7

The facts:
A friend put his phone number (and possibly the IMEI) for his android device into some kind of hacking PC software that promised to (and actually did) extend his Whatsapp account that was about to expire. We all know Whatsapp uses your number as user-name and the device IMEI (reversed and md5-hashed) as password. Certainly his account was compromised: someone would have been able to steal all his account data. This is why I completely deleted his account and uninstalled the app.

Disclaimer: I've read the security.stackexchange.com question What is the risk of leaking IMEI / IMSI numbers over a network but it's related to mobile device privacy and installed applications.

Now, my concern is:
Is it now possible to "clone" his device and possibly being claimed as responsible for misuses that he clearly didn't do? According to this source, should be possible.

  • Your question(s) are not very well defined really... You should make sure you list all your questions clearly in the main body and not the title/heading. – Matthew Peters May 1 '14 at 18:28
  • This is the 1st question (at least here on I.S.). Sorry if it was not clear. I'll try to edit it someway (although I might say that someone liked it anyway, since has been upvoted. ;) ) – dentex May 2 '14 at 12:08
2

Firstly and most likely, the phone number may be sold to lists that are bought for spamming, spoofing, phishing schemes, etc. There are quite a few 'bad' consequences to having your phone number leaked but none that are particularly nefarious (although attackers can try to infect your phone via an sms'd link).

In regards to the IMEI, this is just a device ID and really doesnt mean much if you are trying to 'clone' someones phone (instead you need the IMSI number for that). The article you linked to says:

Picture this scenario: You post your IMEI number on a website looking for an unlock code. Several months go by and you get a phone bill for $3,000 and details of calls that you've never made. Someone has cloned your phone and has been using your account, unknowingly to you.

That's not entirely accurate because it leaves out how the attacker actually clones a device. To clone a device, one must identify the device to clone. On a GSM devices, this is done by copying the SIM card and obtaining the IMEI number. The SIM card contains the IMSI number and together with the IMEI number, the attacker must listen and decode a the transmission key also known as the 'KI'. Once all of that is completed, you then could have a cloned device (well you still need to put it on a modified phone but that's a different story).

Bottom line, I would be far more concerned about my phone number being leaked as a privacy concern than my IMEI being leaked.

Also bear in mind that IMEI numbers change with each phone and that changes quite often for many people. If you are really concerned, change phones and get a new phone number.

  • Thanks. Nice answer. It clears this matter a lot (as a sidenote, it seems that another answer, that I commented some days ago, has been removed...). Bye. – dentex May 2 '14 at 12:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.