59

For instance do they know whether you're using an iPhone or Samsung?

  • 11
    yes, even without the user-agent, and without device fingerprinting, just by the logs. for example you can tell chrome from firefox by the way they fetch video. i'm sure phones are the same. – dandavis Jan 8 '18 at 9:02
  • 3
    they don't say. given the cost of data storage, it's safe to assume indefinitely. Data mining algos are always getting better, so why not have more data? Is losing a long-term insight worth a few hundred MBs? – dandavis Jan 8 '18 at 9:05
  • 2
    @AlexanderA - That will depend heavily on Jurisdiction. ISPs in some places could be legally required to hold data for a minimum of X years meanwhile in another there could be a maximum legal retention. – Hector Jan 8 '18 at 10:58
  • 3
    Given that HTTPS is being used always more, I doubt that the user agent scan will be alive forever – usr-local-ΕΨΗΕΛΩΝ Jan 8 '18 at 13:41
  • 2
    @LateralTerminal A random ad might be running JavaScript on your device. Your ISP generally won't be, unless they're performing some kind of content injection. One doesn't really imply the other. – Chris Hayes Jan 9 '18 at 4:59
62

Depends on the device and if you have taken any steps to hide it. Most devices by default put a lot of identifying information in the User-Agent header on outgoing HTTP/S requests. For HTTP requests these will be visible to anyone with wire access. For example for Android from here -

Mozilla/5.0 (Linux; U; Android 4.0.3; ko-kr; LG-L160L Build/IML74K) AppleWebkit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

Mozilla/5.0 (Linux; U; Android 4.0.3; de-ch; HTC Sensation Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30

And for iPhones -

Mozilla/5.0 (iPhone; CPU iPhone OS 6_1_3 like Mac OS X) AppleWebKit/536.26 (KHTML, like Gecko) Version/6.0 Mobile/10B329 Safari/8536.25

Mobile carriers/providers meanwhile have access to your IMEI which uniquely identifies your device.

*As @Anders points out there are also service fingerprinting techniques. Any connection to a manufacturer related applications/service could be an indicator. As could profiling of data patterns (a simple approach would be fingerprinting device update files). I initially leaned towards user-agents because the original question asked about ISP's / this approach can be used no matter how the device is connected (i.e. IMEI is only visible to your carrier unless they forward it on. User-Agent would be visible on non-encrypted requests from any internet connection - WiFi, ADSL etc).

  • 1
    Does the IMEI part apply to Samsung as well – Alexander A Jan 8 '18 at 8:05
  • 7
    @AlexanderA - Yes. IMEI is universal across all "standard" modern devices (anything 3GPP compliant) including but not limited to anything GSM (2G), UMTS/HSPA/EDGE (3G) or LTE (4G) compliant. On many devices you can change/spoof your IMEI but this is in many jurisdictions highly illegal. I also wouldn't be surprised it networks could detect and block duplicate IMEI's. – Hector Jan 8 '18 at 8:34
  • 2
    WhatIsMyBrowser.com's User Agents might be a good reference and it also includes Windows Phone, Blackberry, and many others. – Andrew T. Jan 8 '18 at 8:42
  • Please do not use comments for discussion or to ask new questions. – Rory Alsop Jan 9 '18 at 7:21
42

I worked for an ISP and yes we do. We know many things about your systems in the house.

A lot of them we learn from the router that we provide you, from vendor Mac addresses, from various headers you send out.

We also know who's computer belongs to whom and what kind of device it is(I think from MAC ADDR Mac Vendor Lookup) maybe IMEI as from comment above. We also know domain names on the device , what networking schema you have, passwords you have on the router.

I think if you were to avoid these things, you could:

  1. Don't use an ISP provided router.
  2. Use a VPN
  3. change headers

I several times would call customers to let them know that we cut their service becasue they were torrenting . They would say they weren't... The argument would always stopped when I pointed the exact computer that was torrenting

EDIT perhaps something weird to add. We know what you use on your computer too (at least what speaks to the internet) . I could see what you people torrented and with what tool too, Usually Utorrent. I could see what torrenting sites they went too IIRC.

Edit : To answer from comment "How to not use ISP provided router" in most cases after setup from your ISP, just have your router clone the mac address of the WAN interface if your ISP's router.

Edit 2: The ISPs that I am talking about are U.S market owners only. Despite having lived in Europe, I cannot confirm this ability within the European or other ISPs.

7

Short answer: YES

How?

MAC ADDRESS & TCP/IP stack profiling

ISP provided routers have access to your phones MAC address which is unique to your device and thus the manufacture of your device ... possibly even down to the model version or range of model versions of your device.

On some devices the MAC address can be spoofed, however, you would need root access on the device in question

The way your device communicates to various types of packets will allow for profiling of the device (both hardware & software) see here.

Alternatively you could use your own router ... which is preferable for numerous other reasons as well (speed, price, security)

HTTP (not https see here) packet header's User-Agent string

As Hector posted here user agent strings from your browser have quite a bit of identifying information in them (OS type, OS version, Browser type, Browser version, etc).

This string can be spoofed, there are various addons or settings in both Chrome and Firefox that can be used to change this string to anything you want, however, apps on your phone can make http requests of there own and may provide User-Agent strings that you can not directly control

Servers your phone accesses

You use your phone, and thus that usage causes your phone to contact various servers. Encrypted or not, the addresses of these servers is provided so as to allow for routing of the message to the destination. That being said, if you open the google play store (android), the iStore (iOS), your phone checks for automatic updates, the malware and or ad servers contacted ... your ISP will see this traffic and could pick up quite a bit of information just based on the addresses contacted and the amount of traffic sent/received from each server.

A VPN could be used to encrypt all of this communication (as long as none of these automatic update api calls are done before the OS full starts and VPN kicks in.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.