O2 accused of leaking phone numbers to websites

 

Gallery

By Stewart Mitchell

Posted on 25 Jan 2012 at 10:09

O2 is facing a privacy backlash from users after reports emerged that the company was sharing subscribers' mobile numbers to websites they visit.

The potentially damaging privacy breach was spotted by system administrator Lewis Peckover, who posted details of how he spotted mobile phone number details when visitors went to his website from their handsets.

Peckover released a script showing the information he receives, saying it included phone numbers and claimed that data was not client-side, meaning the data had to come from O2.

It is logical to conclude that this same information is sent to all other websites too

“O2 seems to be transparently proxying HTTP traffic and inserting this header,” he said. “If you're on O2's UK mobile network (not ADSL), you'll (probably) see a line beginning with x-up-calling-line-id - followed by your mobile phone number in plain text.

“It is logical to conclude that this same information is sent to all other websites too,” he added.

O2 said it was still looking into the claims.

Criticism

O2 faces an angry backlash from users who saw this discovery as a serious data breach, and it will need to act quickly to halt a wave of Twitter disapproval.

“If you want your customers to feel safe, you must disable the proxy immediately, then deal with the wider issues,” said Alexander Hanff, managing director of Think Privacy via his Twitter feed. “RIPA now carries penalties for 'accidental breach' and O2 needs to be held to account for this, numbers effected could be high.

"The longer this proxy is left running the more significant the breach becomes and hundreds of thousands of customers risk exposure."

Hanff highlighted how rogue websites could misuse the information, by manipulating tools such as Gmail's two-factor authentification that uses phone numbers for verification, adding “the gravity of this issue is huge”.

Customers worried

Industry insiders said they were already seeing serious concerns from customers that could be affected by the issue.

“I think O2 have dropped a major one with the phone-number-in-headers thing,” said IT company Wrenthorpe Consultancy on its Twitter feed.

“My morning's being spent dealing with clients who are extremely worried - huge privacy/security concerns.”

According to Wrenthorpe, the issue wasn't restricted to O2, but also affected Tesco Mobile and GiffGaff customers, which are virtual networks using the mobile operator's infrastructure.

"We're currently aware of an issue where mobile number information could be being shared in HTTP headers when browsing the mobile internet through headers on your 3G service," a GiffGaff spokesperson said in a statement.

"At GiffGaff, the privacy and security of our customers is our utmost concern," he added. "We are investigating the reports of what appears to be an O2 network issue as a priority, and will be back to you here as soon as we hear anything more."