Pinephone IMEI changing info: do you think its OK for a Wiki?

[KC9UDX]

To me the solution is simple.  Pine64 does not want the information posted on their site(s).  So, post it on another site and take your own risks.

Heck, post it on LBRY where it really can't be taken down no matter who successfully gets it removed from the official indexes.

[kwdevel]

I'm new to the forum, but I felt the need to speak up about this as I have extensively worked on this exact feature and the legality of it in the past. I've been a hardware/software developer for over 20 years with many of those years focused on privacy enhancing technologies. I think a short story about my past could help clear some things up.

The issue of changing an IMEI showed up while working for a former employer. Someone in the company (we'll call him Chad), much like some people here, ignorantly believed it was illegal for us to do so. Chad had no real reason, no proof, no cited sources for this believe. It was his own believe because he thought it was "immoral". Chad always loved to point out the evil and scary things that could *possibly* be done with certain features on products even though he usually did not fully understand what was really going on. Chad always assume just because one or two people *might* use a product in an undesirable way, he should be the protector of the world and put a stop to it from ever happening in the first place. Chad made a big issue out of changing MAC and IMEI addresses, so the CEO went to an attorney to get clarity. Long story short, it was NOT illegal for the company to change the IMEI and MAC addresses of the devices the company purchased before reselling them. Chad was finally fired some time later, thankfully.

Every device we received had the same IMEI and WiFi MAC address (crappy manufacturing in China). So we had to fix these issues before reselling the product. Here's another CURRENT example of cheap manufacturing from China; Bitmain's Bitcoin miners all have the same ethernet MAC address from the manufacturer, and Bitmain "fixed" this through software at boot. So please don't think this isn't problem because it still happens more often than you think. Having the same static addresses, whether MAC or IMEI, from Chinese manufacturers is very common and well know problem that requires resellers or developers to come up with a fix. To that point, when a manufacturer allows you *AND* provides a way to change these addresses, it is on purpose. This is an intended feature because is NOT illegal and is usually REQUIRED at some point in the development cycle.

So I will put this out there in regards to changing the IMEI, at least in the USA. A bill was introduced in the United States by Senator Chuck Schumer in 2012 that would have made the changing of an IMEI illegal, but the bill was not enacted. Zero efforts since then have been made, in a legal way, to try and do this again. It is 100% LEGAL to do this in the USA. Period. Now I know someone out there is going to point out what the GSA has published, but the GSA does NOT DEFINE LAWS. It's only a recommendation.

Now USA laws don't rule the rest of the world. I'm not a legal expect for every law in every country, so I cannot speak to the legality of this in other countries. Check your country accordingly. However, by being a Chad and saying "it's illegal in country XYZ so we have to ban it altogether" is a very ignorant and dangerous way to view the world.  Don't be a Chad, you're not protecting anyone.

As for the "stealing someone's identity". Just stop. That's not the way the cellular network works. It's sad that I should have to explain this to those who do not understand it, but I'll try and make this short.

Your cellular account has three unique parts. IMEI, IMSI, and MSIDIN.
The MSIDIN is your phone number (+1-212-555-1234 for example of a number in New York).
The IMSI is the serial number of your SIM card.
The IMEI is the serial number of your phone.

It is NOT possible to just steal someone's MSIDIN (phone number) by cloning their IMEI. Further more, even if someone is sniffing the GSM band with a SDR, they still never see your IMEI. They will sometimes catch your IMSI or TMSI (Temporary IMSI), but this is still not enough to steal your MSIDIN or account. The SIM card also requires a private key, that is burned into the SIM card, to get on the network.  


Now for the reason(s) why everyone should be ALLOWED to change their IMEI.
Many providers (AT&T in the USA; Three(3) in the EU) do not activate a pre-paid SIM card if the SIM card is used with an unsupported brand or model of phone (stupid, greedy logic). I spent over an hour on the phone with AT&T trying to activate my prepaid SIM with the PinePhone. They were clueless, but provided me with a bunch of clues. First was "That brand isn't supported" is what they kept saying. Basically, their network did not recognized my device as being a "supported" device on the network. I had to take my new SIM, put it in an old AT&T phone I had, and let it register on the network which took about 2-5 minutes. After that, the network activated my SIM, and I was able to put it back into my PinePhone and IT FINALLY WORKED!  There was nothing technically wrong with what I was trying to do and it should have worked, but AT&T must have a team of Chad's working for them just to make everyone else's life harder. If I had an easy way to change the IMEI on my PinePhone to the IMEI of my old AT&T phone, it would have worked immediately. T-Mobile doesn't have this problem. You can just buy a SIM, put it in any phone or modem, and it works (as it should!)

Another example: The telcom MEO in Portugal. They don't even tell you what the MSIDIN is through your phone or SIM card. They send you a SMS after the SIM is activated on the network that tells you what your phone number is. Or you have to call a friend and see their caller ID. Again, this has nothing to do with the IMEI.

Moral of this long post; DON'T BE A CHAD!!! Changing the IMEI is often necessary and required in many cases, countries, and telco's; and just because you haven't run into these types of problems yourself doesn't mean other people won't. You don't know how every network on the planet works, and MANY people are going to run into this exact problem when using this product considering ZERO, NONE, NOT A SINGLE TELCOM IN THE WORLD SELLS PinePhone's AS A NORMAL CONSUMER PRODUCT! Being able to trick the network into thinking you have a supported phone model in order to get working service is not a crime, IT'S A REQUIREMENT! I bet the Chad's didn't stop and think about that. I've been to over 25 countries and have purchased SIM cards in everyone of them. I've tested more networks and SIMs than most people on this forum. So to the Chad's, just stop it. The only people you are helping is the other Chad's at places like AT&T that want to make it impossible to use a PinePhone out of the box with their network, even though it should work out of the box because we bought and paid for both the product and the service!!

I say, put it on the Wiki and tell the Chad's to be quiet because he doesn't know everything. If, and that's a big IF, some company of legal office sends a letter to PinePhone to remove it from the wiki, then go ahead and take it down. I'd bet a whole bitcoin that it would never happen though!

Thank you for reading this long post and best regards!

[zetabeta]

...


Now for the reason(s) why everyone should be ALLOWED to change their IMEI.
Many providers (AT&T in the USA; Three(3) in the EU) do not activate a pre-paid SIM card if the SIM card is used with an unsupported brand or model of phone (stupid, greedy logic). I spent over an hour on the phone with AT&T trying to activate my prepaid SIM with the PinePhone. They were clueless, but provided me with a bunch of clues. First was "That brand isn't supported" is what they kept saying. Basically, their network did not recognized my device as being a "supported" device on the network. I had to take my new SIM, put it in an old AT&T phone I had, and let it register on the network which took about 2-5 minutes. After that, the network activated my SIM, and I was able to put it back into my PinePhone and IT FINALLY WORKED!  There was nothing technically wrong with what I was trying to do and it should have worked, but AT&T must have a team of Chad's working for them just to make everyone else's life harder. If I had an easy way to change the IMEI on my PinePhone to the IMEI of my old AT&T phone, it would have worked immediately. T-Mobile doesn't have this problem. You can just buy a SIM, put it in any phone or modem, and it works (as it should!)

...

Thank you for reading this long post and best regards!

finland has a law, which bans operators or carriers to block compatible devices. assuming the device is compatible enough. interfering devices and similar can blocked though. it seems that e.u. does not have corresponding law or directive.

https://finlex.fi/fi/laki/ajantasa/2014/...#O9L29P246 , section 246

generally speaking, it just seems weird that u.s. carriers can arbitrarily block anything what they want for any reason. i recently heard for some u.s. carriers, that if device does not connect volte also known as "ims" then carrier bans other access as well like data and text messages.

[wibble]

For the UK see https://www.legislation.gov.uk/ukpga/2002/31/data.pdf

[zetabeta]

For the UK see https://www.legislation.gov.uk/ukpga/2002/31/data.pdf

sounds little bit totalitarian. that term "unique device indentifier" is vague, does it mean mac addresses in network , wifi cards and bluetooth chips, or imei codes in modem chips, or just serial numbers. my interpretation is, it is not mac addresses, those are changed quite often. but imei codes are in gray area and what about serial numbers in devices.

if it is mac address, even devices which can change mac address is illegal, ordinary computer! even giving capability is illegal. if i recall correctly, fedora has mac address randomization, therefore illegal. (although, are computers mobile devices).

my quick superficial search on finnish laws indicates that changing imei and serial codes are not illegal (sort of allowed).

[wibble]

The IMEI was the target. I should have included the explanatory notes which have more of a 'plain english' summary of the law and its intent, sometimes used by courts when there's some disagreement about scope or interpretation of the law. The usual caution about legalese being a separate language that looks close enough to everyday language but can have a different meaning also applies. It may be that Pine64 can give a blanket permission to change the IMEI, but I'd want to ask a lawyer.
https://www.legislation.gov.uk/ukpga/200...view=plain

[kwdevel]

For the UK see https://www.legislation.gov.uk/ukpga/2002/31/data.pdf

sounds little bit totalitarian. that term "unique device indentifier" is vague, does it mean mac addresses in network , wifi cards and bluetooth chips, or imei codes in modem chips, or just serial numbers. my interpretation is, it is not mac addresses, those are changed quite often. but imei codes are in gray area and what about serial numbers in devices.

if it is mac address, even devices which can change mac address is illegal, ordinary computer! even giving capability is illegal. if i recall correctly, fedora has mac address randomization, therefore illegal. (although, are computers mobile devices).

my quick superficial search on finnish laws indicates that changing imei and serial codes are not illegal (sort of allowed).

Just for additional reference, Google now allows you to use random MAC addresses by default when connecting to Wifi. This for privacy reasons (good). So if the big boys are doing it, is it really illegal?? If so, who's going to cry about it or stop them.

[johnpine]

Further undocumented AT commands found by the developer megi, who reverse-engineered parts of the modem and its firmware, can be found on megi's website here.

Can you please provide the link to that megi's website? I would like to learn more about it as the "atinout" commands don't work in Mobian...

Edit: If for some reason there is a problem with posting it in public please PM me.

[fxc]

Further undocumented AT commands found by the developer megi, who reverse-engineered parts of the modem and its firmware, can be found on megi's website here.

Can you please provide the link to that megi's website? I would like to learn more about it as the "atinout" commands don't work in Mobian...

Edit: If for some reason there is a problem with posting it in public please PM me.

You don't have to use atinout, that's only one of the many tools to communicate with the modem. Easiest if you just run them with modemmanager, but minicom will work too, see https://wiki.pine64.org/wiki/PinePhone#AT_commands

Further AT commands are documented here: https://xnux.eu/devices/feature/modem-pp...-pinephone (that's megi's website) and in various places here: https://github.com/Biktorgj/pinephone_modem_sdk, the wiki has the links too. Please be very careful about what you run, some of them can permanently or semi-permanently corrupt your modem (firmware).

I'm locking the thread as the original question is answered, please open a new one if there are further questions.