Full Disclosure mailing list archives
Re: Orange Spain disclosing user phone number
From: B1towel <ben () b1towel com>
Date: Mon, 30 Aug 2010 10:48:45 -0400
It would be funny to see advertisers send targeted SMS ads using this. I bet that the advertisers of web sites that participate in iframe ads would also get this information, assuming the Phone would load up iframe ads. I think the provider should fix this, because if someone developed an exploit similar to the one that was able to compromise the iPhone a while back just by sending a maliciously formed SMS message, your phone could be compromised just by going to a website where this information is sent to the web server. I know this is pretty obvious, just my 2 cents. On Aug 30, 2010, at 7:00 AM, full-disclosure-request () lists grok org uk wrote:
Message: 2 Date: Sun, 29 Aug 2010 21:09:50 +0200 From: "xufi ." <xufxuf () gmail com> Subject: [Full-disclosure] Orange Spain disclosing user phone number To: full-disclosure () lists grok org uk Message-ID: <AANLkTinKy8UsAkPd0gg5UoSESdfeNE8bhjAA-OepKO1Q () mail gmail com> Content-Type: text/plain; charset=ISO-8859-1 Hi, Doing an assessment on mobile GWs I found that Orange Spain is adding the user MSISDN in any HTTP request sent in it?s network. That means that is really simple to get the user phone number from a Orange Spain user. On one hand, I saw that Orange Spain uses the header x-up-calling-line-id to add a user temporary ID that changes every 24h but I also found that in any HTTP request they will add the user phone number in the header X-Network-info. In particular the HTTP header looks like as follow: X-Network-info: CSD,34xxxxxxxxx,unsecured where xxxxxxxxx is the user MSISDN
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Orange Spain disclosing user phone number xufi . (Aug 30)
- Re: Orange Spain disclosing user phone number Collin Mulliner (Aug 30)
- <Possible follow-ups>
- Re: Orange Spain disclosing user phone number B1towel (Aug 31)