A $2.50 lost-device report knocked a still-boxed Galaxy Z Fold 7 off its carrier network

A lost-device block works on the radio itself. Every cellular radio carries a 15-digit IMEI, burned in at the factory and separate from the SIM card, the phone number and the account ^[6]. A lost-device report drops that number into an Equipment Identity Register, and the network then refuses to register the device, whoever is holding it and whatever SIM is inside ^[7]. For a genuinely stolen phone that is the point. The six weaknesses the team documented sit in the machinery around it, spanning the devices, the carrier systems that take the reports, and the systems carriers use to share block lists ^[2].

Carriers do check one thing. All three accept reports only from customers with active service, which is meant to make reporters traceable ^[9]. The researchers opened accounts on all three and found that none verified a Social Security number or a government ID on a prepaid signup, and that prepaid customers could file lost-device reports the same as anyone else ^[10]. Prepaid service can be paid for with an anonymous Visa gift card bought off a rack at Walmart ^[11].

Ownership is the second check, and carriers approximate it by looking at whether the device has spent time on the account, which a spoofed device can produce on demand ^[12]. On one carrier, one second of attachment was enough; the other two wanted a minute ^[13]. After that minimum, none of the three asked for a single call or any data before accepting a report on a phone the team had never used ^[14]. Guan-Hua Tu, an associate professor in Michigan State's College of Engineering, said an attacker can cut a device off remotely "even though the device has not actually been lost, stolen or sold" ^[8].

For a retail phone the IMEI is printed on the sealed box ^[1]. For embedded gear the researchers had to go get it. They fed a deliberately corrupted identity request to four phones and four low-power cellular development boards of the kind used for backup links; the phones ignored it, as the standard requires, and two of the four boards answered with their IMEIs ^[18]. Both leaking boards were vulnerable because of the chipset inside, and those chipsets come from two vendors whose combined global share of that market is above 40 percent ^[19].

The demonstration against a home security gateway runs in two parts that can be months apart ^[21]. Knock the gateway off Wi-Fi so it falls back to cellular, stand up a small rogue base station to lure it in, and ask for its IMEI: 17 seconds in the lab, after which the base station goes dark and leaves the carrier nothing to detect ^[20]. Later, disrupt the Wi-Fi again and file the report ^[21]. Seventeen seconds on air plus the slowest block the team measured, 80 seconds, is 97 seconds of attacker activity ^[1].

Anyone trying to act on this runs into the limits of the public account. Help Net Security names neither the three carriers, the three partner schools, nor the two chipset vendors, and reports no disclosure timeline, no CVE, and no case of the technique being used against a real subscriber ^[22].