Is IMEI deanonymizing you on every reboot?

The golden rule of phone privacy is that you never turn on your WAN anywhere near places attached to your name, or other devices that have ever connected to the internet in such places, or those of your social connections, or even taxi drivers who collect you from such places. Otherwise I can offer a mountain of ways that you can be deanonymized, sometimes down to your passport number. Not that Huawei telco equipment would do that because their website said it doesn't. But just theoretically, I mean.

Which brings me to a very important point: IMEI is immutable. It's a tag on your ass. (Nobel Peace Prize for the first vendor to offer an escape from 1984!) This implies that, in order to follow the above golden rule, you must never allow your phone to utter it, even once, unless YOU explicitly enable WAN access. I am worried that this assumption may be violated in a manner beyond your control:

First of all, suppose you have an Android phone which has been in airplane mode for a long time. It's therefore "safe" to go ahead and replace its firmware with GrapheneOS, which overall is probably a great idea. You're not stupid so you don't do this at home, in order to distance a phone running the (very rare) GrapheneOS from your home wifi (and for that matter your leaky VPN). You show up at a random coffee shop miles from your home. Now you boot up your laptop (with full battery) and connect to the shop wifi. Or perhaps you boot your other phone and hotspot your laptop to WAN. Either way, you just deanonymized yourself because you broadcast either your laptop wifi MAC or your other phone's IMEI. So if you're smarter still, you would disable your laptop wifi before leaving home, and buy a plug-and-play USB wifi dongle on the way to the coffee shop. And by the way, you rode your bike there (in dark or at least cloudy conditions) because you realize that a taxi driver's cellphone is just a proxy for your own location, connecting your home to the coffee shop.

So far so good, Sherlock! You boot up your laptop, connect to the Graphene OS site, and start the install process. As part of that process, the phone needs to reboot. Uh oh, here we go...

Scenario 1

GrapheneOS starts its first boot. It first initializes the baseband module and tells it search for WAN networks, blurting out the IMEI in the process. If you ever use the phone again, it will be tied to the coffee shop. If you cut corners on any of the above steps, well, too bad, you're irrevocably deanonymized. Hopefully the coffee shop camera isn't hacked, in which case all of that prep work is for nothing if the video is being connected to a face recognition database somewhere (not that a small company like Alibaba would be able to do that, obviously). Let's just punt on that one and pray that such threats aren't yet pervasive in 2023. Just don't sit next to that guy playing TikTok, or for that matter at the table right under one of the store's many cameras.

Scenario 2

GrapheneOS starts its first boot. It knows that it shouldn't enable WAN unless and until you instruct it to do so. However, your baseband module was designed by security ignoramuses. As soon as it powers on, it automatically broadcasts its IMEI as part of its hardwired initialization process. Game over.

Scenario 3

The previous scenarios are just fiction. I'm a fool for being so wrong, and we can all rejoice.

So, hive brain, which one is it...?

N1b You're very welcome. Pass it on to socially responsible people.

Here's a bonus factoid: some VPNs allow naked source IPs to leak out of the device until they manage to start their app. It's insane that this is even possible but it's due to stupid race conditions in the whole scheme. Those few million bits are invaluable to traffic analysis.

lbc The short answer is: if a data set is feasible to collect and worth the money to sell or exploit, then assume it's being done.

The passport number thing is like this (and obviously just one of many deanonymization routes):

You started using your GrapheneOS phone in Argentina. Let's say for sake of argument that you connect to a 5G tower down there with a base station provided by Huawei. At bare minimum, I would expect your IMEI to be relayed over the internet to some servers in China. Using triangulation, we could even get your location, but it's enough just to know you're hanging out in Buenos Aires. Now you decide it's time to go on that safari trip you've been dreaming about. So you book your tickets, and a month later, you pop out in Kenya. You're not an idiot, so you never turn on your WAN anywhere near the airport or the connected taxis, let alone while passing through immigration. You might have connected to the airport wifi, but with MAC randomization that should be OK. (As in, you're immune to trivial deanonymization, and instead an attacker would need to apply costly traffic timing and sizing analysis to "see" you through your VPN or whatever). But...

How many people from Argentina do you think left the country on September 1 and arrived in Kenya on September 2? I dunno but probably just YOU! Now if the telco infrastructure in Kenya is also Huawei, or any other company which connects to those same servers in China, then you can see where this is going. "Ah ha! The guy with IMEI number X must have been someone one the plane that left Argentina on September 1." Now all you need to do is eventually fly back home, and it's checkmate! Why? Well, a simple logical-and function of the passenger manifests will reveal you. If you happen to have backdoor access to Kenya's immigration servers (not that you would find any reporting of that online) then it's game over right there. Otherwise they might have to wait til you check in to a hotel or make the unforgivable error of registering a SIM card in your own name, in order for your passport number to get ejected to some endpoint which is a bit more accessible.

But why would "they" care? The Chinese don't, so long as you're not a bother to them, and hey, you're just a guy going on a safari. But imagine if they could then go to either government involved, and say, "Here's a pile of location data tagged with IMEI. For a small price per IMEI, we'll show you all the places they've been, and when, to the extent that they've connected to our poisoned telco equipment. Then it's all up to you how you want to exploit the people attached to them."

It all starts with exfiltrating all the intel that your "cheap and efficient" security devices capture, including all your telco equipment. Then do a bunch of correlation analysis. But...

Modern intelligence fusion over there already makes a mockery of my scenario here. This is really trivial shit. And obviously Huawei isn't the only busybody around, but rather just the most infamous one.

88dotorg I get where you're coming from. Out-of-the-box GrapheneOS definitely has its market niche. It's a convenience-vs-security thing. The thing is, I think the majority of such companies are legit, but now I have yet another party that I need to trust. Trusting GrapheneOS to be free of supply chain attacks is already a big ask (and I'm mostly satisfied in that regard). Now I have to trust this vendor, and obviously the mail system. I'm personally so not brave. If nothing else, it would be hard to avoid tying the device to my address.

And if it's not obvious, the only way to buy a phone or anything connected to it is with cash, bitcoin from untraceable sources, or privacy coins.