O2 statement on the mobile number issue

http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html

by SandB0x • 15 years ago

96 61 15 years ago

blog.o2.co.uk

christoph• 15 years ago

"but only with certain trusted partners."

Hmmm.... not sure I believe them on that part.

rmc• 15 years ago

You don't have the believe them. Numerous people have found it clear that they are not sharing it with only trusted parties, but were in fact sharing it with everyone.

This is a factual inaccuracy in the statement from O2.

urbanjunkie• 15 years ago

Not necessarily.

O2's position is clearly that they normally only share mobile numbers with these unspecified "trusted partners". However, this configuration glitch has led to the mobile number being shared with everyone.

I think most people reading the statement would understand that.

alexchamberlain• 15 years ago

Erm... they admitted they were sharing it with everyone due to a bug, but now they've fixed it...

kolektiv• 15 years ago

Predictable, nothing too surprising. I think they're going to have a lot of questions to answer around age verification though, seeing as they put in an age verification program without customer request or warning over the last year or so.

From this I'm assuming that the company they used for this (Bango I believe) would have been sent my mobile number in the past if I ever tried to access content they thought should have been verified. There has not previously been any messaging from o2 around this. Disquieting indeed. I would not have agreed to that transfer of information (nothing to hide, but it's MY information).

mhw• 15 years ago

So, a configuration snafu by the sound of it. But it's also drawn attention to the fact that they share customers' phone numbers with 'selected trusted partners' which will probably come as a surprise to many. If their audit mechanisms and processes are so lax that sharing phone numbers with the whole internet wasn't recognised, how well managed can we expect the 'trusted partners' white list to be?

Torn4• 15 years ago

> "A: The only information websites had access to is your mobile number, which could not have been linked to any other identifying information we have about customers."

The problem here is not that it was only the mobile number, rather that these sites are able to link your mobile number to the content that you have viewed. There's a scenario here in which sites that had collected this information could publish (or otherwise leak, i.e. through hacking) lists of mobile numbers to URLs visited.

In an age of lax privacy protections and data-sharing it's not hard to obtain people's mobile numbers. What would happen when a potential employer googles your mobile phone number and finds the crawled data?

Steps we now need to take:

1) Some kind of request to get the full list (Subject Access Request under DPA, as pointed out below?)

2) If there is no opt-out process, lodge a Data Protection complaint to the ICO

alexmuller• 15 years ago

> A Freedom of Information request to get the full list,

Although (as far as I know) the FOI Act only applied to public bodies (government and organisations like universities). So O2 wouldn't need to comply with a request under that act. Not sure if the ICO could force them to disclose that info, but I doubt it.

http://en.wikipedia.org/wiki/Freedom_of_Information_Act_2000...

mike-cardwell• 15 years ago

1.) FOI only applies to public bodies. You can't send an FOI request to O2.

2.) People probably opted in to this without realising. Do they need to supply an opt out, if it was a condition of signing up in the first place?

richardburton3• 15 years ago

I am still stunned that they respond so swiftly to this but have not dealt with SMS spoofing in years:

http://news.ycombinator.com/item?id=3509228

This is certainly bad, but SMS spoofing has the potential to do a lot more damage. People trust SMS too much.

talkingquickly2• 15 years ago

This seems to be quite a simple fix; SMS spoofing's a much more complicated problem I think because it requires co-operation across carriers.

There are also a lot of services which rely on "legitimate spoofing" e.g. skype allowing you to send text messages from it's service which appear to be from your actual mobile number (so they can be replied to etc).

richardburton3• 15 years ago

Just because it is complicated does not mean it should not be dealt with. Fast.

dan_b• 15 years ago

It's a feature, not a bug.

DougBTX• 15 years ago

A: The only information websites had access to is your mobile number, which could not have been linked to any other identifying information we have about customers.

But it is used for age verification and billing...

mseebach2• 15 years ago

I think it means that only phone numbers were exposed, not other identifying information. The billing and age verification systems (into which presumably the phone number is a key) were not compromised.

gjulianm• 15 years ago

I suppose that O2 gives their trusted partners a way to check age and make billings through a private API or similar. Any other site which is not affiliated with them wouldn't have access to that API so they can't get any other information.

justincormack• 15 years ago

But a hash of the number, or a random id would work for this too.

talkingquickly2• 15 years ago

It's a shame they've come so close to an open and honest response and then detract from from it with phrases such as "possible in certain circumstances for other websites to see the mobile number." From what I understand it wasn't really certain circumstances, it was in almost all circumstances that the data was made available; whether the site knew it was available or chose to do anything about it was another matter.

I wonder if this means that Age verification can be spoofed by changing that header or if it's just one of several methods they use.

jodrellblank3• 15 years ago

Certain circumstances presumably meaning you use 3G, don't use a company VPN or Proxy, are not abroad and roaming.

extension• 15 years ago

In other words, the general circumstance. There is no reason to say "potential in certain circumstances" other than deception.

executive• 15 years ago

I work with major carriers in North America - This is not industry standard practice here.

At most, we will send area code to partners (mostly for ad targeting) but this is never exposed in wap headers.

If we are doing age verification, we send age range to partners.. likewise never exposed in headers.

Never full phone number. If for some reason a partner needs access to this, they would have a local database corresponding to scrambled wap signatures - which ARE sent in headers.

otoburb2• 15 years ago

This is where the interpretation of the statement comes into play. It's certainly commonplace throughout the wireless carrier industry to send the mobile number to "trusted sites" within the carrier network (such as a ringtone/download portal), or over a pre-arranged VPN tunnel.

And when I say "commonplace", I'm referring to multiple carriers around the world, including North America.

However, the level of trust that a site qualifies for may necessitate a more nuanced or out-of-band approach similar to what you've experienced, where a 3rd party partner may receive the scrambled identifier and request the mobile number mapping for billing purposes.

There are lots of ways to skin a cat. My only point here is that there are multiple carriers around the world that routinely use this method of sending the mobile number in plaintext to sites they trust, typically over communication channels that they trust (i.e. over network gear they either own or have secured). I've seen this from both sides (working at and with carriers).

But there are a heck of a lot more 3rd party partner sites that do not usually receive full mobile numbers in the clear, so from that perspective, there is a point to be said about this not being "industry practice". Semantics.

philjackson• 15 years ago

Why do they need to give out numbers to anyone, ever? How does a mobile number help with age verification?

jrockway2• 15 years ago

It lets them charge your account without you knowing when, which is good for them.

I also wonder what use "age verification" is on the Internet. There's no shortage of "adult content" up on the torrent sites.

jrockway2• 15 years ago

I don't understand how this "trusted partner" thing would work. It's HTTP and phone numbers are not secret. Can I send an HTTP header with a "friend's" phone number in it and have their account charged.

Sending your name in clear text is not a digital signature.

(There are so many good ways to authenticate users of a network that it makes me sad to see "tack on a phone number" was even considered, much less implemented, pushed to production, and accidentally turned on for the Entire Internet. Doh.)

bwarp2• 15 years ago

The man-in-the-middle proxy adds the phone number based on your IMEI. You could probably send someone else's number down and it'd change the header back to yours in the proxy.

The SMS spoofing issue (which has been around forever) is far worse as it's not proxied anywhere. Some SMS-controlled devices use the SMS from number as an authentication scheme which is much much more dangerous as that can be spoofed easily.

It's all about trust and it appears that trusting proprietary networks is an issue.

mseebach2• 15 years ago

Hopefully, it's augmented by verifying the origin of the traffic. But yeah, not exactly bulletproof.

tommyd• 15 years ago

If it's anything like the systems I've come across, there is a proxy server on the mobile data network with a whitelist of either IPs or URL patterns that will have the number added as a HTTP header ("header enrichment"), then the endpoints (so the third party systems) must be configured to only accept this header from the IP range of the proxies, so that should avoid spoofing if correctly configured. I'd have thought this IP restriction requirement would be part of the contract they'd have to sign to get the data.

jgroome• 15 years ago

Firstly, hats off to O2 for going into crisis mode, responding to customer complaints directly, and then resolving the issue and putting out a complete statement on the same day the matter was brought up.

Secondly, however, this statement smells faintly of fluffy language and PR speak:

> When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.

Is it really industry practice? Can anybody in this field confirm this? I can see why it would be useful for billing as they mention, but is this really an effective way to do age verification?

> in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners.

Woah, there's nothing "potential" about it - this was right there in the HTTP headers. Saying "there has been the potential..." implies the website owner would have had to do some hacking to get hold of this information, which is not the case, right?

mooism25• 15 years ago

I presume most websites that weren't expecting to find an O2 number in the HTTP headers won't have looked for it, won't have logged it, etc.

If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?

uptown• 15 years ago

yes

civild• 15 years ago

It's quite straightforward to dump the entire header in a web log or database, and I'm sure some sites do.

They might have put the envelope in the recycling, but they never have it emptied and someone just told them it contains a £20 note.

Torn4• 15 years ago

> If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?

Yes. Intent and the fact you did it is what matters here.

noobiscus• 14 years ago

"If I send a secret to you in the post, and you put the envelope in the recycling unopened, have I disclosed a secret to you?"

Oh god yes. Everyone who reads your comment is hoping you don't work with financial, personal, confidential or (eek) classified information.

stuff4ben• 15 years ago

Yes this is industry standard practice. I worked on the official mobile appstore for AT&T Wireless (way back when it was known as Cingular) that handled ringtones/graphics/apps/games and we had access to that header as well for billing purposes. We used it to track purchase history on that site for recommendations/profiling and also used it for segmenting the mobile UI storefront.

otoburb2• 15 years ago

> Is it really industry practice? Can anybody in this field confirm this? I can see why it would be useful for billing as they mention, but is this really an effective way to do age verification?

I'm in the field, and this is indeed standard industry practice. It is useful for many purposes, billing and age verification being just two, but the main root reason being that wireless carriers typically use the mobile number as the root identity for a subscriber profile that is shared across multiple backend systems.

It's an effective way to do age verification provided the carrier has implemented some type of process during sign-up or via some other (in)direct method, mainly by leveraging the identity of the subscriber and running a check against it.

deltaqueue• 15 years ago

A few years ago Verizon included an XID variable in the headers (essentially a unique subscriber code), but I'm not sure what the SOP is today.

Granted, there are still several ad-testing companies that store a variety of mobile cookies for tracking impressions, but this is much different from permanent, header-based tracking that used to occur with Verizon and possibly others.

andyking• 15 years ago

A similar technique seems to be in use by at least one other UK network.

I'm with 3 (one of O2's rivals) and if I access my account information from my handset connected to their network, it takes me straight to the relevant info without a pesky login. (If I try the same via wi-fi, I get a page asking me to disconnect from the hotspot and go back online via 3G.)

I always did wonder how they achieved this--sending the mobile number in the HTTP headers is likely.

tcas• 14 years ago

This seems like a possible security hole. I wonder what will happen if you forge the HTTP header to pretend your someone else.

sc00ter2• 15 years ago

It seem O2 may not be the only one up to this:

  Headers that can be used to identify the end user:

  Header name 	 	What it means
  x-drutt-portal-user-msisdn 	The mobile phone number.
  x-h3g-msisdn 	 	the phone number.
  x-imsi: 	 	The imsi number. Identifies the end user.
  x-msisdn 	 	The end users phone number
  x-wsb-identity 	End users phone number
  x-wte-msisdn: 	Indicates that the value is a phone number. Does not look like that...
  x-nokia-imsi: 	Imsi value
  x-nokia-alias 	The end users phone number. encrypted.
  x-nokia-msisdn: 	The users phone number in plain text.
  x-up-calling-line-id: 	End user identifier

Gleaned from: http://mobiforge.mobi/developing/blog/useful-x-headers?dm_sw...

Edit: fixed the formatting.

sc00ter2• 15 years ago

Detailed white-paper: "Privacy Leaks in Mobile Phone Internet Access"

http://news.ycombinator.com/item?id=3510520

guyht• 15 years ago

Surly this is hugely open to abuse. I could curl requests at a O2 partners site to purchase a ringtone and pass along any O2 number I like, setting the aforementioned headers. Unless the partner site does some sort of extra verification (I have seen no mention of this anywhere), then the O2 number I use will run up a massive bill... Have I missed something?

weavejester• 15 years ago

One of the principles of the Data Protection Act here in this UK is:

Personal data shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes.

In my view, mobile phone companies have my phone number so they can connect my calls. Providing age verification with "trusted partners" would seem to be a step beyond that specified purpose.

The act also says:

Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

If you just want to verify age, or verify the customer uses O2, then providing their entire phone number seems excessive to me. Even if they want to bill the user, a UUID could be used that's unconnected to the user's phone number.

Even if O2 were just sharing the data with "trusted partners", it doesn't look like they were acting legally.

Torn4• 15 years ago

As to age verification, how there isn't a boolean 'isMajor' per-account baffles me. They take your DoB during the sign-up process.

Agreed 100% on the UUID - authorisation does not have to mean identification.

Confusion• 15 years ago

The 'excessive' angle seems hopeless to argue: that just leads to endless debates about what is 'excessive'.

Instead, I'd rather argue about whether this piece of personal data is 'relevant'. It obviously isn't. As you say, they could easily replace it with a UUID or, to use something permanent already at their disposal, your O2 customer-id (which might arguably also be personal information, but at least not something anyone with wireshark can immediately use to get you on the bloody phone).

It's an example of sheer laziness to send the telephone number itself instead of doing a lookup and sending something less sensitive. I've dealt with a similar situation with zipcode verification and you can bet I refused to send the zipcode straight up or hashed (the number of zipcodes is rather limited).

biafra2• 15 years ago

"Q: Which websites do you normally share my mobile number with?

A: Only where absolutely required by trusted partners who work with us on age verification, premium content billing, such as for downloads, and O2's own services, have access to these mobile numbers."

But those trusted partners may share your mobile phone number with their "trusted" partners. I know Ericsson IPX does this at least in Germany.

It usually works via several http redirects and is unnoticeable even to the client application using the usual http client APIs.

You can prevent this by using a http proxy.

jodrellblank3• 15 years ago

Those blog comments are pretty dismal; aside from the didn't read/don't understand/just angry, the repeated calls for a total list of trusted partners - is a blog comment really the right place to ask that? Does anyone expect O2 to answer those?

And how many people think such a list is going to be useful at all? It won't be three companies you've heard of, it will be pages and pages of sites and background services companies and test sites and so on.

Mr or Mrs "I want to make a considered decision, I might not trust them", are you really going to make a considered decision if your number is passed to, say, "TechElbonia UK Services, O2 portal processing for connections passing through dept 17 routes, and URLs matching the following 10 line regex (..)"?

mjs• 15 years ago

The list of trusted partners is interesting to see what happens if you spoof mobile phone numbers. They've already said that it's involved in payment in some way...

_b8r0• 15 years ago

I use O2 with my iPad 2, and this really doesn't surprise me. The 'adult payment' restriction on half of the Internet made me quickly find out that VPNs offer a practical workaround.

I don't trust O2 as a bearer, so I use a VPN instead, which also comes in handy for hotel room/café wireless hotspots.

rmoriz• 15 years ago

maybe it just happend this way:

"Hello o2, this is your trusted partner acme!

Can you please add our ips to the MSISDN whitelist? It's 0.0.0.0/0

thanks"

masenf• 14 years ago

"2) to enable third party content partners to bill for premium content such as downloads or ring tones that the customer has purchased"

Does anyone else get the feeling this could be exploited to make unauthorized purchases which would be billed to <random_O2_customer>. I've want to think they have this covered, but with a config glitch leaking your phone number on the net who knows what kind of security they have in place.

Does anyone know how this billing process works?

O2 statement on the mobile number issue

Related Stories