Getting a stranger’s phone kicked off the cellular network costs a few dollars
Researchers show attackers can remotely block strangers' phones and alarm gateways on US cellular networks by abusing lost/stolen IMEI reporting for $2.50-$4 per device.
Researchers from Michigan State University and three partner schools found six weaknesses in the lost/stolen device reporting ecosystem spanning devices, carrier systems, and cross-carrier block-list sharing. They demonstrated blocking unopened Samsung Galaxy Z Fold 7 phones and home alarm gateways on three major US carriers, with each block costing $2.50-$4 and taking roughly 20-80 seconds. The attacks exploit thin identity and ownership checks in prepaid accounts, IMEI leakage from vulnerable cellular chipsets used by two vendors with over 40% global market share, and pre-release IMEI databases purchasable for $600. Victims receive no notification, and restoring service requires proving device ownership to the carrier.
- Six weaknesses found across device, carrier, and cross-carrier lost-device blocking systems on three major US carriers.
- Prepaid accounts created with anonymous gift cards could report any device as lost with no ID verification.
- Two chipset vendors covering over 40% of the cellular IoT market leak IMEIs to rogue base stations.
- Blocking a home alarm gateway's cellular backup silences alarms reaching homeowners and monitoring centers.
- Blocking 100 unshipped Galaxy Z Fold 7 phones cost $250-$400 against $200,000 worth of devices.
- Vendors
- Samsung
- Products
- Samsung Galaxy Z Fold 7
- Organizations
- Michigan State UniversityGuan-Hua Tu
- Countries
- United States
From the original article
6 min read at helpnetsecurity.com
Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, and reported the phone to its carrier as lost. Then they opened the box and set the phone up the way a launch-day buyer would. It would not connect.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.