Re: [Full-disclosure] Orange Spain disclosing user phone number

[Juha-Matti Laurio <juha-matti.laurio@xxxxxxxx>]

I'm sure this has been the source of many targeted advertising SMS's and calls 
during the last years.

And probably many advertisers are digging the logs now:
http://www.zdnet.co.uk/news/security/2010/08/31/orange-spain-reveals-phone-numbers-researcher-40089965/

Juha-Matti

B1towel [ben@xxxxxxxxxxx] kirjoitti: 
> It would be funny to see advertisers send targeted SMS ads using this. I bet 
> that the advertisers of web sites that participate in iframe ads would also 
> get this information, assuming the Phone would load up iframe ads. 
> 
> I think the provider should fix this, because if someone developed an exploit 
> similar to the one that was able to compromise the iPhone a while back just 
> by sending a maliciously formed SMS message, your phone could be compromised 
> just by going to a website where this information is sent to the web server.
> 
> I know this is pretty obvious, just my 2 cents.
> 
> On Aug 30, 2010, at 7:00 AM, full-disclosure-request@xxxxxxxxxxxxxxxxx wrote:
> 
> > 
> > Message: 2
> > Date: Sun, 29 Aug 2010 21:09:50 +0200
> > From: "xufi ." <xufxuf@xxxxxxxxx>
> > Subject: [Full-disclosure] Orange Spain disclosing user phone number
> > To: full-disclosure@xxxxxxxxxxxxxxxxx
> > Message-ID:
> >     <AANLkTinKy8UsAkPd0gg5UoSESdfeNE8bhjAA-OepKO1Q@xxxxxxxxxxxxxx>
> > Content-Type: text/plain; charset=ISO-8859-1
> > 
> > Hi,
> > Doing an assessment on mobile GWs I found that Orange Spain is adding
> > the user MSISDN in any HTTP request sent in it?s network. That means
> > that is really simple to get the user phone number from a Orange Spain
> > user. On one hand, I saw that Orange Spain uses the header
> > x-up-calling-line-id to add a user temporary ID that changes every 24h
> > but I also found that in any HTTP request they will add the user phone
> > number in the header X-Network-info. In particular the HTTP header
> > looks like as follow:
> > 
> > X-Network-info: CSD,34xxxxxxxxx,unsecured
> > 
> > where xxxxxxxxx is the user MSISDN
> 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/