O2 Privacy Flaw Sends Users' Mobile Numbers to Visited Websites

[MacRumors]

As noted by think broadband, a privacy flaw in the way UK carrier O2 handles web traffic on mobile devices has resulted in users' mobile numbers being sent to any website visited from the device as part of the headers in the HTTP requests. While O2 is apparently still investigating the situation, it appears to have the potential for significant privacy-related issues.

If you're reading this news article using your O2 mobile phone, you'll be pleased to know that O2 have already sent us your mobile phone number within the HTTP headers which normally contain information about how content can be displayed on your device. These headers are not normally seen by users, and usually not logged by most websites, but the flaw allows malicious sites to get more personal information about you than you may be willing to share.

For example, if you open an e-mail which includes references to external images, the mere action of opening the e-mail would divulge your phone number. This could be used by anyone undertaking a phishing attack or other scam to get more information from you. The opportunity to abuse this is potentially endless.

The issue was discovered by Twitter user @lewispeckover, who then set up a website to allow users to see what headers are being sent as part of their HTTP requests to websites.

He now notes that the headers coming from his device appear to have stopped showing his mobile phone number, although O2 has yet to issue an official statement on the matter. The company's Twitter account is continuing to blast out responses to concerned users, noting only that the company is looking into the situation and will issue an update when it knows more.

The issue is not exclusive to the iPhone and has the potential to affect all mobile data on the second-largest carrier in the UK, although some users have reported that they are not seeing their mobile numbers appearing in their HTTP request headers. The issue has the potential to for a significant impact on UK iPhone users, as O2 has proven to be a popular choice for iPhone users dating back to its status as the exclusive iPhone carrier in the UK when the device originally launched back in 2007.

Those familiar with the UK's privacy laws have indicated that mobile phone numbers are not considered protected information, but the disclosure of such numbers as part of standard HTTP requests does have the potential to carry implications for users.

Article Link: O2 Privacy Flaw Sends Users' Mobile Numbers to Visited Websites

 

[japanime]

The "O" is for "Oops!"

 

[ChazUK]

Wirelessly posted (Mozilla/5.0 (Linux; U; Android 4.0.2; en-gb; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30)

Glad I'm no longer on o2 given this news.

 

[Elijahg]

I've really not been impressed by O2 in recent years. I first joined them in 2006, but ever since then, their network coverage in the 20 mile radius of here (near Bath) hasn't improved one bit. The 3G coverage is absolutely awful. If you aren't in a major town or a city, you have no chance of 3G with O2, only dial-up speed GPRS. Not even EDGE in most cases.

Everything Everywhere are very good, but Three (in the south of England at least) are best by far for 3G coverage.

Perhaps if O2 spent more money on, well, being a service provider and improving their network, rather than all that "priority moments" crap, they might increase their 3G coverage.

 

[rmwebs]

Only O2 could do something as stupid as this

Glad I moved away from their crummy services after my first iPhone contract was up. Works out MUCH cheaper to just buy an unlocked iPhone from Apple, otherwise you end up spending around £900 for the contract over a 2 year period.

Cant beat T-Mobile/Orange for coverage now that they have merged into EverythingEverywhere

 

[mw360]

Lots of present-tense hyperbole in the article but the episode seems to be over. Checked mine, no phone number transmitted.

 

[navtis]

Not so in my o2 account with an iPhone using iOS 5.0.1 via Safari. All it gets is:

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3

- but no number

 

[philstubbington]

It's over now (for me, anyway )

I had this issue when I first saw the story this morning, but having checked it just now, seems to have been fixed. Still not clever though!

 

[VulchR]

Makes me glad I'm with Orange UK. If this story is true, then O2 are really going to have egg on their face....

Anybody know what the salary/bonus is for the CEO of O2?

 

[Elijahg]

Not so in my o2 account with an iPhone using iOS 5.0.1 via Safari.

It wasn't inserted into the user agent, it was a separate header: "x-up-calling-line-id".

 

[SimonTheSoundMa]

From TFA

Another annoying feature of O2 is that they interfere with the responses from servers too. They downgrade all images and insert a javascript link into the HTML of each page. I've talked to customer service about this lovely feature several times, but they never have a clue what I'm talking about, let alone any idea how to opt out/disable it.

I asked O2 about this a couple of years ago and asked to have a copy of their privacy policy. They didn't have one, and perhaps still do not.

Contract customers can switch it off by using different APN credentials. PAYG and giffgaff customers cannot turn it off.

 

[Frosticus]

Hmmm..., I'm with O2 and it doesn't appear to do it with mine when I visit taht website.

At first I thought it was (obviously) because I had wifi enabled, but I disabled it and tried again - same result. No number that I could recognise in the header.

Fluke?

 

[The Phazer]

This does appear to have been fixed in the last hour, but is typical for O2. I'm sure many of you remember when O2 sent the credit card numbers of iPhone users attempting to opt out of their ludicrous age verification system in plaintext, and then preceeded to lie about it ever happening and censor any posts about it on their own boards or blogs.

Phazer

 

[stordoff]

Not so in my o2 account with an iPhone using iOS 5.0.1 via Safari. All it gets is:

User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3

- but no number

That's only the user agent. It was in one of the other headers.

 

[SimonTheSoundMa]

http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html

 

[Spanky Deluxe]

O2 have just released a Q&A regarding this: link

O2 mobile numbers and web browsing

Security is of the utmost importance to us and we take the protection of our customers’ data extremely seriously.

We have seen the report published this morning suggesting the potential for disclosure of customers’ mobile phone numbers to website owners.

We investigated, identified and fixed it this afternoon. We would like to apologise for the concern we have caused.

Below is a set of Q&As, to answer questions we've been receiving. If you have further questions, do leave them in the blog comments and we will do our best to answer as many as possible.



Q: What's happened with O2 mobile numbers when I browse the internet on my mobile?

A: Every time you browse a website (via mobile or desktop), certain technical information about the machine you are using, is passed to website owners. This happens across the internet, and enables website owners to optimise the site you see. When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice. We share mobile numbers with selected trusted partners for 3 reasons: 1) to manage age verification, which manages access to adult content, 2) to enable third party content partners to bill for premium content such as downloads or ring tones that the customer has purchased 3) to identify customers using O2 services, such as My O2 and Priority Moments. This only happens over 3G and WAP data services, not WiFi.



Q: How long has this been happening?

A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners.



Q: Has it been fixed?

A: Yes. It was fixed as of 1400 on Wednesday 25th January 2012.



Q: Which of my information can website owners access?

A: The only information websites had access to is your mobile number, which could not have been linked to any other identifying information we have about customers.



Q: Why did this happen?

A: Technical changes we implemented as part of routine maintenance had the unintended effect of making it possible in certain circumstances for website owners to see the mobile numbers of those browsing their site.



Q: Which customers were affected?

A: It affected customers accessing the internet via their mobile phone on 3G or WAP services, but not WIFI, between 10th of January and 1400 on Wednesday the 25th of January.



Q: Which websites do you normally share my mobile number with?

A: Only where absolutely required by trusted partners who work with us on age verification, premium content billing, such as for downloads, and O2's own services, have access to these mobile numbers.



Q: The Information Commissioner said he is investigating - what are you doing as part of this?

A: We are in contact with the Information Commissioner's office, and we will be co-operating fully. We have also contacted OFCOM.

 

[fabian9]

Wirelessly posted (Mozilla/5.0 (iPhone; CPU iPhone OS 5_0_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A405 Safari/7534.48.3)

My number doesn't show up either.

 

[forum user]

Q: How long has this been happening?

A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners.

Wow, for two weeks the phone numbers have been send to any website.

- Olaf

 

[robertosh]

I think that there are some less employers at o2.. incredible

 

[adder7712]

Good thing carriers in Malaysia has significantly less control on devices on their networks as carriers do not sell phones.

 

[forum user]

Good thing carriers in Malaysia has significantly less control on devices on their networks as carriers do not sell phones.

It is not so much a question of control over the device.

When a mobile phone opens an internet connection the identification of the SIM card is needed to administer this connection. The ID of the SIM (IMSI) is not the phone number. (The phones on the O2 network are using the GSM standard with SIM cards)
In other words there is no technical reason for using the subscribers phone number when surfing the net. The phone number is only for us humans to call somebody, the network uses the IMSI.

Considering the above, transmitting of the phone number to a third party site becomes a rather delicate subject.

- Olaf

 

[goosnarrggh]

Good thing carriers in Malaysia has significantly less control on devices on their networks as carriers do not sell phones.

This has nothing to do with anything happening inside the phone itself. Apple was almost certainly not complicit in this.

O2 was most likely accomplishing this using "deep-packet inspection" on all data traffic flowing through their cellular service, to identify any TCP/IP connections which were carrying HTTP sessions. Any sessions that were so identified, were probably being manipulated to include some extra data, derived (as described in the post directly above this) from the subscriber identity contained in the SIM card.

...the network uses the IMSI.

In fact, The IMSI only plays an essential part of the communication link at the MAC layer, and even then it is only relevent to the MAC layer of the portion of the link that physically exists within O2's internal wireless network. It's nowhere near TCP, and certainly not relevant to HTTP.

Once the request leaves O2 and goes out on the open Internet, the IMSI becomes totally irrelevant from a technological standpoint, in the same way that the MAC address of any device on your WiFi network becomes totally irrelevant once a connection propagates out of your wireless router and down to your ISP.

The only thing the open Internet technologically needs to care about is the IP address of the phone and the socket over which it is communicating (or the IP address and socket of O2's NAT firewall or proxy server, if O2 is using such technologies.)

 

[ArtOfWarfare]

O2 has proven to be a popular choice for iPhone users dating back to its status as the exclusive iPhone carrier in the UK when the device originally launched back in 2007.

Can it really be considered a popular choice when it was the only choice? I think you can only date it back as far as when other carriers in the UK began offering the iPhone.

 

[Westyfield2]

I saw it this morning, and tested it with my iPhone.

I was going to be all ragey , but seeing as it was only from 10th of January to 1400 on today (not from the dawn of time) it's not soo bad .

I am now intrigued though as to who the "trusted partners" are. O2 themselves and BT Openzone are the only ones I can think of.

 

[4D4M]

I'm perfectly happy with O2, I've found the coverage decent and I don't get loads of junk text messages from them like I did from Vodafone*. This latest gaffe is a bit annoying, but whatever, as a business owner my details are well and truly 'out there' for all the lowlife to exploit anyway. Bring it on scumbags.

*The junk texts don't stop when you leave Vodafone. The other day I received a text that said "Come back to Vodafone and we'll give you a free Windows 7 laptop". If there's one thing that would be guaranteed to STOP me going back to them, it's the threat of a crappy low end piece of junk with a crappy low end OS turning up at my house.