IMEI and phone number given to unknown sources. What are the risks?

Question

The facts:
A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend his Whatsapp account that was about to expire. We all know Whatsapp uses your number as user-name and the device IMEI (reversed and md5-hashed) as password. Certainly his account was compromised: someone would have been able to steal all his account data. This is why I completely deleted his account and uninstalled the app.

Disclaimer: I've read the security.stackexchange.com question What is the risk of leaking IMEI / IMSI numbers over a network but it's related to mobile device privacy and installed applications.

Now, my concern is:
Is it now possible to "clone" his device and possibly being claimed as responsible for misuses that he clearly didn't do? According to this source, should be possible.

Answer 1

Firstly and most likely, the phone number may be sold to lists that are bought for spamming, spoofing, phishing schemes, etc. There are quite a few 'bad' consequences to having your phone number leaked but none that are particularly nefarious (although attackers can try to infect your phone via an sms'd link).

In regards to the IMEI, this is just a device ID and really doesnt mean much if you are trying to 'clone' someones phone (instead you need the IMSI number for that). The article you linked to says:

Picture this scenario: You post your IMEI number on a website looking for an unlock code. Several months go by and you get a phone bill for $3,000 and details of calls that you've never made. Someone has cloned your phone and has been using your account, unknowingly to you.

That's not entirely accurate because it leaves out how the attacker actually clones a device. To clone a device, one must identify the device to clone. On a GSM devices, this is done by copying the SIM card and obtaining the IMEI number. The SIM card contains the IMSI number and together with the IMEI number, the attacker must listen and decode a the transmission key also known as the 'KI'. Once all of that is completed, you then could have a cloned device (well you still need to put it on a modified phone but that's a different story).

Bottom line, I would be far more concerned about my phone number being leaked as a privacy concern than my IMEI being leaked.

Also bear in mind that IMEI numbers change with each phone and that changes quite often for many people. If you are really concerned, change phones and get a new phone number.