4

I am using my own device on my college's Wi-Fi. I've heard that many pieces of information about my device such as my OS version is sent through a browser such as Google Chrome. But how can he obtain my serial number if he wants?

5

The Wi-Fi admin can only get your MAC Address of your device.

This is needed for you when connecting to Wi-Fi and to get a IP Address. But MAC addresses can be spoofed.

He cannot get the IMEI number, unless he make you install some software or App on you device.

He also gets your OS version and browser details is via the request Headers of browsers.

Here is a sample. You can see the User-Agent contains the info of your OS. In my case Windows NT 6.1 and browser information Firefox/38.0.

POST /posts/validate-body HTTP/1.1
Host: security.stackexchange.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://security.stackexchange.com/questions/135142/can-my-college-wi-fi-admin-obtain-the-serial-number-imei-of-my-device
Content-Length: 177

You can spoof this Information as well using various methods.

Edit:

The Above HTTP request headers can be read if you are browsing plaintext protocols like HTTP.

When a DHCP request is made the Hostname is sent as well.

| improve this answer | |
  • 2
    Works for HTTP only ofcourse. In addition, hostnames are sent as well in the DHCP request. – Yorick de Wid Aug 28 '16 at 10:22
  • 1
    @YorickdeWid Thanks for that. I added it in my answer. – Sravan Aug 28 '16 at 10:50
  • How many other protocols are used than http and dhcp? Do any of them send a serial number? – Enne Aug 28 '16 at 12:07
  • @Enne Most of the standard protocols like HTTP,FTP,SSH etc serial number(Unique Identifier) is never considered. These protocols are built long before Mobile devices are capable of connecting Internet. AFAIK, there is no widely used protocol that wants to identify serial number/IMEI of a device. AFAIK,only the software you installed may want to identify the device uniquely based on serial number/IMEI when there is a need for(ex:in case of License management). So, you have choose the software you install wisely like perfer Open source ones. – Sravan Aug 28 '16 at 12:39
  • 2
    IMEI is a telecom concept, so it is probably only used in communication with the cellular network (e.g. for Wi-Fi calling and such). In that case it should be protected by an IPSec tunnel, though. Additionally, at least iOS explicitly does not allow applications to get the device IMEI (I'm not sure what Android allows). – You Aug 28 '16 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.