Full Disclosure mailing list archives

Re: Orange Spain disclosing user phone number

From: "xufi ." <xufxuf () gmail com>
Date: Wed, 1 Sep 2010 09:21:03 +0200

Orange Spain has updated it´s GW configuration and it´s not adding the
user MSISDN by default anymore.
Another example that responsible disclosure is not always enough.
Thanks for helping fixing this
@xuf_


On Mon, Aug 30, 2010 at 4:48 PM, B1towel <ben () b1towel com> wrote:

It would be funny to see advertisers send targeted SMS ads using this. I bet
that the advertisers of web sites that participate in iframe ads would also
get this information, assuming the Phone would load up iframe ads.
I think the provider should fix this, because if someone developed an
exploit similar to the one that was able to compromise the iPhone a while
back just by sending a maliciously formed SMS message, your phone could be
compromised just by going to a website where this information is sent to the
web server.
I know this is pretty obvious, just my 2 cents.
On Aug 30, 2010, at 7:00 AM, full-disclosure-request () lists grok org uk
wrote:


Message: 2
Date: Sun, 29 Aug 2010 21:09:50 +0200
From: "xufi ." <xufxuf () gmail com>
Subject: [Full-disclosure] Orange Spain disclosing user phone number
To: full-disclosure () lists grok org uk
Message-ID:
<AANLkTinKy8UsAkPd0gg5UoSESdfeNE8bhjAA-OepKO1Q () mail gmail com>
Content-Type: text/plain; charset=ISO-8859-1

Hi,
Doing an assessment on mobile GWs I found that Orange Spain is adding
the user MSISDN in any HTTP request sent in it?s network. That means
that is really simple to get the user phone number from a Orange Spain
user. On one hand, I saw that Orange Spain uses the header
x-up-calling-line-id to add a user temporary ID that changes every 24h
but I also found that in any HTTP request they will add the user phone
number in the header X-Network-info. In particular the HTTP header
looks like as follow:

X-Network-info: CSD,34xxxxxxxxx,unsecured

where xxxxxxxxx is the user MSISDN

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Current thread:

Re: Orange Spain disclosing user phone number xufi . (Sep 01)
- <Possible follow-ups>
- Re: Orange Spain disclosing user phone number Juha-Matti Laurio (Sep 03)