UK network o2 send your number to every site you visit • Hacker News Board

Re: UK network o2 send your number to every site you visit

#141

Post by rmc » Wed, Jan 25, 2012, 12:49 PM UTC

nandemo wrote: post #110

Torn wrote: post #89

Earlier quoted context omitted.

Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection…

The tweet: > "Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" Wow.

Their Twitter account ( https://twitter.com/#!/O2 ) has a burst of new activity. Looks like this has been passed up from Tier 1 support.

Re: UK network o2 send your number to every site you visit

#142

Post by JonnieCache » Wed, Jan 25, 2012, 1:02 PM UTC

Here's a statement from the Information Commissioner's Office:

"When people visit a website via their mobile phone they would not expect their number to be made available to that website. "We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed."

http://news.sky.com/home/technology/article/16156276

O2 are in trouble.

Re: UK network o2 send your number to every site you visit

#143

Post by perspective » Wed, Jan 25, 2012, 1:04 PM UTC

kgutteridge wrote: post #19

A lot of mobile network operators wash this information about or have it hashed into some other form (which means it can still be used as a unique identifier) Some popular headers to check X-UP-CALLING-LINE-I X_NOKIA_MSISDN X_H3G_MSISDN MSISDN X_MSISDN X_NETWORK_INFO X-WAP-MSISDN X-UP-SUBNO

I'm on 3 w/Samsung Galaxy SII & Cyanogenmod and it's not sending any phone-specific headers.

Re: UK network o2 send your number to every site you visit

#144

Post by netmute » Wed, Jan 25, 2012, 1:05 PM UTC

Just tested this on O2 Germany. They don't do it.

Re: UK network o2 send your number to every site you visit

#145

Post by perspective » Wed, Jan 25, 2012, 1:06 PM UTC

adhipg wrote: post #137

jgrahamc wrote: post #118

Earlier quoted context omitted.

Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?

Three's headers contain my phone make and model as a wap profile header - nothing personal apart from that.

Just tested this on SGSII and can confirm the same.

Re: UK network o2 send your number to every site you visit

#146

Post by dazbradbury » Wed, Jan 25, 2012, 1:15 PM UTC

Glad this is being brought to attention finally (as it seems it's been discovered before), but this is just yet another case of a UK mobile operator losing my trust.

O2: Send number in plain-text to every website visited. [1]

Orange: Increase fixed contract price by RPI through use of dodgy contract clause. [2]

Three: Place a non-payment flag on my credit report for no apparent reason. When I realise years later, they remove it and don't even apologise.

I'm running out of operators which haven't negatively impacted me, and to be honest, I think some of the blame must land with OFCOM.

[1] - http://news.sky.com/home/technology/article/16156276

[2] - http://en.wikipedia.org/wiki/Orange_%28UK%29#Controversy

Re: UK network o2 send your number to every site you visit

#147

Post by sfgfdhgfdshdhhd » Wed, Jan 25, 2012, 1:25 PM UTC

edlea wrote: post #116

I've built a simple Twilio script that shows how easy it is to exploit this here: http://edlea.net/ Vistors on an O2 phone will receive an SMS on their first visit. An MD5 hash of their MSISDN is kept in memory to prevent multiple SMS being sent.

FYI: this is trivially spoofable. I just sent a couple of texts to non-O2 friends by changing my browser headers. Thought about writing a Python script to run through the space of +447740[1-9][0-9]{5} numbers, but thought better of it.

Re: UK network o2 send your number to every site you visit

#148

Post by danbee » Wed, Jan 25, 2012, 1:35 PM UTC

The header is no longer being inserted for me. I think O2 must have fixed the problem.

Re: UK network o2 send your number to every site you visit

#149

Post by dvd03 » Wed, Jan 25, 2012, 1:54 PM UTC

To stop your o2 iPhone exposing your number through http headers, go to Settings > General -> Network -> Cellular Data Network, and change both APN to mobile.o2.co.uk and username to o2web (leaving password as is).

Re: UK network o2 send your number to every site you visit

#150

Post by mdpye » Wed, Jan 25, 2012, 1:56 PM UTC

naz wrote: post #61

otoburb wrote: post #51

Earlier quoted context omitted.

Consider the circumstance where a carrier portal sits on subnets owned by the carrier. In this case, unencrypted HTTP requests to the portal originating from the carrier's proxy are usually considered trusted. In such a circumstance, carriers may consider this "trusted".

That's true. I imagine they'll be considering some third-party sites trusted too.

I believe that in cases where the third party site lies outside the carrier infrastructure and the header is plain text (some carriers encrypt the value), a carriersite operator VPN is required.

People shouldn't really be surprised that ALL mobile web traffic is heavily proxied (and transformed, by default). You probably wouldn't want to experience a direct net connection as flaky as mobile ones actually are.