Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

O2 VoLTE: locating any customer with a phone call

mastdatabase.co.uk

Post reply on HN
Print view View original

11–20 of 80 posts

Re: O2 VoLTE: locating any customer with a phone call

#11

Post by andix »

edude03 wrote: post #4

I don’t know anything about IMS but I assume they have to stay on the call long enough for the debug headers to be sent (like the tracing the call thing in every spy movie but real) and if that’s the case can this be mitigated by “just”* not answering calls from unknown numbers? *yes I’m aware that means people you know who have your number could also exploit this

I guess this information is already known to the network before the connection is even established. Those seem to be debugging headers, you probably need them for cases where the connection can't be established properly to debug why. If I understand the article correctly, the information is even there if the receiving phone is turned off, then you get the last known cell.

Re: O2 VoLTE: locating any customer with a phone call

#12

Post by throw123xz »

throw8388844848 wrote: post #9
edent wrote: post #3

O2 used to have a responsible disclosure address - but they removed it a few years back. When I worked there (many years ago) the security team was excellent. When I emaileld them about an issue last year, they were all gone.

[flagged]

Imagine wasting the time to create a new account just to blame diversity for this when you have no idea what happened to the team or seem to be familiar with O2's incompetent management...

Re: O2 VoLTE: locating any customer with a phone call

#13

Post by razemio »

throw8388844848 wrote: post #9
edent wrote: post #3

O2 used to have a responsible disclosure address - but they removed it a few years back. When I worked there (many years ago) the security team was excellent. When I emaileld them about an issue last year, they were all gone.

[flagged]

How do you even manage to always throw politics into the most random topics? Like having a ghetto blaster, which you play in the most inappropriate places.

Re: O2 VoLTE: locating any customer with a phone call

#14

Post by andix »

throw123xz wrote: post #12
throw8388844848 wrote: post #9

Earlier quoted context omitted.

[flagged]

Imagine wasting the time to create a new account just to blame diversity for this when you have no idea what happened to the team or seem to be familiar with O2's incompetent management...

Chances are high it's just a bot. Sample prompt:

"Select one comment which would be suitable for a passive agressive an anti DEI post. Return the ID of the original comment and an answer."

Re: O2 VoLTE: locating any customer with a phone call

#15

Post by [deleted] »

celsoazevedo wrote: post #7

Seems to be a serious problem. It's not that hard to root a phone, install NSG, and look at this info. O2 is also the largest mobile network in the UK and they have contracts with the government... It's disappointing that they didn't reply, but I'm not surprised. O2 seems to be a mess internally. Anything that can't be fixed by someone at a store takes ages to fix (eg: a bad number port). Their systems seem to be out…

[deleted]

Re: O2 VoLTE: locating any customer with a phone call

#16

Post by usr1106 »

According to GDPR this is clearly illegal. I am pretty sure their subscriber contracts don't contain consent for sharing your location to any caller.

Now UK has left the EU so GDPR does no longer apply. But it is my understanding they have not changed any fundamental principles in whatever applies now?

Re: O2 VoLTE: locating any customer with a phone call

#17

Post by palm-tree »

usr1106 wrote: post #16

According to GDPR this is clearly illegal. I am pretty sure their subscriber contracts don't contain consent for sharing your location to any caller. Now UK has left the EU so GDPR does no longer apply. But it is my understanding they have not changed any fundamental principles in whatever applies now?

I'm no expert, but I'm fairly sure that UK GDPR applies, which is effectively the same as the EU version https://ico.org.uk/for-organisations/data-protection-and-the...

Re: O2 VoLTE: locating any customer with a phone call

#19

Post by dylan604 »

razemio wrote: post #13
throw8388844848 wrote: post #9

Earlier quoted context omitted.

[flagged]

How do you even manage to always throw politics into the most random topics? Like having a ghetto blaster, which you play in the most inappropriate places.

There must be a name for the rule that says if you're going to play music at an obnoxious level in public that it must be shitty music.

Re: O2 VoLTE: locating any customer with a phone call

#20

Post by mdasen »

cloudref wrote: post #18

Could you mitigate this by turning off VoLTE? I can see docs online for turning it off on an iPhone 11 - but my iPhone 15 doesn't have that option!

> Disabling 4G Calling does not prevent these headers from being revealed, and if your device is ever unreachable these internal headers will still reveal the last cell you were connected to and how long ago this was.

So it seems like that won't do anything.

Post reply on HN