Phone box barcode information - exploitability??

taranarat

To briefly explain. On the box of a new phone is the barcode information and the corresponding number. Such as the; IMEI1, IMEI2, EID, SN, SKU.

If an attacker obtained those numbers, to what extent & how can that information be used to exploit, compromise or penetrate the device?

W1zardK1ng

taranarat these can be used as identifiers but don't think it can be used compromise or explicit a device.

taranarat

W1zardK1ng okay thank you! Follow up question - Does obtaining hose identifiers allow the attacker to more easily find and target the device?

de0u

taranarat Does obtaining [those] identifiers allow the attacker to more easily find and target the device?

https://grapheneos.org/faq#hardware-identifiers

There is lots of good information in the FAQ.

W1zardK1ng

taranarat depends on the capabilities of the attacker, for example if it's a government agency they can get the phone number used by the user based on the imei from the carrier, then they can monitor your call history or send you some 0 click exploit to take control of your phone. This is theoretically possible but if you have higher threat model you will have much bigger things to worry. For a common man I don't think this will be an issue.

taranarat

W1zardK1ng thank you for confirming that's a great help! And as you mentioned it out of curiosity, if the circumstances did present a more severe threat model, what could be expected there?

CaptainPlanet

taranarat at the higher end you would be expecting US special forces appearing out of no where in your bedroom and whisking you off to a New York court.

23Sha-ger

taranarat
Your IMEI is being broadcasted to cell towers when you are not using airplane mode.
An attacker doesn't need to obtain this from the box.
The only potential issue here is that a retail store or anyone with access their database can link the
identity of who paid for the device to that specific IMEI/SN.

taranarat

23Sha-ger my thinking was starting to go that way, in that if it's printed on the side of the box, there must be simple methods for agencies, law enforcement or attackers to obtain that information

CaptainPlanet well not that intense of a threat model lol

de0u

taranarat my thinking was starting to go that way, in that if it's printed on the side of the box, there must be simple methods for agencies, law enforcement or attackers to obtain that information

Yes... but... if a phone is connected to a cellular network, even without a SIM, its IMEI is shared with the carrier automatically. And in general cellular carriers are quite willing to share information about which IMEI was where with law enforcement agencies. This happens whether or not the IMEI is printed on the box, so it's not clear that printing on the box aids law enforcement.

Having the serial number etc. printed on the box does make it possible for retailers to associate a sold device with a payment method. But this is convenient for many people if the device later needs warranty service, and can be defeated by users who are upset by this sort of association. So again it's not clear that printing on the box aids law enforcement.

Printing the serial number etc. on the box clearly makes it easier for Google, and the retailer, to track small expensive objects. I think lots of electronic devices have the serial number printed on the box, or printed on a label. Three feet from me there is a box containing a MikroTik Wi-Fi access point, with a printed label on the side bearing the serial number. If that's for the convenience of law enforcement agencies, I don't see how.

raccoondad

taranarat in that if it's printed on the side of the box, there must be simple methods for agencies, law enforcement or attackers to obtain that information

The IMEI is just a network/device identifier, its used to track who your device is, which is integral for network functions.

Any network administrator is going to be able to see it, LE can see it because they can demand an administrator to give information.