8 ms·

UK network o2 send your number to every site you visit

362 points by wgx 15y ago

wgx 15y ago
Tried it on my iPhone using o2's network and my number was indeed inserted into the headers.
- christoph 15y ago
  Tested and confirmed on my Galaxy S2 as well.
- robgough 15y ago
  Seconded. iPhone 4 and O2-UK
- ambuj 15y ago
  Yep, same here. iPhone/O2 (UK) - my number's there!
- chitabox 15y ago
  Confirmed with Samsung S2, Additionally, x-wap-profile provides phone model (GT-I9100) Additionally, confirmed on HTC HD2 on Tesco Mobile - Custom ROM (ICS 4.03), thinks its a Nexus HD2 - Stock browser display phone number, Dolphin Mini also displays number!
jarofgreen 15y ago
Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.
- jarofgreen 15y ago
  https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than official policy response but hopefully the storm coming their way will get an official response soon.
  - alexchamberlain 15y ago
    From the oracle (Wikipedia), Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation. It is in fact illegal for the website to obtain this information... Lew, you're going down... Only joking.
  - cubicle67 15y ago
    The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" ...and for people using iPod Touches or similar?
  - mattmanser 15y ago
    Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'
- jarofgreen 15y ago
  While waiting for an upload, I had a look. This tag is inserted in the head: <script src="http://1.2.3.4/bmi-int-js/bmi.js http://1.2.3.4/bmi-int-js/bmi.js language="javascript"> This is inserted at the end: <script language="javascript"> </script> The external JS is here: http://pastebin.com/rv3k4meX http://pastebin.com/rv3k4meX Analysis please. At an initial glance it seems to just be about the image compression.
  - iamichi 15y ago
    Here is a un-minified version: http://pastebin.com/t0FhS2Z7 http://pastebin.com/t0FhS2Z7 My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.
- samarudge 15y ago
  The javascript changes all image URL's to lower quality versions from O2's servers, it also provides a helpful little function which lets you use a hotkey (Alt+D I believe) to download all the images in full quality. The javascript comes from the domain //1.2.3.4/bmi-int-js/bmi.js (Not a real domain, only works behind O2's proxy)
- larsgirndt 15y ago
  We got aware of that problem in October 2011 during relaunch of our website and we faced it also with t-mobile in germany. After digging around helpful sources have been http://stackoverflow.com/questions/4113268/how-to-stop-javascript-injection-from-vodafone-proxy http://stackoverflow.com/questions/4113268/how-to-stop-javas... Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.
  - tomgallard 15y ago
    Yes- we were stung by this one. Our boss saw errors loading the site on his iPad, but whenever we brought him into the office to try and replicate it, the problems disappeared. We finally figured out it only happened when he was out the office, so on 3G not WiFi, and then managed to find the stackoverflow post you mention.
wgx 15y ago
Additional write-up on another site here: http://www.thinkbroadband.com/news/4990-o2-shares-your-mobile-phone-number-with-every-website-you-visit.html http://www.thinkbroadband.com/news/4990-o2-shares-your-mobil...
- otoburb 15y ago
  The write-up is more charitable when it comes to the possible reason why this may be happening. The specific quote: " Our suspicion is that the feature is used by internal O2 websites to identify the user trying to make changes to the account, but that one or more of O2's proxy servers have been misconfigured." x-up-calling-line-id (and similar headers from other gateway vendors) are typically not meant to be sent in the clear beyond internal sites. Perhaps a certain set/class of URL ACLs were (mis)configured during a maintenance window that caused this to happen. Similar to how websites leave cookies, carriers have always had the ability to send certain identifying information to external sites. Usually, such identifying information is munged in some way that doesn't make it possible to determine the mobile number of the subscriber. The funny thing is that people are often surprisingly willing to provide their phone number on more and more sites, which then makes it trivial for such services to link the anonymized identifier with the actual mobile number. Regarding the customer support folks, it's highly unlikely that they know anything about HTTP headers, since they are typically level 1 support. This type of query/complaint would be filtered up to level 2 or 3 usually quite quickly once enough customers start calling in, or if somebody happens to be reading certain media outlets (e.g. HN).
  - jarofgreen 15y ago
    Some tweets claim it isn't happening for them any more so maybe this was a mistake being fixed? However, amusing it's a honest mistake being fixed, this still SHOULD NOT HAPPEN in the first place. Companies dealing with personal data need to be more careful when the ramifications of "honest mistakes" can be so serious. It's right that people are making a fuss about this and pressuring O2 to fix this. > The funny thing is that people are often surprisingly willing to provide their phone number on more and more sites, which then makes it trivial for such services to link the anonymized identifier with the actual mobile number. Sure, but that still doesn't excuse this.
MrKurtHaeusler 15y ago
Just tested on o2 Germany, and no such header was inserted. It would probably be illegal here anyway.
- wgx 15y ago
  I have a hunch that it's probably a breach of data protection law in the UK too.
- jarofgreen 15y ago
  I would sodding hope it's illegal in the UK to! Altho as IANAL I can't think of which law exactly would cover it. Anyone know? I'm envious, you Germans have great privacy laws.
  - alexchamberlain 15y ago
    Data protection act - Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
    - jarofgreen 15y ago
      I suspect any legal case would hinge on whether your mobile phone number counted as personal data or not. Again, IANAL, but the Data Protection Act is not specific on what counts as personal data and instead leaves it up to case law and I think the data registrar(?) to clarify.
      - alexchamberlain 15y ago
        Information Commissioner, or at least his office. However, I think it is generally percieved as personal.
        15y ago
alexchamberlain 15y ago
Not inserted on Dell Streak.
edandersen 15y ago
You should be able to bypass the proxy that inserts the HTTP headers with the following APN on O2: apn: mobile.o2.co.uk username: bypass password: password Worked in 2008 when I tried it (http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image-compression/ http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image...) as they used to screw with images on the App Store. I don't have access to O2 anymore, can someone try this and see if it still works? Edit: It still includes your phone number, thanks msmithstubbs.
- msmithstubbs 15y ago
  Just tried it. The phone number header is still being included.
  - iamichi 15y ago
    Same for me.
- dspillett 15y ago
  The only way to reliably work around operators messing around with what you access (inserting their own client side code and such) and potentially inserting stuff into the headers like this too is to use a VPN for all Internet traffic that isn't otherwise tamper proof (i.e. HTTPS with a properly signed cert). I use OpenVPN when I have my netbook tethered to my phone (or when I use any other "untrusted" wireless network for that matter) and route all traffic through my home fibre (I'm with an ISP that I know doesn't mess with my traffic). There are problems with that though: * installing OpenVPN on Android is a faf (I've still not got around to it on my device) [see http://vpnblog.info/android-openvpn-strongvpn.html http://vpnblog.info/android-openvpn-strongvpn.html and similar] - most users are not going to want to mess around like that * there is no garantee that it will even work (or work efficiently enough) on all networks, or they could classify all encrypted traffic in the same lump as encrypted P2P connections and shape/block accordingly * any VPN adds overheads (at least a set of headers per packet, and keep-alive packets when the connection is otherwise inactive), so if you don't have a cheap data plan that could be a consideration
- EwanToo 15y ago
kgutteridge 15y ago
A lot of mobile network operators wash this information about or have it hashed into some other form (which means it can still be used as a unique identifier) Some popular headers to check X-UP-CALLING-LINE-I X_NOKIA_MSISDN X_H3G_MSISDN MSISDN X_MSISDN X_NETWORK_INFO X-WAP-MSISDN X-UP-SUBNO
- perspective 15y ago
  I'm on 3 w/Samsung Galaxy SII & Cyanogenmod and it's not sending any phone-specific headers.
  - biafra 15y ago
    It is not the phone that sends these headers. It is the internet gateway or proxy at the carrier that inserts it.
rix0r 15y ago
I'm using Vodafone and I'm seeing an "X-VF-ACR" header in my headers that contains a very long base64-encoded string. Anyone any idea what it is? (Edit: Looks like a big bunch of binary)
birger 15y ago
Isn't this information used as an extra security layer when using your mobile phone for payments or bank transactions? Here in The Netherlands when I want to use my mobile phone to log in to my bank account and do transactions, I first need to confirm my phone number and a special code. I can imagine that then they need the phone number in the header to verify it is my phone. And how is this information different then an IP adress that they also have with each request?
- wgx 15y ago
  >And how is this information different then an IP adress that they also have with each request? Unscrupulous marketers can't do much with your IP address. They can do a lot more evil with your mobile number: SMS spam, cold calls, re-sell your data, etc, etc...
- alexchamberlain 15y ago
  Headers are too easily spoofed to carry security information without a signature.
  - mooism2 15y ago
    It's like security through obscurity: on its own it's inadequate, but as an extra layer it can be helpful.
    - alexchamberlain 15y ago
      How is this helpful? We have proved it's inconsistent... Do you check IP addresses for security too?
      - mooism2 15y ago
        I can imagine a bank fraud detection system being more suspicious of unusually large transactions if they originate from an unusual phone number or ip address, yes.
- 15y ago
rheeseyb 15y ago
This doesn't appear to be happening with the Samsung Galaxy Nexus *edit scratch that it is happening now. Both attempts were on 3G only. Seems it doesn't always happen.
mseebach 15y ago
This does not happen on giffgaff, a MVNO owned by and operating on O2s network.
- philjones88 15y ago
  Actually it does for me. Perhaps its the handset that determines this issue? I have a O2 PAYG HTC HD7 WP7.5 device that I use with GiffGaff and the page clearly lists the header and my phone number.
  - mseebach 15y ago
    Perhaps I should turn off wifi. Facepalm. Yes, it happens on Giffgaff too.
- prof_hobart 15y ago
  It does for me.
Leynos 15y ago
Using Opera Mini seems to disable this "feature". Of course, doing so means all of my web traffic goes via Oslo. And of course, any apps using an http API are presumably affected too. I'm rather disappointed to hear about this.
- ntmartin 15y ago
  +1 the header is gone via Opera Mini and their proxy. Leaving O2 after this, definitely not cool.
- mhw 15y ago
  > Of course, doing so means all of my web traffic goes via Oslo. Which probably means that your phone number is going to Oslo instead. At least it's not being proxied onwards from there.
  - pmjordan 15y ago
    Opera Mini uses its own protocol to talk to the proxy. HTTP is quite chatty, so there's a lot of mileage in reducing the headers by simply omitting a lot of unneeded information and compressing the rest.
  - pmjordan 15y ago
    Opera Mini uses its own protocol to talk to the proxy. HTTP is quite chatty, so there's a lot of mileage in reducing the headers by simply omitting a lot of unneeded information and compressing the rest.
mattyohe 15y ago
Well, their twitter guy just woke up: https://twitter.com/#!/o2 https://twitter.com/#!/o2
- jarofgreen 15y ago
  9.21am in the UK, the office just opened. This will be a fun day for the poor workers on level-1 support :-)
shocks 15y ago
Orange UK here - nothing in my headers. Clean as a whistle.
JCB_K 15y ago
I'm on Giffgaff, which is a daughter company of O2, same problem. Started a support thread on the website, let's see what they say.
- chalgo 15y ago
  Also commented on this on the GG community. Hopefully Giffgaff can apply some pressure on O2 from a more official direction.
- gerrit 15y ago
  On giffgaff too, any chance you could link to that thread?
  - SandB0x 15y ago
    http://community.giffgaff.com/t5/Help-Ask-the-community-got-stuck/o2-sending-mobile-number-in-http-headers-of-mobile-internet-page/td-p/2852253 http://community.giffgaff.com/t5/Help-Ask-the-community-got-... and http://community.giffgaff.com/t5/Contribute-Innovation-Promotion/Phone-number-being-sent-in-header-to-websites/m-p/2851947 http://community.giffgaff.com/t5/Contribute-Innovation-Promo... and http://community.giffgaff.com/t5/Contribute-Innovation-Promotion/Massive-Giffgaff-Privacy-Breach/td-p/2852711 http://community.giffgaff.com/t5/Contribute-Innovation-Promo...
bravolima 15y ago
I'm not seeing the header - HTC Desire.
- samwilliams 15y ago
  I am not seeing it on the HTC Sensation either. This article seems to agree with us too: http://www.slashgear.com/o2-sharing-phone-numbers-for-mobile-surfers-but-not-everyone-25210620/ http://www.slashgear.com/o2-sharing-phone-numbers-for-mobile... I wonder what the (de)selection criteria is then?
cornet 15y ago
Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!
- jarofgreen 15y ago
  Can you tell us more about the kind of people who count as a trusted site, how you get on this list, and if this is made public/opt-outable anywhere? (Thanks for reporting!)
  - otoburb 15y ago
    The criteria varies per carrier. In most cases, a trusted site is one run or owned by the carrier (e.g. carrier portal site). Getting on this list usually (from what I understand) requires a whole lot of paperwork and approvals. In terms of being made public or opt-outable, I'm not aware of any carriers that do this. I guess it depends on which 3rd party sites have negotiated agreements and obtained appropriate opt-ins from you and/or the carrier in various Terms of Agreements. For example, banking sites probably get a free pass when it comes to your mobile number because you may have entered it in to the banking application for verification purposes (just an example).
    - jarofgreen 15y ago
      It's the 3rd party sites I'm more interested in - I can see that carriers may want it as a security function for internal websites and as they already have your number and all your details anyway, it's not really an issue then. For instance with your banking example, yes, I may have given my number and probably have if I'm a customer. But what if I'm just browsing a banks website thinking about opening an account? Should they have my number then? (but of course banks are unlikely to abuse this for spam or anything.) But can you see how people would think this is a grey area with potential for abuse? So basically, we just have to trust our carriers not to sell us out with no way of checking up on them?
MattBearman 15y ago
I got the header inserted on my iPhone 3Gs, not happy about this.
jsvaughan 15y ago
I'm on o2 business / htc desire / cyanogen and my phone number is in the header. wtf.
wr1472 15y ago
My colleague just tried it with Tesco Mobile which runs on O2 on his Galaxy S2 and his number was in the header.
- JosephRedfern 15y ago
  I concur - this is also happening on an iPhone 4 on Tesco.
alexchamberlain 15y ago
I think we should write to the ICO about this.
Torn 15y ago
I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.gov.uk/complaints/data_protection.aspx
- alexchamberlain 15y ago
  Can you post what you send and then we can all forward it?
  - Torn 15y ago
    Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header. Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited. This can be verified by visiting http://lew.io/headers.php http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page. SECTION 10: Online utility that will show you the headers sent in your page request: http://lew.io/headers.php http://lew.io/headers.php Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857 http://news.ycombinator.org/item?id=3508857 Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 ------------------------- COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk: To whom it may concern, Please find attached my complaint against O2 under the Data Protection Act. When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. Regards,
    - 15y ago
deleted 15y ago
[deleted]
Dexec 15y ago
Just tested on o2 Ireland (iPhone 4S), no header inserted.
vibrazy 15y ago
This might be useful http://mobiforge.com/developing/blog/useful-x-headers http://mobiforge.com/developing/blog/useful-x-headers
burnsie_la 15y ago
Good to see the power of social networking used for good https://twitter.com/#!/search/%40o2 https://twitter.com/#!/search/%40o2
ploureiro 15y ago
I don't find my number. Galaxy Nexus with a contract on O2 (uk) using HDSPA connection. 1.2.3.50/ups/ shows just "This is a personalization server index page created by Bytemobile" but the rest of the page is blank. Nothing to setup...
- justincormack 15y ago
  I do on mine. What apn have you got set? Mine is mobile.o2.co.uk username o2web. Maybe some apns are different?
yankcrime 15y ago
O2 / iPhone here. My number doesn't appear in the HTTP headers sent.
urbanjunkie 15y ago
Tested an iPhone 4S on Three (UK)'s mobile network - no phone number passed in the HTTP headers.
atomicdog 15y ago
My number didn't show up in the header but I think my data might be going through Blackberry, not o2.
jarofgreen 15y ago
Unrelated story from yesterday but slightly funny in it's timing: "Head of PR for O2 Nicola Green has been promoted to director of comms and reputation for O2's parent company Telefónica UK." http://www.prweek.com/news/1113672/Head-PR-O2-Nicola-Green-becomes-TelefOnica-UKs-director-comms/?DCMP=ILC-SEARCH http://www.prweek.com/news/1113672/Head-PR-O2-Nicola-Green-b... Wonder if this means they have no head of PR in place at the moment? Ouch.
peterclary 15y ago
If an image is loaded from a third-party site then presumably that request's header also includes the phone number. Can anyone confirm? That would mean that it's not just the website you're visiting that's getting your phone number, but advertisers too. Here comes the SMS spam...
- MattBearman 15y ago
  Since using O2 I've been getting more SMS spam than ever. I often wondered how they we're getting my number (I'm pretty careful). Maybe this is how...
jarofgreen 15y ago
I just checked again and it's not there any more. Anyone else seen the same pattern of seeing it in the past but not now? Hopefully that means fixes are being rolled out.
richardburton 15y ago
As bad as this may seem, SMS spoofing is way, way worse. http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.html http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.... Nothing has been done about it.
- samarudge 15y ago
  When using Skype messaging to a mobile number, you can enter your real mobile number as the 'from' address (In Skype settings). To do this Skype first sends you a confirmation message to the number you want to send from. I'm going to assume the confirmation message is Skype being curious, and that the same technology could be used without confirmation. Or is this an agreement with the mobile operators?
  - richardburton 15y ago
    That is right: http://news.ycombinator.com/item?id=3509228 http://news.ycombinator.com/item?id=3509228
- michh 15y ago
  I disagree. SMS spoofing is a serious problem but not such a gigantic privacy issue as sending my phone number to every website I visit. If it were merely some string that uniquely identifies me across different domains no matter how many times I reset my browse, it'd already be a privacy disaster. But making it my actual phone number? That's... just.. horrible.
- corin_ 15y ago
  That article is actually hilarious in how bad it is. Lines like this one: "The message was so convincing that the iPhone Anita was using believed it was genuine and listed it directly underneath the real message from that bank." Show a complete misunderstanding of how SMS works. SMS is like email in that who it comes from is simply a type of header, which when sending from a mobile phone isn't editable - when a message arrives your phone can't verify where it actually came from. In particular given banks don't send from an official number, they send from a text name.
doismellburning 15y ago
So apparently this has been going on for some time - see this paper from October 2010: http://www.mulliner.org/collin/academic/publications/mobile_web_privacy_icin10_mulliner.pdf http://www.mulliner.org/collin/academic/publications/mobile_...
ffffruit 15y ago
T-Mobile UK, no phone number in HTTP headers.
sambenson 15y ago
Someone hit the damage control button @O2: https://twitter.com/#!/O2 https://twitter.com/#!/O2
webmonkeyuk 15y ago
Tested using a HTC HD2 (Windoze Mobile) device in Opera and IE. No IP or location information sent in the headers.
jiggy2011 15y ago
Wow, just tried this and my number is right there in plain text within the HTTP header. I would never have signed the contract if I was aware that this would be happening. Does anybody know if this is a new development or been happening forever? Hopefully they fix this pronto, if not I'm not quite sure what to do since I'm really not comfortable using the service if this is happening and it's something I'm already signed up to pay for monthly for the next year at least!
- Torn 15y ago
  > I'm not quite sure what to do File a Data Protection complaint, see below: http://news.ycombinator.org/item?id=3509096 http://news.ycombinator.org/item?id=3509096
- otoburb 15y ago
  It's quite unlikely that this has been going on forever. More likely that this was a gaffe or misconfiguration during some sort of operational maintenance.
bjnortier_hn 15y ago
They have a twitter bot that responds to everyone who tweets about the issue - "we are investigating these reports and will provide more information as soon as we can.' Their twitter account is a disaster zone: https://twitter.com/#!/o2 https://twitter.com/#!/o2
mike-cardwell 15y ago
Mobile networks seem to do all sorts of horrendous shit to peoples Internet connections. I found out this morning that T-Mobile UK's transparent web proxy breaks web sockets. They also break some websites by minifying javascript badly. This is exactly why my phone has a VPN to my Linode server and routes out all Internet traffic over it. Mobile phone companies don't provide a clean Internet connection.
- fpp 15y ago
  What they do is traffic shaping / policy management / caching to reduce the amount of traffic delivered to the device via the mobile network. The issues here are part of the overall network neutrality theme besides privacy & user experience issues. Key technologies used are DPI (deep packet inspection) and PCRF (policy & charging rule function) within their IMS and even on the edge of their networks (mostly caching plus location capture etc). There are whole application ecosystems around these providing specialized solutions depending on the infrastructure (provider) used by the TelCom. Leaders of the pack providing such technology are Sandvine, Ericsson, NSN, Cisco, Procera, Allot & Arbor Networks. CDN providers like Akamai or Level3 are tmk also active here. Beyond the above there are pure HW players that e.g. provide TCP/ IP processing equipment which allows real-time inspections of 10/100Gbps streams together with development stacks - typical development providers include Continuous Computing (they have some nice posters to familiarize you with normal TelCom infrastructure) and smaller ones like Cavium Networks. Besides all of the above commercial tools there is the so-called Lawful-Inspection where who-god-knows is peeking into the telcom traffic with special installations (now also in almost all western countries) so that even the Telcos don't know where the data is going to. To get an overview what is happening in that industry segment have a look at http://broabandtrafficmanagement.blogspot.com/ http://broabandtrafficmanagement.blogspot.com/ - be aware that the TelComs are using a special lingo and acronym soup!
declan_traynor 15y ago
Confirmed on iPhone. Have received generic O2 response after mentioning this thread on twitter...
jgrahamc 15y ago
It's not just O2 in the UK. This happens all over the place. See this talk done in 2010: http://mulliner.org/security/httpheaderprivacy.php http://mulliner.org/security/httpheaderprivacy.php It mentions: Orange (UK), Rogers (Canada), H3G (Italy), Vodafone/BILDmobil (Germany), Pelephone (Israel), and on and on...
- swombat 15y ago
  Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.
  - jgrahamc 15y ago
    Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?
    - Tyrannosaurs 15y ago
      The headers I can see (from my iPhone on three) are very minimal and don't include anything that look like they could be a hashed phone number.
    - swombat 15y ago
      None of the ones listed on the lew.io website seemed to include a phone number hash, but I only glanced at it quickly.
    - adhipg 15y ago
      Three's headers contain my phone make and model as a wap profile header - nothing personal apart from that.
      - perspective 15y ago
        Just tested this on SGSII and can confirm the same.
edlea 15y ago
I've built a simple Twilio script that shows how easy it is to exploit this here: http://edlea.net/ http://edlea.net/ Vistors on an O2 phone will receive an SMS on their first visit. An MD5 hash of their MSISDN is kept in memory to prevent multiple SMS being sent.
- sfgfdhgfdshdhhd 15y ago
  FYI: this is trivially spoofable. I just sent a couple of texts to non-O2 friends by changing my browser headers. Thought about writing a Python script to run through the space of +447740[1-9][0-9]{5} numbers, but thought better of it.
mbrit 15y ago
Here's a proof-of-concept to get the user's location too: http://mbrit.com/o2numberandlocation.aspx http://mbrit.com/o2numberandlocation.aspx. (Albeit they need to give permission to access the HTML5 location APIs.)
- davej 15y ago
  What's wrong with this? This is a browser feature which requires permission from the user. Am I missing something?
DrJokepu 15y ago
Apart from the obvious data protection issues, perhaps an even more interesting and frightening aspect of the issue is that that phone number is probably there for a reason. It's entirely possible that some O2 or O2 partner sites use that header field to associate a visitor with an O2 customer. It would be interesting to see if that could be abused somehow, e.g. fake a phone number header to see if it's possible to "prank your friends" who use O2 or do something ever more malicious. (I'm not advocating anything like that, it's illegal and immoral and bad, I'm just curious if that would really work.)
- fpp 15y ago
  This is done inside the TelCom core - you have no control over that on the device. That's also why headers from normal (non-mobile) endpoints including WiFi are considered unreliable for such information. All that might soon change with the use of IP6 addresses.
J_Darnley 15y ago
Now that is how a web page should look! It uses my preferred font at the preferred size and fills the entire width of the page with text. Congratulations!
hm2k 15y ago
It doesn't seem to send it if you're going over wifi.
1880 15y ago
A similar thing happened in 2010 with Orange Spain: http://certificateerror.blogspot.com/2010/08/orange-spain-disclosing-user-phone.html?m=1 http://certificateerror.blogspot.com/2010/08/orange-spain-di... It looks like it was fixed immediately.
neave 15y ago
Here's a demo I made to better illustrate the issue: http://neave.com/temp/phone-headers/ http://neave.com/temp/phone-headers/
iamichi 15y ago
I had the header at 9.30 this morning. I just refreshed the page and my number has gone, so either they've fixed it or I'm using a different proxy that doesn't have the issue.
JonnieCache 15y ago
Here's a statement from the Information Commissioner's Office: "When people visit a website via their mobile phone they would not expect their number to be made available to that website. "We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed." http://news.sky.com/home/technology/article/16156276 http://news.sky.com/home/technology/article/16156276 O2 are in trouble.
- justincormack 15y ago
  Odd they said something different to the Guardian http://www.guardian.co.uk/technology/2012/jan/25/02-mobile-phone-users-privacy-breach-website http://www.guardian.co.uk/technology/2012/jan/25/02-mobile-p... "The Information Commissioner's Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as "personally identifying information" (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time." I just google my phone number and found all my other details though, better fix that.
  - jiggy2011 15y ago
    Even if it doesn't technically violate the DPA there must be something this violates? I wonder if this was in the T&C when I signed the contract?
- Torn 15y ago
  Update at 14:40: Looks like they've removed the header from being inserted, no doubt after pressure from the ICO and the media cover. The system works!
netmute 15y ago
Just tested this on O2 Germany. They don't do it.
dazbradbury 15y ago
Glad this is being brought to attention finally (as it seems it's been discovered before), but this is just yet another case of a UK mobile operator losing my trust. O2: Send number in plain-text to every website visited. [1] Orange: Increase fixed contract price by RPI through use of dodgy contract clause. [2] Three: Place a non-payment flag on my credit report for no apparent reason. When I realise years later, they remove it and don't even apologise. I'm running out of operators which haven't negatively impacted me, and to be honest, I think some of the blame must land with OFCOM. [1] - http://news.sky.com/home/technology/article/16156276 http://news.sky.com/home/technology/article/16156276 [2] - http://en.wikipedia.org/wiki/Orange_%28UK%29#Controversy http://en.wikipedia.org/wiki/Orange_%28UK%29#Controversy
- alexmuller 15y ago
  Let's not forget Vodafone, who released an update for Android at about the same time 2.2 was arriving. Only it wasn't 2.2, it was a whole load of Vodafone-branded cruft for 2.1 that couldn't be removed. http://www.itpro.co.uk/625774/vodafone-no-froyo-android-update-angers-customers http://www.itpro.co.uk/625774/vodafone-no-froyo-android-upda...
danbee 15y ago
The header is no longer being inserted for me. I think O2 must have fixed the problem.
- mseebach 15y ago
  It's also gone for me.
dvd03 15y ago
To stop your o2 iPhone exposing your number through http headers, go to Settings > General -> Network -> Cellular Data Network, and change both APN to mobile.o2.co.uk and username to o2web (leaving password as is).
michaelfeathers 15y ago
The link insertion reminds me of an ISP in another country that was rewriting HTML before sending it. If we want to get very technical, if this happened in the US, couldn't an ISP be dinged for creating a "derived work" of a copyrighted page without permission?
- ignoreme 15y ago
  I think that is opening up a can of worms I would rather not see opened. Technically caching could be seen as copyright infringement. Quite a few ISP's run transparent proxies for caching and technically every time you visit a website you are creating a copy of it on your local drive. If I disable javascript or run other scripts (like via grease-monkey) I am also technically creating "derived work".
  - DanBC 15y ago
    English law has exemptions for caching.
ukgent2 15y ago
UK South Iphone 4s Headers in plain sight Called o2 support, stating I believe this is a breach of contract and wish to cancel my contract. The guy on the phone was not really sure how to handle this. Does anyone had any luck forcing o2 to cancel their contract based on this information? I kinda like Orange, no headers, and orange wednesdays
VMG 15y ago
slightly OT: there was a page that displays your full http request but I forgot the name. It was on the HN front page not too long ago. (I'm curious to see what my phone/provider sends)
jiggy2011 15y ago
This seems to be fixed for me now, anybody else still getting issues?
gpapilion 15y ago
Sadly I can say this is true for at least two US carriers. One had obfuscated the number by padding it in a unique identifier header, and the other would send it along in some cases (i can't remember if it was on a partner by partner basis). Also, almost every HTTP request on a mobile phone still passes through a HTTP Proxy. Generally, so avoiding opera, won't do any good. That is what the APN does. What typically will get you off the carriers proxies is to use wi-fi, despite what the author says. They tend to get out of the loop if you're using someone else's network.
urbanjunkie 15y ago
O2 have responded http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-... Selected highlights: Q: How long has this been happening? A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners. Q: Has it been fixed? A: Yes. It was fixed as of 1400 on Wednesday 25th January 2012. [edited to add] I find this a bit weaselly: Q: Which websites do you normally share my mobile number with? A: Only where absolutely required by trusted partners who work with us on age verification, premium content billing, such as for downloads, and O2's own services, have access to these mobile numbers.
- eps 15y ago
  When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.
  - urbanjunkie 15y ago
    It's more alarming that this is 'standard industry practice', implying all the UK mobile telcos are doing this.
Pr1sm 15y ago
Apparently now fixed: http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...
c_mac 15y ago
I must say I am encouraged to see that some media coverage and, what seems to be an influx of emails to 02 by worried customers has managed to prompt a response from the company. Sadly, the concerns of who these nameless "trusted partners" are will no doubt have some people concerned.
mpunaskar 15y ago
As per statement from O2 - They share data with their "trusted partners" for age verification purpose. Does that mean they share my birth date with their "trusted" partners?
- kgutteridge 15y ago
  Due to the code of practice in the UK the mobile network operators do at share "over 18 yes/no" with some sites You can read more http://www.aimelink.org/docs/UK_MNO_Age_Verification_Procedures.pdf http://www.aimelink.org/docs/UK_MNO_Age_Verification_Procedu...
deleted 15y ago
[deleted]
- kgutteridge 15y ago
  If you have ever used any payforit service to pay for goods, the intermediary you went through will at the very least have your MSISDN hashed and most likely in the clear (depends on your mobile network operator) List of the Payforit intermediaries http://www.payforit.org/ http://www.payforit.org/

362 points by wgx 15y ago

wgx 15y ago

Tried it on my iPhone using o2's network and my number was indeed inserted into the headers.

christoph 15y ago
Tested and confirmed on my Galaxy S2 as well.
robgough 15y ago
Seconded. iPhone 4 and O2-UK
ambuj 15y ago
Yep, same here. iPhone/O2 (UK) - my number's there!
chitabox 15y ago
Confirmed with Samsung S2, Additionally, x-wap-profile provides phone model (GT-I9100) Additionally, confirmed on HTC HD2 on Tesco Mobile - Custom ROM (ICS 4.03), thinks its a Nexus HD2 - Stock browser display phone number, Dolphin Mini also displays number!

jarofgreen 15y ago

Confirmed on a Google Nexus. In his webpage he also says "They downgrade all images and insert a javascript link into the HTML of each page." The image downgrading has been know about for ages, the JS I have not heard about before. I have asked for more info on Twitter but will investigate myself if I can find time today.

jarofgreen 15y ago
https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 says "@lewispeckover Hi Lewis. The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" As Lewis replies, "@O2 User-agent header ID's the device. Passing mobile number to third party sites is not ok! Seems like a data protection act breach to me?" Being charitable, that could be clueless support rather than official policy response but hopefully the storm coming their way will get an official response soon.
- alexchamberlain 15y ago
  From the oracle (Wikipedia), Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation. It is in fact illegal for the website to obtain this information... Lew, you're going down... Only joking.
- cubicle67 15y ago
  The mobile number in the HTML is linked to how the site determines that your browsing from a mobile device #O2Guru" ...and for people using iPod Touches or similar?
- mattmanser 15y ago
  Their twitter has now exploded with a flurry of tweets like '@user we are investigating these reports and will provide more information as soon as we can.'
jarofgreen 15y ago
While waiting for an upload, I had a look. This tag is inserted in the head: <script src="http://1.2.3.4/bmi-int-js/bmi.js http://1.2.3.4/bmi-int-js/bmi.js language="javascript"> This is inserted at the end: <script language="javascript"> </script> The external JS is here: http://pastebin.com/rv3k4meX http://pastebin.com/rv3k4meX Analysis please. At an initial glance it seems to just be about the image compression.
- iamichi 15y ago
  Here is a un-minified version: http://pastebin.com/t0FhS2Z7 http://pastebin.com/t0FhS2Z7 My quick glace at it agrees with you, it looks like it replaces the URLs of the images, presumably to load compressed versions.
samarudge 15y ago
The javascript changes all image URL's to lower quality versions from O2's servers, it also provides a helpful little function which lets you use a hotkey (Alt+D I believe) to download all the images in full quality. The javascript comes from the domain //1.2.3.4/bmi-int-js/bmi.js (Not a real domain, only works behind O2's proxy)
larsgirndt 15y ago
We got aware of that problem in October 2011 during relaunch of our website and we faced it also with t-mobile in germany. After digging around helpful sources have been http://stackoverflow.com/questions/4113268/how-to-stop-javascript-injection-from-vodafone-proxy http://stackoverflow.com/questions/4113268/how-to-stop-javas... Besides injecting the bmi.js they also do their own javascript compression. At that time we had our own minified version of jquery, which got corrupted by their compression. They assume that /* always denotes a starting comment. This is wrong for the jquery lib, which contains some strings containing /* to denote mime type patterns. Anyways, we solved those compression issues with cache-control:no-transform. Also gzip compressing the HTTP responses worked.
- tomgallard 15y ago
  Yes- we were stung by this one. Our boss saw errors loading the site on his iPad, but whenever we brought him into the office to try and replicate it, the problems disappeared. We finally figured out it only happened when he was out the office, so on 3G not WiFi, and then managed to find the stackoverflow post you mention.

wgx 15y ago

Additional write-up on another site here: http://www.thinkbroadband.com/news/4990-o2-shares-your-mobile-phone-number-with-every-website-you-visit.html http://www.thinkbroadband.com/news/4990-o2-shares-your-mobil...

otoburb 15y ago
The write-up is more charitable when it comes to the possible reason why this may be happening. The specific quote: " Our suspicion is that the feature is used by internal O2 websites to identify the user trying to make changes to the account, but that one or more of O2's proxy servers have been misconfigured." x-up-calling-line-id (and similar headers from other gateway vendors) are typically not meant to be sent in the clear beyond internal sites. Perhaps a certain set/class of URL ACLs were (mis)configured during a maintenance window that caused this to happen. Similar to how websites leave cookies, carriers have always had the ability to send certain identifying information to external sites. Usually, such identifying information is munged in some way that doesn't make it possible to determine the mobile number of the subscriber. The funny thing is that people are often surprisingly willing to provide their phone number on more and more sites, which then makes it trivial for such services to link the anonymized identifier with the actual mobile number. Regarding the customer support folks, it's highly unlikely that they know anything about HTTP headers, since they are typically level 1 support. This type of query/complaint would be filtered up to level 2 or 3 usually quite quickly once enough customers start calling in, or if somebody happens to be reading certain media outlets (e.g. HN).
- jarofgreen 15y ago
  Some tweets claim it isn't happening for them any more so maybe this was a mistake being fixed? However, amusing it's a honest mistake being fixed, this still SHOULD NOT HAPPEN in the first place. Companies dealing with personal data need to be more careful when the ramifications of "honest mistakes" can be so serious. It's right that people are making a fuss about this and pressuring O2 to fix this. > The funny thing is that people are often surprisingly willing to provide their phone number on more and more sites, which then makes it trivial for such services to link the anonymized identifier with the actual mobile number. Sure, but that still doesn't excuse this.

MrKurtHaeusler 15y ago

Just tested on o2 Germany, and no such header was inserted. It would probably be illegal here anyway.

wgx 15y ago
I have a hunch that it's probably a breach of data protection law in the UK too.
jarofgreen 15y ago
I would sodding hope it's illegal in the UK to! Altho as IANAL I can't think of which law exactly would cover it. Anyone know? I'm envious, you Germans have great privacy laws.
- alexchamberlain 15y ago
  Data protection act - Data must not be disclosed to other parties without the consent of the individual whom it is about, unless there is legislation or other overriding legitimate reason to share the information (for example, the prevention or detection of crime). It is an offence for Other Parties to obtain this personal data without authorisation.
  - jarofgreen 15y ago
    I suspect any legal case would hinge on whether your mobile phone number counted as personal data or not. Again, IANAL, but the Data Protection Act is not specific on what counts as personal data and instead leaves it up to case law and I think the data registrar(?) to clarify.
    - alexchamberlain 15y ago
      Information Commissioner, or at least his office. However, I think it is generally percieved as personal.
      - 15y ago

alexchamberlain 15y ago

Not inserted on Dell Streak.

edandersen 15y ago

You should be able to bypass the proxy that inserts the HTTP headers with the following APN on O2: apn: mobile.o2.co.uk username: bypass password: password Worked in 2008 when I tried it (http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image-compression/ http://www.edandersen.com/2008/07/13/iphone-o2-fix-the-image...) as they used to screw with images on the App Store. I don't have access to O2 anymore, can someone try this and see if it still works? Edit: It still includes your phone number, thanks msmithstubbs.

msmithstubbs 15y ago
Just tried it. The phone number header is still being included.
- iamichi 15y ago
  Same for me.
dspillett 15y ago
The only way to reliably work around operators messing around with what you access (inserting their own client side code and such) and potentially inserting stuff into the headers like this too is to use a VPN for all Internet traffic that isn't otherwise tamper proof (i.e. HTTPS with a properly signed cert). I use OpenVPN when I have my netbook tethered to my phone (or when I use any other "untrusted" wireless network for that matter) and route all traffic through my home fibre (I'm with an ISP that I know doesn't mess with my traffic). There are problems with that though: * installing OpenVPN on Android is a faf (I've still not got around to it on my device) [see http://vpnblog.info/android-openvpn-strongvpn.html http://vpnblog.info/android-openvpn-strongvpn.html and similar] - most users are not going to want to mess around like that * there is no garantee that it will even work (or work efficiently enough) on all networks, or they could classify all encrypted traffic in the same lump as encrypted P2P connections and shape/block accordingly * any VPN adds overheads (at least a set of headers per packet, and keep-alive packets when the connection is otherwise inactive), so if you don't have a cheap data plan that could be a consideration
EwanToo 15y ago

kgutteridge 15y ago

A lot of mobile network operators wash this information about or have it hashed into some other form (which means it can still be used as a unique identifier) Some popular headers to check X-UP-CALLING-LINE-I X_NOKIA_MSISDN X_H3G_MSISDN MSISDN X_MSISDN X_NETWORK_INFO X-WAP-MSISDN X-UP-SUBNO

perspective 15y ago
I'm on 3 w/Samsung Galaxy SII & Cyanogenmod and it's not sending any phone-specific headers.
- biafra 15y ago
  It is not the phone that sends these headers. It is the internet gateway or proxy at the carrier that inserts it.

rix0r 15y ago

I'm using Vodafone and I'm seeing an "X-VF-ACR" header in my headers that contains a very long base64-encoded string. Anyone any idea what it is? (Edit: Looks like a big bunch of binary)

birger 15y ago

Isn't this information used as an extra security layer when using your mobile phone for payments or bank transactions? Here in The Netherlands when I want to use my mobile phone to log in to my bank account and do transactions, I first need to confirm my phone number and a special code. I can imagine that then they need the phone number in the header to verify it is my phone. And how is this information different then an IP adress that they also have with each request?

wgx 15y ago
>And how is this information different then an IP adress that they also have with each request? Unscrupulous marketers can't do much with your IP address. They can do a lot more evil with your mobile number: SMS spam, cold calls, re-sell your data, etc, etc...
alexchamberlain 15y ago
Headers are too easily spoofed to carry security information without a signature.
- mooism2 15y ago
  It's like security through obscurity: on its own it's inadequate, but as an extra layer it can be helpful.
  - alexchamberlain 15y ago
    How is this helpful? We have proved it's inconsistent... Do you check IP addresses for security too?
    - mooism2 15y ago
      I can imagine a bank fraud detection system being more suspicious of unusually large transactions if they originate from an unusual phone number or ip address, yes.
15y ago

rheeseyb 15y ago

This doesn't appear to be happening with the Samsung Galaxy Nexus *edit scratch that it is happening now. Both attempts were on 3G only. Seems it doesn't always happen.

mseebach 15y ago

This does not happen on giffgaff, a MVNO owned by and operating on O2s network.

philjones88 15y ago
Actually it does for me. Perhaps its the handset that determines this issue? I have a O2 PAYG HTC HD7 WP7.5 device that I use with GiffGaff and the page clearly lists the header and my phone number.
- mseebach 15y ago
  Perhaps I should turn off wifi. Facepalm. Yes, it happens on Giffgaff too.
prof_hobart 15y ago
It does for me.

Leynos 15y ago

Using Opera Mini seems to disable this "feature". Of course, doing so means all of my web traffic goes via Oslo. And of course, any apps using an http API are presumably affected too. I'm rather disappointed to hear about this.

ntmartin 15y ago
+1 the header is gone via Opera Mini and their proxy. Leaving O2 after this, definitely not cool.
mhw 15y ago
> Of course, doing so means all of my web traffic goes via Oslo. Which probably means that your phone number is going to Oslo instead. At least it's not being proxied onwards from there.
- pmjordan 15y ago
  Opera Mini uses its own protocol to talk to the proxy. HTTP is quite chatty, so there's a lot of mileage in reducing the headers by simply omitting a lot of unneeded information and compressing the rest.
- pmjordan 15y ago
  Opera Mini uses its own protocol to talk to the proxy. HTTP is quite chatty, so there's a lot of mileage in reducing the headers by simply omitting a lot of unneeded information and compressing the rest.

mattyohe 15y ago

Well, their twitter guy just woke up: https://twitter.com/#!/o2 https://twitter.com/#!/o2

jarofgreen 15y ago
9.21am in the UK, the office just opened. This will be a fun day for the poor workers on level-1 support :-)

shocks 15y ago

Orange UK here - nothing in my headers. Clean as a whistle.

JCB_K 15y ago

I'm on Giffgaff, which is a daughter company of O2, same problem. Started a support thread on the website, let's see what they say.

chalgo 15y ago
Also commented on this on the GG community. Hopefully Giffgaff can apply some pressure on O2 from a more official direction.
gerrit 15y ago
On giffgaff too, any chance you could link to that thread?
- SandB0x 15y ago
  http://community.giffgaff.com/t5/Help-Ask-the-community-got-stuck/o2-sending-mobile-number-in-http-headers-of-mobile-internet-page/td-p/2852253 http://community.giffgaff.com/t5/Help-Ask-the-community-got-... and http://community.giffgaff.com/t5/Contribute-Innovation-Promotion/Phone-number-being-sent-in-header-to-websites/m-p/2851947 http://community.giffgaff.com/t5/Contribute-Innovation-Promo... and http://community.giffgaff.com/t5/Contribute-Innovation-Promotion/Massive-Giffgaff-Privacy-Breach/td-p/2852711 http://community.giffgaff.com/t5/Contribute-Innovation-Promo...

bravolima 15y ago

I'm not seeing the header - HTC Desire.

samwilliams 15y ago
I am not seeing it on the HTC Sensation either. This article seems to agree with us too: http://www.slashgear.com/o2-sharing-phone-numbers-for-mobile-surfers-but-not-everyone-25210620/ http://www.slashgear.com/o2-sharing-phone-numbers-for-mobile... I wonder what the (de)selection criteria is then?

cornet 15y ago

Firstly I don't work for O2 but I work in the mobile industry. O2 should only be passing your number to trusted sites (and to get on that list is pretty hard). We have reported it to them via various internal contacts we have. Hopefully they will fix this soon!

jarofgreen 15y ago
Can you tell us more about the kind of people who count as a trusted site, how you get on this list, and if this is made public/opt-outable anywhere? (Thanks for reporting!)
- otoburb 15y ago
  The criteria varies per carrier. In most cases, a trusted site is one run or owned by the carrier (e.g. carrier portal site). Getting on this list usually (from what I understand) requires a whole lot of paperwork and approvals. In terms of being made public or opt-outable, I'm not aware of any carriers that do this. I guess it depends on which 3rd party sites have negotiated agreements and obtained appropriate opt-ins from you and/or the carrier in various Terms of Agreements. For example, banking sites probably get a free pass when it comes to your mobile number because you may have entered it in to the banking application for verification purposes (just an example).
  - jarofgreen 15y ago
    It's the 3rd party sites I'm more interested in - I can see that carriers may want it as a security function for internal websites and as they already have your number and all your details anyway, it's not really an issue then. For instance with your banking example, yes, I may have given my number and probably have if I'm a customer. But what if I'm just browsing a banks website thinking about opening an account? Should they have my number then? (but of course banks are unlikely to abuse this for spam or anything.) But can you see how people would think this is a grey area with potential for abuse? So basically, we just have to trust our carriers not to sell us out with no way of checking up on them?

MattBearman 15y ago

I got the header inserted on my iPhone 3Gs, not happy about this.

jsvaughan 15y ago

I'm on o2 business / htc desire / cyanogen and my phone number is in the header. wtf.

wr1472 15y ago

My colleague just tried it with Tesco Mobile which runs on O2 on his Galaxy S2 and his number was in the header.

JosephRedfern 15y ago
I concur - this is also happening on an iPhone 4 on Tesco.

alexchamberlain 15y ago

I think we should write to the ICO about this.

Torn 15y ago

I'm filing a Data Protection complaint now. I'd encourage other UK HNers to do the same: http://www.ico.gov.uk/complaints/data_protection.aspx http://www.ico.gov.uk/complaints/data_protection.aspx

alexchamberlain 15y ago
Can you post what you send and then we can all forward it?
- Torn 15y ago
  Adjust as needed, here's roughly what I put: ------------------------- SECTION 4: Name: Telefonica O2 UK Address: 260 Bath Road Postcode: SL1 4DX Phone: 0800 089 0202 email: peter.erksine@o2.com website: http://www.o2.co.uk http://www.o2.co.uk SECTION 6: When users of their network visit a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. O2 does this by modifying the HTTP request and inserting the number in the 'x-up-calling-line-id' HTTP header. Alarmingly, it does this to all unencrypted site visits (i.e. 'http' not 'https'), and these end-sites can trivially harvest the mobile numbers of visitors and link these to content visited. This can be verified by visiting http://lew.io/headers.php http://lew.io/headers.php on an O2 mobile device. The site serves as a tool to show the visitor the HTTP headers received by the server when the user requests that particular page. SECTION 10: Online utility that will show you the headers sent in your page request: http://lew.io/headers.php http://lew.io/headers.php Discussion on technical forum 'hacker news': http://news.ycombinator.org/item?id=3508857 http://news.ycombinator.org/item?id=3508857 Official O2 Twitter responding to (and misunderstanding/misrepresenting) the problem: https://twitter.com/#!/O2/status/161872584634408960 https://twitter.com/#!/O2/status/161872584634408960 ------------------------- COVERING LETTER WITH EMAIL TO casework@ico.gsi.gov.uk: To whom it may concern, Please find attached my complaint against O2 under the Data Protection Act. When users of their network visits a site O2 inject the mobile phone number of the user into the request. This is then available to the website host, which raises obvious data protection issues. Regards,
  - 15y ago

deleted 15y ago

[deleted]

Dexec 15y ago

Just tested on o2 Ireland (iPhone 4S), no header inserted.

vibrazy 15y ago

This might be useful http://mobiforge.com/developing/blog/useful-x-headers http://mobiforge.com/developing/blog/useful-x-headers

burnsie_la 15y ago

Good to see the power of social networking used for good https://twitter.com/#!/search/%40o2 https://twitter.com/#!/search/%40o2

ploureiro 15y ago

I don't find my number. Galaxy Nexus with a contract on O2 (uk) using HDSPA connection. 1.2.3.50/ups/ shows just "This is a personalization server index page created by Bytemobile" but the rest of the page is blank. Nothing to setup...

justincormack 15y ago
I do on mine. What apn have you got set? Mine is mobile.o2.co.uk username o2web. Maybe some apns are different?

yankcrime 15y ago

O2 / iPhone here. My number doesn't appear in the HTTP headers sent.

urbanjunkie 15y ago

Tested an iPhone 4S on Three (UK)'s mobile network - no phone number passed in the HTTP headers.

atomicdog 15y ago

My number didn't show up in the header but I think my data might be going through Blackberry, not o2.

jarofgreen 15y ago

Unrelated story from yesterday but slightly funny in it's timing: "Head of PR for O2 Nicola Green has been promoted to director of comms and reputation for O2's parent company Telefónica UK." http://www.prweek.com/news/1113672/Head-PR-O2-Nicola-Green-becomes-TelefOnica-UKs-director-comms/?DCMP=ILC-SEARCH http://www.prweek.com/news/1113672/Head-PR-O2-Nicola-Green-b... Wonder if this means they have no head of PR in place at the moment? Ouch.

peterclary 15y ago

If an image is loaded from a third-party site then presumably that request's header also includes the phone number. Can anyone confirm? That would mean that it's not just the website you're visiting that's getting your phone number, but advertisers too. Here comes the SMS spam...

MattBearman 15y ago
Since using O2 I've been getting more SMS spam than ever. I often wondered how they we're getting my number (I'm pretty careful). Maybe this is how...

jarofgreen 15y ago

I just checked again and it's not there any more. Anyone else seen the same pattern of seeing it in the past but not now? Hopefully that means fixes are being rolled out.

richardburton 15y ago

As bad as this may seem, SMS spoofing is way, way worse. http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.html http://www.bbc.co.uk/blogs/watchdog/2010/04/mobile_spoofing.... Nothing has been done about it.

samarudge 15y ago
When using Skype messaging to a mobile number, you can enter your real mobile number as the 'from' address (In Skype settings). To do this Skype first sends you a confirmation message to the number you want to send from. I'm going to assume the confirmation message is Skype being curious, and that the same technology could be used without confirmation. Or is this an agreement with the mobile operators?
- richardburton 15y ago
  That is right: http://news.ycombinator.com/item?id=3509228 http://news.ycombinator.com/item?id=3509228
michh 15y ago
I disagree. SMS spoofing is a serious problem but not such a gigantic privacy issue as sending my phone number to every website I visit. If it were merely some string that uniquely identifies me across different domains no matter how many times I reset my browse, it'd already be a privacy disaster. But making it my actual phone number? That's... just.. horrible.
corin_ 15y ago
That article is actually hilarious in how bad it is. Lines like this one: "The message was so convincing that the iPhone Anita was using believed it was genuine and listed it directly underneath the real message from that bank." Show a complete misunderstanding of how SMS works. SMS is like email in that who it comes from is simply a type of header, which when sending from a mobile phone isn't editable - when a message arrives your phone can't verify where it actually came from. In particular given banks don't send from an official number, they send from a text name.

doismellburning 15y ago

So apparently this has been going on for some time - see this paper from October 2010: http://www.mulliner.org/collin/academic/publications/mobile_web_privacy_icin10_mulliner.pdf http://www.mulliner.org/collin/academic/publications/mobile_...

ffffruit 15y ago

T-Mobile UK, no phone number in HTTP headers.

sambenson 15y ago

Someone hit the damage control button @O2: https://twitter.com/#!/O2 https://twitter.com/#!/O2

webmonkeyuk 15y ago

Tested using a HTC HD2 (Windoze Mobile) device in Opera and IE. No IP or location information sent in the headers.

jiggy2011 15y ago

Wow, just tried this and my number is right there in plain text within the HTTP header. I would never have signed the contract if I was aware that this would be happening. Does anybody know if this is a new development or been happening forever? Hopefully they fix this pronto, if not I'm not quite sure what to do since I'm really not comfortable using the service if this is happening and it's something I'm already signed up to pay for monthly for the next year at least!

Torn 15y ago
> I'm not quite sure what to do File a Data Protection complaint, see below: http://news.ycombinator.org/item?id=3509096 http://news.ycombinator.org/item?id=3509096
otoburb 15y ago
It's quite unlikely that this has been going on forever. More likely that this was a gaffe or misconfiguration during some sort of operational maintenance.

bjnortier_hn 15y ago

They have a twitter bot that responds to everyone who tweets about the issue - "we are investigating these reports and will provide more information as soon as we can.' Their twitter account is a disaster zone: https://twitter.com/#!/o2 https://twitter.com/#!/o2

mike-cardwell 15y ago

Mobile networks seem to do all sorts of horrendous shit to peoples Internet connections. I found out this morning that T-Mobile UK's transparent web proxy breaks web sockets. They also break some websites by minifying javascript badly. This is exactly why my phone has a VPN to my Linode server and routes out all Internet traffic over it. Mobile phone companies don't provide a clean Internet connection.

fpp 15y ago
What they do is traffic shaping / policy management / caching to reduce the amount of traffic delivered to the device via the mobile network. The issues here are part of the overall network neutrality theme besides privacy & user experience issues. Key technologies used are DPI (deep packet inspection) and PCRF (policy & charging rule function) within their IMS and even on the edge of their networks (mostly caching plus location capture etc). There are whole application ecosystems around these providing specialized solutions depending on the infrastructure (provider) used by the TelCom. Leaders of the pack providing such technology are Sandvine, Ericsson, NSN, Cisco, Procera, Allot & Arbor Networks. CDN providers like Akamai or Level3 are tmk also active here. Beyond the above there are pure HW players that e.g. provide TCP/ IP processing equipment which allows real-time inspections of 10/100Gbps streams together with development stacks - typical development providers include Continuous Computing (they have some nice posters to familiarize you with normal TelCom infrastructure) and smaller ones like Cavium Networks. Besides all of the above commercial tools there is the so-called Lawful-Inspection where who-god-knows is peeking into the telcom traffic with special installations (now also in almost all western countries) so that even the Telcos don't know where the data is going to. To get an overview what is happening in that industry segment have a look at http://broabandtrafficmanagement.blogspot.com/ http://broabandtrafficmanagement.blogspot.com/ - be aware that the TelComs are using a special lingo and acronym soup!

declan_traynor 15y ago

Confirmed on iPhone. Have received generic O2 response after mentioning this thread on twitter...

jgrahamc 15y ago

It's not just O2 in the UK. This happens all over the place. See this talk done in 2010: http://mulliner.org/security/httpheaderprivacy.php http://mulliner.org/security/httpheaderprivacy.php It mentions: Orange (UK), Rogers (Canada), H3G (Italy), Vodafone/BILDmobil (Germany), Pelephone (Israel), and on and on...

swombat 15y ago
Three (UK) don't do it, and it's worth also noting that @O2 has been in overdrive about trying to contain the twitter outrage. Good to see a large corp paying attention for once.
- jgrahamc 15y ago
  Have you examined all the Three headers to ensure that they are not sending a hashed version of the phone number?
  - Tyrannosaurs 15y ago
    The headers I can see (from my iPhone on three) are very minimal and don't include anything that look like they could be a hashed phone number.
  - swombat 15y ago
    None of the ones listed on the lew.io website seemed to include a phone number hash, but I only glanced at it quickly.
  - adhipg 15y ago
    Three's headers contain my phone make and model as a wap profile header - nothing personal apart from that.
    - perspective 15y ago
      Just tested this on SGSII and can confirm the same.

edlea 15y ago

I've built a simple Twilio script that shows how easy it is to exploit this here: http://edlea.net/ http://edlea.net/ Vistors on an O2 phone will receive an SMS on their first visit. An MD5 hash of their MSISDN is kept in memory to prevent multiple SMS being sent.

sfgfdhgfdshdhhd 15y ago
FYI: this is trivially spoofable. I just sent a couple of texts to non-O2 friends by changing my browser headers. Thought about writing a Python script to run through the space of +447740[1-9][0-9]{5} numbers, but thought better of it.

mbrit 15y ago

Here's a proof-of-concept to get the user's location too: http://mbrit.com/o2numberandlocation.aspx http://mbrit.com/o2numberandlocation.aspx. (Albeit they need to give permission to access the HTML5 location APIs.)

davej 15y ago
What's wrong with this? This is a browser feature which requires permission from the user. Am I missing something?

DrJokepu 15y ago

Apart from the obvious data protection issues, perhaps an even more interesting and frightening aspect of the issue is that that phone number is probably there for a reason. It's entirely possible that some O2 or O2 partner sites use that header field to associate a visitor with an O2 customer. It would be interesting to see if that could be abused somehow, e.g. fake a phone number header to see if it's possible to "prank your friends" who use O2 or do something ever more malicious. (I'm not advocating anything like that, it's illegal and immoral and bad, I'm just curious if that would really work.)

fpp 15y ago
This is done inside the TelCom core - you have no control over that on the device. That's also why headers from normal (non-mobile) endpoints including WiFi are considered unreliable for such information. All that might soon change with the use of IP6 addresses.

J_Darnley 15y ago

Now that is how a web page should look! It uses my preferred font at the preferred size and fills the entire width of the page with text. Congratulations!

hm2k 15y ago

It doesn't seem to send it if you're going over wifi.

1880 15y ago

A similar thing happened in 2010 with Orange Spain: http://certificateerror.blogspot.com/2010/08/orange-spain-disclosing-user-phone.html?m=1 http://certificateerror.blogspot.com/2010/08/orange-spain-di... It looks like it was fixed immediately.

neave 15y ago

Here's a demo I made to better illustrate the issue: http://neave.com/temp/phone-headers/ http://neave.com/temp/phone-headers/

iamichi 15y ago

I had the header at 9.30 this morning. I just refreshed the page and my number has gone, so either they've fixed it or I'm using a different proxy that doesn't have the issue.

JonnieCache 15y ago

Here's a statement from the Information Commissioner's Office: "When people visit a website via their mobile phone they would not expect their number to be made available to that website. "We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed." http://news.sky.com/home/technology/article/16156276 http://news.sky.com/home/technology/article/16156276 O2 are in trouble.

justincormack 15y ago
Odd they said something different to the Guardian http://www.guardian.co.uk/technology/2012/jan/25/02-mobile-phone-users-privacy-breach-website http://www.guardian.co.uk/technology/2012/jan/25/02-mobile-p... "The Information Commissioner's Office said it is considering whether to investigate further, although a spokesman said there was no immediate breach of the Data Protection Act. A mobile phone number on its own is not classed as "personally identifying information" (PII), because it does not identify an individual on its own; but the spokesman said the office would consider whether other personal data was being processed at the same time." I just google my phone number and found all my other details though, better fix that.
- jiggy2011 15y ago
  Even if it doesn't technically violate the DPA there must be something this violates? I wonder if this was in the T&C when I signed the contract?
Torn 15y ago
Update at 14:40: Looks like they've removed the header from being inserted, no doubt after pressure from the ICO and the media cover. The system works!

netmute 15y ago

Just tested this on O2 Germany. They don't do it.

dazbradbury 15y ago

Glad this is being brought to attention finally (as it seems it's been discovered before), but this is just yet another case of a UK mobile operator losing my trust. O2: Send number in plain-text to every website visited. [1] Orange: Increase fixed contract price by RPI through use of dodgy contract clause. [2] Three: Place a non-payment flag on my credit report for no apparent reason. When I realise years later, they remove it and don't even apologise. I'm running out of operators which haven't negatively impacted me, and to be honest, I think some of the blame must land with OFCOM. [1] - http://news.sky.com/home/technology/article/16156276 http://news.sky.com/home/technology/article/16156276 [2] - http://en.wikipedia.org/wiki/Orange_%28UK%29#Controversy http://en.wikipedia.org/wiki/Orange_%28UK%29#Controversy

alexmuller 15y ago
Let's not forget Vodafone, who released an update for Android at about the same time 2.2 was arriving. Only it wasn't 2.2, it was a whole load of Vodafone-branded cruft for 2.1 that couldn't be removed. http://www.itpro.co.uk/625774/vodafone-no-froyo-android-update-angers-customers http://www.itpro.co.uk/625774/vodafone-no-froyo-android-upda...

danbee 15y ago

The header is no longer being inserted for me. I think O2 must have fixed the problem.

mseebach 15y ago
It's also gone for me.

dvd03 15y ago

To stop your o2 iPhone exposing your number through http headers, go to Settings > General -> Network -> Cellular Data Network, and change both APN to mobile.o2.co.uk and username to o2web (leaving password as is).

michaelfeathers 15y ago

The link insertion reminds me of an ISP in another country that was rewriting HTML before sending it. If we want to get very technical, if this happened in the US, couldn't an ISP be dinged for creating a "derived work" of a copyrighted page without permission?

ignoreme 15y ago
I think that is opening up a can of worms I would rather not see opened. Technically caching could be seen as copyright infringement. Quite a few ISP's run transparent proxies for caching and technically every time you visit a website you are creating a copy of it on your local drive. If I disable javascript or run other scripts (like via grease-monkey) I am also technically creating "derived work".
- DanBC 15y ago
  English law has exemptions for caching.

ukgent2 15y ago

UK South Iphone 4s Headers in plain sight Called o2 support, stating I believe this is a breach of contract and wish to cancel my contract. The guy on the phone was not really sure how to handle this. Does anyone had any luck forcing o2 to cancel their contract based on this information? I kinda like Orange, no headers, and orange wednesdays

VMG 15y ago

slightly OT: there was a page that displays your full http request but I forgot the name. It was on the HN front page not too long ago. (I'm curious to see what my phone/provider sends)

jiggy2011 15y ago

This seems to be fixed for me now, anybody else still getting issues?

gpapilion 15y ago

Sadly I can say this is true for at least two US carriers. One had obfuscated the number by padding it in a unique identifier header, and the other would send it along in some cases (i can't remember if it was on a partner by partner basis). Also, almost every HTTP request on a mobile phone still passes through a HTTP Proxy. Generally, so avoiding opera, won't do any good. That is what the APN does. What typically will get you off the carriers proxies is to use wi-fi, despite what the author says. They tend to get out of the loop if you're using someone else's network.

urbanjunkie 15y ago

O2 have responded http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-... Selected highlights: Q: How long has this been happening? A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners. Q: Has it been fixed? A: Yes. It was fixed as of 1400 on Wednesday 25th January 2012. [edited to add] I find this a bit weaselly: Q: Which websites do you normally share my mobile number with? A: Only where absolutely required by trusted partners who work with us on age verification, premium content billing, such as for downloads, and O2's own services, have access to these mobile numbers.

eps 15y ago
When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice.
- urbanjunkie 15y ago
  It's more alarming that this is 'standard industry practice', implying all the UK mobile telcos are doing this.

Pr1sm 15y ago

Apparently now fixed: http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-...

c_mac 15y ago

I must say I am encouraged to see that some media coverage and, what seems to be an influx of emails to 02 by worried customers has managed to prompt a response from the company. Sadly, the concerns of who these nameless "trusted partners" are will no doubt have some people concerned.

mpunaskar 15y ago

As per statement from O2 - They share data with their "trusted partners" for age verification purpose. Does that mean they share my birth date with their "trusted" partners?

kgutteridge 15y ago
Due to the code of practice in the UK the mobile network operators do at share "over 18 yes/no" with some sites You can read more http://www.aimelink.org/docs/UK_MNO_Age_Verification_Procedures.pdf http://www.aimelink.org/docs/UK_MNO_Age_Verification_Procedu...

deleted 15y ago

[deleted]

kgutteridge 15y ago
If you have ever used any payforit service to pay for goods, the intermediary you went through will at the very least have your MSISDN hashed and most likely in the clear (depends on your mobile network operator) List of the Payforit intermediaries http://www.payforit.org/ http://www.payforit.org/