Researchers Demonstrate How Flaws in Carrier Reporting Can Block Phones and Connected Devices
Summary
Researchers demonstrated that weak carrier identity and ownership checks, IMEI leaks, and block-list sharing gaps can let attackers disable phones and connected devices. They proposed stronger identity checks, device certification, and improved data sharing.
Key points
- Tests across three major U.S. carriers found that prepaid accounts could report devices as lost with weak identity and ownership checks; blocking a device cost $2.50–$4.
- Researchers blocked a new Samsung Galaxy Z Fold 7 before its release using an IMEI obtained from a supply-chain database.
- Two of four tested cellular development boards disclosed their IMEIs after malformed identity requests; the researchers used the weakness to disable a home alarm gateway in an end-to-end test.
- The gateway attack involved disrupting Wi-Fi, eliciting the IMEI through a rogue base station, and later filing a fraudulent lost-device report.
- Fraud victims receive no notice when service is blocked and may need to prove ownership to restore it.
- A phone reported lost on one carrier still worked on the other two a week later, indicating gaps in cross-carrier block-list synchronization.
- Researchers proposed government-ID checks, stronger ownership verification, device certification tests, and sharing more security details between carriers; they notified affected companies and the GSMA.
Article Details
- Attack Vectors
- Researchers filed fraudulent lost-device reports through carrier portals using prepaid accounts that did not require government-ID verification.
- Weak ownership checks allowed reports for devices that had briefly connected to a carrier network, including devices the reporter did not own.
- A deliberately corrupted identity request caused two tested cellular development boards to disclose their IMEIs.
- In a demonstrated alarm-gateway attack, researchers disrupted Wi-Fi, used a small rogue base station to obtain the gateway’s IMEI, then later filed a fraudulent lost-device report to block its cellular service.
- Researchers used a script to submit reports through carrier web forms and block newly released phones whose IMEIs appeared in a supply-chain verification database.
- Defensive Notes
- Require government-ID verification for lost-device reports.
- Strengthen ownership checks by combining multiple signals, including whether the device matches the reporter’s plan, and refer doubtful cases for in-store verification.
- Test device certification to ensure phones and cellular modules do not disclose IMEIs in response to unauthenticated requests.
- Include identity-verification details in records shared between carriers so receiving carriers can assess whether to trust a block.
- Improve carrier synchronization with the global block list.