Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

O2 VoLTE: locating any customer with a phone call

mastdatabase.co.uk

Post reply on HN
Print view View original

31–40 of 80 posts

Re: O2 VoLTE: locating any customer with a phone call

#31

Post by celsoazevedo »

kjellsbells wrote: post #21

Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I'm surprised that the pre-encryption payload is available.

They're using a rooted Android phone and an app called Network Signal Guru: https://play.google.com/store/apps/details?id=com.qtrun.Quic...

At least the free version of the app doesn't seem to "decrypt" anything, but it has root access and access to the modem, so it can read these logs. It can also disable bands and try to lock to a specific mast (like dedicated 4G/5G routers can), which is useful if you're trying to use mobile data as your main internet connection.

Re: O2 VoLTE: locating any customer with a phone call

#32

Post by throw123xz »

anonymousiam wrote: post #22

[flagged]

Using what seems to be a misconfiguration of a network feature to support the opinion that the UK has no privacy is a bit weird. Not only other networks don't seem to have the same issue, but companies and people screw up sometimes.

Also, is that Nigel Farage the same one of Brexit fame? The one who ran away when Brexit turned out to be different from what he and his party promised? That guy is going to save UK's privacy and freedom? lol.

Re: O2 VoLTE: locating any customer with a phone call

#33

Post by immibis »

andix wrote: post #8

The really interesting part of this issue is, that under most jurisdictions it probably won't even qualify as hacking. The data is sent out by the network voluntarily and during normal use. There are no systems at any point tricked into revealing personal data, which is often illegal, even if the hack is trivial. Even appending something like "&reveal_privat_data=true" to an URL might be considered illegal, because t…

It is, however, a data breach, triggering the requirement for them to report it to the regulator immediately or get fined, etc etc (if such rules exist in the UK)

Re: O2 VoLTE: locating any customer with a phone call

#34

Post by immibis »

celsoazevedo wrote: post #31
kjellsbells wrote: post #21

Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I'm surprised that the pre-encryption payload is available.

They're using a rooted Android phone and an app called Network Signal Guru: https://play.google.com/store/apps/details?id=com.qtrun.Quic... At least the free version of the app doesn't seem to "decrypt" anything, but it has root access and access to the modem, so it can read these logs. It can also disable bands and try to lock to a specific mast (like dedicated 4G/5G routers can), which is useful if you're trying to…

Right, so, that's the hacking tool they'll soon get prosecuted for using, while the problem will remain unfixed.

Re: O2 VoLTE: locating any customer with a phone call

#35

Post by mrjeeves »

kjellsbells wrote: post #21

Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I'm surprised that the pre-encryption payload is available.

Hello, article editor here. Many Android devices with Qualcomm chips offer the option to expose a modem diagnostics port over USB meaning a rooted device isn't even needed. It's just much easier to use NSG rooted on-device than going around with a laptop places.

It's as simple as using Scat (https://github.com/fgsect/scat) with the modem diag port enabled to view all signalling traffic to/from the network.

Re: O2 VoLTE: locating any customer with a phone call

#36

Post by mrjeeves »

edent wrote: post #3

O2 used to have a responsible disclosure address - but they removed it a few years back. When I worked there (many years ago) the security team was excellent. When I emaileld them about an issue last year, they were all gone.

We know the relevant team within O2 was actually informed, but evidently no action (or insufficient action) was taken.

Re: O2 VoLTE: locating any customer with a phone call

#37

Post by andix »

watusername wrote: post #30
andix wrote: post #27

Earlier quoted context omitted.

> You clearly aren’t familiar with how broad the Computer Misuse Act is No, I'm not familiar with it at all. But usually illegal hacking requires to access devices in a way you aren't allowed to access. As long as making the phone call itself is not an issue, it should be fine. Dumping data from the memory of your phone can't be unauthorized. It would probably become an issue if you make unusual phone calls, harassin…

> Dumping data from the memory of your phone can't be unauthorized. > just dumping the diagnostics for regular phone calls should be fine IANAL, but computer hacking laws like the CMA in the UK and CFAA in the US are written in a manner so vague that even pressing F12 to view the source of a web page could be a violation [0]. From O2's perspective, they could argue that the OP has accessed their internal diagnostic d…

I don't have a lot of knowledge about US and UK law, but I hear a lot of bad things.

"good faith security research" is a different ballpark though. Some laws catch all unauthorized access, even if the intent is not in a bad faith (which is probably a very bad idea, but that's how it is). But it also makes sense to some point: if your neighbor has a really bad lock that can be opened just by hitting the door frame a few times, you're also not allowed to break in just to disclose their bad security.

Usually some deliberate action needs to be taken that qualifies as unauthorized access. Something like adding a malformed header to a HTTP request could be enough. Or logging in with credentials that are clearly not yours (even if it's just admin/admin). But logging the traffic of regular and authorized usage patterns shouldn't be enough.

Re: O2 VoLTE: locating any customer with a phone call

#38

Post by mrjeeves »

lol768 wrote: post #2

> Attempts were made to reach out to O2 via email (to both Lutz Schüler, CEO and securityincidents@virginmedia.co.uk) on the 26 and 27 March 2025 reporting this behaviour and privacy risk, but I have yet to get any response or see any change in the behaviour. This is really poor. And why is a Virgin Media address the closest best thing here? https://www.o2.co.uk/.well-known/security.txt should 200, not 404. To be cle…

This one is actually on us. The email contacted was actually @virginmediao2.co.uk, not @virginmedia.co.uk. It's a typo in the article.

I'll update it with a correction.

Re: O2 VoLTE: locating any customer with a phone call

#39

Post by netsharc »

throw123xz wrote: post #32
anonymousiam wrote: post #22

[flagged]

Using what seems to be a misconfiguration of a network feature to support the opinion that the UK has no privacy is a bit weird. Not only other networks don't seem to have the same issue, but companies and people screw up sometimes. Also, is that Nigel Farage the same one of Brexit fame? The one who ran away when Brexit turned out to be different from what he and his party promised? That guy is going to save UK's pri…

Lots of these incels are surprised that the UK has different free speech laws to the US and are outraged that posting incendiary things on social media (racist violence-inciting anti-migrant comments) can lead to a visit from the police, arrest, and conviction...

Their genius is thinking posting things in public is related to "privacy"...

Post reply on HN