News for hackers. Stuff that matters.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by segfaultbuserr on Wednesday June 12, 2019 @03:59PM (#20168652)
Looking back, it was unbelievable to see how huge the storm caused by Intel's "processor serial number" in Pentium 3 was, that even forced Intel to withdrew it.

Meanwhile, nobody has ever said anything about the serial numbers of hard drives, GPUs, motherboards, RAM modules, Ethernet MAC address, etc, etc, etc. Nowadays, basically everything comes with one UUID.

Pretty illogical, isn't it?

> We've long lost the war on privacy.

Agree. I understand UUID is important in engineering for many purposes, but the fact that nobody is talking about it anymore (because they are nothing when compared to more severe issues like fingerprinting) indicates we've long lost the war on privacy.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by Scoundreller on Wednesday June 12, 2019 @05:05PM (#20169307)
Would love to see a YouTube channel or blog where somebody systemically takes apart their computer and starts reflashing every serial number in flash/EEPROM with 0x00.

It’s not like any of these are phoning home (I hope), or married together, so there’s nothing to kill clones.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by segfaultbuserr on Wednesday June 12, 2019 @05:54PM (#20169722)
> reflashing every serial number in flash/EEPROM with 0x00.

It will be an amazing video, but good luck if the device in question has (very likely):

* a mask-ROM / OTP-ROM for a serial number - almost all microcontrollers and EEPROMs sold nowadays has at least one permanent and unchangable UUID for hardware tracking and DRM implementation (security-through-obscurity tricks to prevent rogue competitors from copying your firmware).

* "firmware read-protection" - which means the only way to dump the EEPROM is performing a full-chip erase and destroy the entire firmware, commonly used in embedded systems to stop rogue competitors from copying your firmware.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by Scoundreller on Wednesday June 12, 2019 @06:47PM (#20170140)
I just knew that RAM DIMMs usually have a 24 or 93 series chip on them, and figured that could be re-programmed (or replaced with a reprogrammable version if the existing chip is non-compliant).
Re:Saudi Arabia tracks runaway women by cellphone IMEI by InitialLastName on Wednesday June 12, 2019 @05:56PM (#20169741)
In many cases, a) the unique id's are in read-only parts of the flash and b) the system firmware won't work if it can't read a unique id that matches a (signed) stored ID somewhere in its system.

In many cases, this isn't for anything user-facing. Unique ID chips can be very useful for detecting factory-overrun counterfeits ("oh, your $widget does this notable, nonfunctional behavior? Where did you purchase it, perchance?").

Re:Saudi Arabia tracks runaway women by cellphone IMEI by dmos62 on Wednesday June 12, 2019 @05:48PM (#20169680)
> It’s not like any of these are phoning home (I hope)

Firmware is largely closed-source, so all you can do is hope.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by RachelF on Wednesday June 12, 2019 @08:30PM (#20170786)
Changing the IMEI number of a phone is illegal in many countries.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by londons_explore on Thursday June 13, 2019 @03:14AM (#20172460)
My phone required it.

When purchased, it had an IMEI of all zeroes, and came with a step by step guide to setting the IMEI from my old phone into it.

Apparently that works around phone providers who blacklist or whitelist certain manufacturers.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by boredishBoi on Thursday June 13, 2019 @04:56AM (#20172894)
Can you please expand on your phone? What model is it? It sounds very unusual for the user to be able to change the imei.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by londons_explore on Thursday June 13, 2019 @05:26AM (#20173025)
A knock-off Umidigi A3 Pro.

It's an awesome Chinese $50 android phone.

Because it hasn't passed all the network tests, most mobile networks would block an entirely random IMEI, so they suggest you type in the IMEI from your old phone (as long as it's 4g - if it isn't, they have a support email address you can contact and they'll give you an IMEI that works in your country)

Even the legit Umidigi A3 Pro's (which cost $80, and have proper certifications) have an 'imei change' tool.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by salawat on Thursday June 13, 2019 @10:27AM (#20175166)
Not for long I'll wager...
Re:Saudi Arabia tracks runaway women by cellphone IMEI by solarkraft on Thursday June 13, 2019 @11:50AM (#20176016)
I'll wager the opposite. Of course it's not legal anywhere, but I don't expect any customs people to be able to tell that a phone comes with an changeable/unapproved IMEI.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by CaptainZapp on Thursday June 13, 2019 @04:14AM (#20172718)
Meanwhile, nobody has ever said anything about the serial numbers of hard drives, GPUs, motherboards, RAM modules, Ethernet MAC address

Let's not forget every single page printed by a color printer.[1]

[1] https://en.wikipedia.org/wiki/Machine_Identification_Code

Re:Saudi Arabia tracks runaway women by cellphone IMEI by codedokode on Wednesday June 12, 2019 @06:49PM (#20170153)
Furthermore, in many OS those unique numbers are not protected from applications. For example, in Linux any application can read any hardware identifiers without any specific permissions. For comparison, in Android an application needs to have a permission to read phone or IMEI number.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by segfaultbuserr on Wednesday June 12, 2019 @07:09PM (#20170288)
Yes.

BTW, how does Windows hash your hardware serial numbers for DRM nowadays? I haven't used and checked it for a long time. Is it still the harddrive and the motherboard?

Re:Saudi Arabia tracks runaway women by cellphone IMEI by microcolonel on Wednesday June 12, 2019 @07:51PM (#20170539)
Barring an extremely risky, one-off backdoor in the management engine or your board or device firmware; there should be no reason why your hard disk, GPU, board, memory, and NIC UUIDs (MACs are configurable, and random by default in NetworkManager and some other network configuration systems) are available to third parties on a regular basis, unless you put software on your computer to make that happen.

Don't run spyware on purpose.

Re:Saudi Arabia tracks runaway women by cellphone IMEI by solarkraft on Thursday June 13, 2019 @11:52AM (#20176047)
> unless you put software on your computer to make that happen

Couldn't that be ... any software?

Re:Saudi Arabia tracks runaway women by cellphone IMEI by microcolonel on Friday June 14, 2019 @08:46PM (#20187802)
Well, you could start by not installing software that you know exfiltrates these data, like Microsoft Windows, or Adobe Flash...
Re:Saudi Arabia tracks runaway women by cellphone IMEI by solarkraft on Saturday June 15, 2019 @02:52PM (#20191465)
Even in free software, do you audit everything you install? Information security is only as strong as the weakest link.
Re:Saudi Arabia tracks runaway women by cellphone IMEI by microcolonel on Saturday June 15, 2019 @10:57PM (#20193576)
Why not start with software which isn't known to deliberately disseminate information about your computer. Sure, if you move the goalposts all day, you'll never score.