Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I'm surprised that the pre-encryption payload is available.
O2 VoLTE: locating any customer with a phone call
21–30 of 80 posts
Re: O2 VoLTE: locating any customer with a phone call
#22[flagged]
Re: O2 VoLTE: locating any customer with a phone call
#23Re: O2 VoLTE: locating any customer with a phone call
#24The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking. The data is sent out by the network voluntarily and during normal use. There are no systems at any point tricked into revealing personal data, which is often illegal, even if the hack is trivial. Even appending something like "&reveal_privat_data=true" to an URL might be considered illegal, because t…
> The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking
You clearly aren’t familiar with how broad the Computer Misuse Act is
Re: O2 VoLTE: locating any customer with a phone call
#25I’m curious to see if this exists on O2 in NZ. I switched to them last week because they do free roaming in Australia, and VoLTE calls.
Re: O2 VoLTE: locating any customer with a phone call
#26Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I'm surprised that the pre-encryption payload is available.
i think you meant GTP tunnel. And GTP tunnel is between enodeb and core network. it's secured only in case that it run inside IPSEC.
Re: O2 VoLTE: locating any customer with a phone call
#27The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking. The data is sent out by the network voluntarily and during normal use. There are no systems at any point tricked into revealing personal data, which is often illegal, even if the hack is trivial. Even appending something like "&reveal_privat_data=true" to an URL might be considered illegal, because t…
> The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking You clearly aren’t familiar with how broad the Computer Misuse Act is
> You clearly aren’t familiar with how broad the Computer Misuse Act is
No, I'm not familiar with it at all. But usually illegal hacking requires to access devices in a way you aren't allowed to access. As long as making the phone call itself is not an issue, it should be fine. Dumping data from the memory of your phone can't be unauthorized.
It would probably become an issue if you make unusual phone calls, harassing people with constantly calling, or calling just for the purpose of getting the location data and immediately hanging up. But just dumping the diagnostics for regular phone calls should be fine (I'm not a lawyer).
Re: O2 VoLTE: locating any customer with a phone call
#28[flagged]
> I hope that Nigel Farage will improve things when he becomes PM
He is likely to improve things the same way Trump improves things. They have a lot of common ground.
Re: O2 VoLTE: locating any customer with a phone call
#29According to GDPR this is clearly illegal. I am pretty sure their subscriber contracts don't contain consent for sharing your location to any caller. Now UK has left the EU so GDPR does no longer apply. But it is my understanding they have not changed any fundamental principles in whatever applies now?
I'm no expert, but I'm fairly sure that UK GDPR applies, which is effectively the same as the EU version https://ico.org.uk/for-organisations/data-protection-and-the...
Yes, it still exists. Most (all?) EU legislation that ended had to be explicitly revoked, since the UK was fairly diligent in transposing it to national legislation.
Re: O2 VoLTE: locating any customer with a phone call
#30Earlier quoted context omitted.
> The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking You clearly aren’t familiar with how broad the Computer Misuse Act is
> You clearly aren’t familiar with how broad the Computer Misuse Act is No, I'm not familiar with it at all. But usually illegal hacking requires to access devices in a way you aren't allowed to access. As long as making the phone call itself is not an issue, it should be fine. Dumping data from the memory of your phone can't be unauthorized. It would probably become an issue if you make unusual phone calls, harassin…
> Dumping data from the memory of your phone can't be unauthorized.
> just dumping the diagnostics for regular phone calls should be fine
IANAL, but computer hacking laws like the CMA in the UK and CFAA in the US are written in a manner so vague that even pressing F12 to view the source of a web page could be a violation [0]. From O2's perspective, they could argue that the OP has accessed their internal diagnostic data in an unauthorized manner. What we (technical people) think is irrelevant.
[0]: In the US, the DOJ has revised its policy to not prosecute defendants pursuing "good faith security research," which you may trust at your own risk: https://www.justice.gov/archives/opa/pr/department-justice-a...