Is Apple Tracking iPhone Users Through IMEI?

ariefwn writes ""As I sit here applying a new layer of Reynolds tin foil to my international hat of conspiracy, its been proven that Apple tracks iPhone usage and tracks IMEI numbers of all their iPhones worldwide. Hidden in the code of the 'Stocks' and 'Weather' widgets is a string that sends the IMEI of your phone to a specialized URL that Apple collects. I wonder if there will be any implications to owners of hacked iPhones..."

Yes, and the problem is?

[LiquidCoooled]

You signed an agreement when you bought the device.

When you interact with Apple, we may collect personal information relevant to the situation, such as your name, mailing address, phone number, email address, and contact preferences; your credit card information and information about the Apple products you own, such as their serial numbers and date of purchase; and information relating to a support or service issue.

However people will expect this to be at manual support time and not all the time.

While you're waiting...

[Huntr]

You could just read all the comments [slashdot.org] about Blizzard's Warden program for WoW, as they will likely be strikingly similar.

Re:Tracking what?

[tgd]

Nothing, its a device serial number... not associated with your SIM and therefore not with your account. It proves its an iPhone to the webservice. Not much more.

Bet I get modded down for saying it though :)

Tracking?

[nickovs]

There's a substantial difference between receiving information and tracking people. Do the land-line phone companies "track" the calls you make? Sure, they use it to send you a bill, but most people don't seem to think it's a privacy violation. The author does not, as he claims, have "proof" that Apple track iPhone users, simply that they have the wherewithal to collate information about the services used by people if they could be bothered.

The IMEI number is there to facilitate identifying mobile devices to the Public Land Mobile Network (PLMN) for the purpose of charging for services. Your IMEI goes out every time you connect to the EDGE network or any GPRS service anywhere in the world, and is (and always has been) logged by the phone company, irrespective of what brand of phone you have. It's always been possible for the phone company, or anyone with the right data sharing relationship with the phone company (e.g. Apple), or the police with a court order, or the CIA/FBI/KBG/MI6, to link this to the IP address assigned to the mobile device, and from there to server logs. People who worry about this shouldn't just be wearing tin-foil hats, they should be putting tin foil around their phones too.

Re:Just a few more minutes...

[daveschroeder]

Sorry, the idea of what is essentially a hardware device serial number being used to "track" anything at all, other than perhaps the fact the device is actually an iPhone, was to stupid for even me to grace with a response. ;-)

This post [slashdot.org] sums it up quite nicely, though.

Re:Just change it...

[dave420]

... and go to jail! It's illegal to change your IMEI in the UK, fyi, so this isn't the best advice for anyone in the UK.

Re:Tracking?

[kybred]

The IMEI number is there to facilitate identifying mobile devices to the Public Land Mobile Network (PLMN) for the purpose of charging for services.

No, that would be the IMSI [wikipedia.org]. The IMEI [wikipedia.org] just identifies what equipment you are using.

Re:Just change it...

[javab0y]

Yep...they work peachy. The service is off your SIM, not the IMEI. As for illegality...yep...I live in the USA...so no laws preventing it here. Yes...those who do this should probably examine their own countries' laws.

Re:Just a few more minutes...

[bolo1729]

Has anyone verified that the IMEI is actually inserted into that field in the URL when the widget runs?

From the article: Any attempts to modify the URL to exclude the IMEI information will not allow you to retrieve any information in the "Stocks" and "Weather" apps.

It seems that the author did...

Re:Just a few more minutes...

[Anonymous Coward]

The problem is the IMEI allows for SIM cloning, which is why you should *never* give it out.. it's unique to your SIM and used for billing etc.

So iphone broadcasts it unencrypted via wi-fi.. and you're not bothered?

The IMEI is unique to your phone, not your SIM, and isn't used for billing.

Re:Tracking what?

[Lars T.]

heise confirmed that they are not sending the IMEI!!!!!
http://www.heise.de/newsticker/meldung/99220 [heise.de]

Errm, poor AC is still at 0 despite saying the truth. Mod up. Translated quote:

The obvious suspicion that the IMEI of the phone is actually transmitted with each inquiry could not be confirmed by the tests heise Security did. Although a number actually was found in the HTTP requests to the Apple server they were not the IMEI of iPhones. Moreover, the weather applet sent a different "IMEI" in its query than the Exchange applet.

IOW evil Apple sends an HTML request with the string "imei" in it, not the IMEI (of the phone). That's all the "proof" TFA needed - see sig for more info.