you sure only "grey market" solutions are available in the UK? This page says otherwise.
    – Neil Smithline
    Dec 30, 2015 at 20:52
  • 1
    When unlocking is illegal, I believe the process is that a "mobile phone service provider" contacts the manufacturer to get your unlock code. Those mobile providers are shady operations that don't really exist and are continually under legal pressure due to pissing off real mobile providers who have lots of money for lawyers and want you locked into their service.
    – Neil Smithline
    Dec 30, 2015 at 20:58

2 Answers 2

Reset to default
2

The phone's manufacturer does some crypto (most likely an obscure and proprietary algorithm) in order to derive a NCK code (unlock code) from the IMEI and presumably a secret key, and that code toggles something in the mobile phone modem to disable a whitelist of allowed networks, so the phone is now considered SIM-unlocked.

For the iPhone, NCK codes were (are?) used as well internally but the process was as the unlock request goes through Apple and the user himself isn't prompted to enter the code. Instead the phone will get it automatically from Apple the next time it's activated (along with the usual stuff it gets during activation like client certificates for notifications and iMessage). Apparently this has changed and SIM-locking is now enforced by the OS rather than by the modem; the allowed networks are now defined in a WildcardTicket, a configuration file received from Apple's servers upon iPhone activation.

I'll leave it to someone more experienced to provide more details and possibly tell which algorithms are used to generate these codes.

Improve this answer
2
  • If I understand you correctly, you're saying that there is no brute-forcing going on, and the unlock code can only be provided from the manufacturer. In this case, I don't understand why the manufacturers don't just offer it directly to the public at a cost higher than you can buy it for on Ebay (I recently paid £3 but would gladly have paid £10 direct to the manufacturer for something that I know is legitimate and approved)
    – Andy
    Dec 31, 2015 at 11:38
  • @Andy no bruteforcing indeed. The third-party unlocks either use the official algorithm once it's been leaked or exploit software flaws in the modem's firmware (like unofficial iPhone unlocks). As far as for why manufacturers don't offer it, that's because of their agreements with the carriers.
    – André Borie
    Dec 31, 2015 at 16:11
-1

I think IMEI number of a phone is just like WPS pin of a router.If you are knowing the IMEI number and the right encryption algorithm (in case of WPS there is a 8 digit pin, mainly 7 and the last digit is just a checksum.The pin is divided into two parts first 4 and last 3 digits each encrypted with a 128-bit random noice which are sadly not so random and we can perform bruteforce attack to get the right pin through which we are able to tell the router that we are a legitimate user and the router hands over the passkey) we can get the password of the phone.

Improve this answer
1
  • This does not answer the question. By the way the IMEI is more like a MAC address and isn't supposed to be secret nor used like a PIN.
    – André Borie
    Dec 31, 2015 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.