0

How do I set the IMEI number to automatically randomly change every time I connect to a cellular network?

Android 9 introduced a feature that was a huge boon to the privacy of Android users: WiFi MAC Address Randomization.

Starting in Android 8.0, Android devices use randomized MAC addresses when probing for new networks while not currently associated with a network. In Android 9, you can enable a developer option (it's disabled by default) to cause the device to use a randomized MAC address when connecting to a Wi-Fi network.

In Android 10, MAC randomization is enabled by default for client mode, SoftAp, and Wi-Fi Direct.

MAC randomization prevents listeners from using MAC addresses to build a history of device activity, thus increasing user privacy.

As stated, this feature is enabled by default in >= Android 10. So now when you connect to a WiFi network, the owner of the WiFi networks are less able to track your activity between networks.

  • MAC addresses are the unique identifier of the hardware device that connects to a WiFi network.

  • IMEI numbers are are the unique identifier of the hardware device that connects to a cellular network.

While this change in Android 9/10 greatly increases a user's privacy on WiFi networks (ie MAC randomization), I've seen no such improvements to increase a user's privacy on cellular networks (ie IMEI randomization).

IMEI randomization is especially important in-light of recent research discovering that loads of PII (including IMEI numbers) are being uploaded to both Google and Apple on average every 4.5 minutes

Abstract — We investigate what data iOS on an iPhone shares with Apple and what data Google Android on a Pixel phone shares with Google. We find that even when minimally configured and the handset is idle both iOS and Google Android share data with Apple/Google on average every 4.5 mins. The phone IMEI, hardware serial number, SIM serial number and IMSI, handset phone number etc are shared with Apple and Google. Both iOS and Google Android transmit telemetry, despite the user explicitly opting out of this. When a SIM is inserted both iOS and Google Android send details to Apple/Google. iOS sends the MAC addresses of nearby devices, e.g. other handsets and the home gateway, to Apple together with their GPS location. Users have no opt out from this and currently there are few, if any, realistic options for preventing this data sharing.

Similar to the WiFi MAC randomization feature, how can I setup IMEI randomization? If this is not currently possible, when is it being planned to be added to AOSP?

Michael Altfield
  • 414
  • 3
  • 15
  • Read more to understand why apps ask for IMEI info (though answers are dated, they are valid), so if you randomize them apps may misbehave, as in, music app not pausing when you get a phone call // If you still want to do that, root your phone, install Edxposed modules like XPrivacyLua // when is it being planned to be added to AOSP - ask Google, not here-no one here can answer that – beeshyams Aug 28 '21 at 12:35
  • 3
    IMEI is used for legal purposes e.g. to identify mobile theft and to enforce carrier agreements wit users. I don't think it'll happen ever. – Irfan Latif Aug 28 '21 at 12:35
  • MAC addresses are used for legal purposes e.g. to identify a device on a wifi network. I didn't think WiFi MAC randomization would ever be baked-into AOSP and enabled by default, but here we are. It seems at least some of the architects at Google care about privacy – Michael Altfield Aug 28 '21 at 12:45
  • MAC address is used to identify a device in a local network, just for the purpose of DHCP IP assignment and L2 routing in Ethernet protocol. IMEIs are used to identify devices by MNOs who operate at global level. There are authorities who allocate IMEIs. And IMEI cloning is a crime in many countries. So MAC and IMEI cannot be compared. They are entirely different types of identifiers. – Irfan Latif Aug 28 '21 at 16:33
  • But your concern is valid. Govt. agencies use IMEI to track you. This must be circumvented. But IMEI randomization doesn't seem to be an option. Even if it is, there are other ways to track you. The entirely isolated operating systems of SIM (Java) card and baseband processors of 3G/4G modems. Who known what runs inside them. – Irfan Latif Aug 28 '21 at 16:33
  • It should be noted that oppressive governments aren't the only issue. Of course there's many that have a history of violating human rights, dragnet collection of innocent people's PII, and also having this data stolen in breaches. But there's also countless malicious apps that use IMEI numbers to track & sell user's data without their permission. And malicious multinational corporations that have been found guilty of the same. The point is: the best way to keep your data safe is to make it useless -- either by widespread adoption of randomization (eg MAC) or standardization (eg Tor Browser). – Michael Altfield Aug 28 '21 at 18:08
  • Since Android 10 normal user apps cannot read IMEI: https://developer.android.com/about/versions/10/privacy/changes#non-resettable-device-ids. So it's no more a big issue. But the ROMs provided by OEMs aren't open source. They have privileges to read everything. So is the privileged Google Mobile Suite (Play Services and company). And as I said hardware components aren't open source like BP. So what will you gain by just ensuring that apps are not be able to read the IMEI. The bigger privacy concerns remain unresolved. – Irfan Latif Aug 28 '21 at 19:27
  • 2
    https://forum.xda-developers.com/t/imei-change-and-legality-mods-please-read.4155591 – alecxs Aug 28 '21 at 21:09

0 Answers0