Slashdot Log In
UK Mobile Operator O2 Leaks MMS Photos
Posted by
Soulskill
on Sat Jul 19, 2008 01:05 AM
from the like-a-sieve dept.
from the like-a-sieve dept.
Anonymous Hero writes "UK Mobile Operator O2 allows its customers to send Multimedia Messaging Service (MMS) photos to email recipients by way of a web interface. The URLs published by the MMS-to-email application are not authenticated, so a simple Google search reveals hundreds, if not thousands of private photos."
Reader ttul points out similar coverage of this issue at InformationWeek.
Related Stories
Submission: UK Mobile Operator O2 Leaks MMS Photos by Anonymous Coward
[+]
Mobile: It's Not Just O2 Leaking MMS Messages 105 comments
wiedzmin writes "A recently publicized issue with UK's O2 leaking private MMS to the Internet by making them available and searchable in Google has gained a lot of momentum and forced the company to promptly fix the problem. However a quick internet search shows that other mobile server providers, including those located in US and Canada, also make all MMS messages available in a similar manner. In fact, operators like Sprint and Boost Mobile will even let you see the phone number from which the picture or video was sent, download it, print it, forward it or reply to it from the same web page. Other operators like Canada's Bell, Solo Mobile, Verizon, Rogers and Quest appear to have removed or otherwise protected all MMS messages recently as all the cached search listings that show up for these providers are no longer available. There is no telling how many other operators' MMS listings can be accessed given correct search terms, but it looks like they are starting to get the idea and remove them from the web."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Tomorrow's news (Score:5, Funny)
Under pressure from the NY attorney general, major telecoms have agreed to permanently stop offering MMS service.
Re:Tomorrow's news (Score:4, Informative)
I tried to post this on
It appears that although Contract customers on the mobile network are fully able to access email and SSH via their mobile phone, yet customers subscribed through 'Pay as you Go' (PAYG; a non-subscription service, paid up in front as credit), are only given WAP access, which only provides very basic HTTP access.
Essentially this means that anyone with a pay-in-front service agreement won't be able to access their email or use anything apart from basic HTTP, even though O2 are now selling and advertising the new Apple iPhone on PAYG and stating it will support "all the same features as contract customers".
It's been reported that on contacting O2, they state its a technical problem and one that can't be resolved, yet it's also been mentioned that their own O2 POP3 mail service does work, but access to any other service doesn't.
Are O2 right to restrict access for customers not on a fixed contract? Does your mobile phone company do the same thing? And are O2 advertising unfairly?"
More information here [xcns.co.uk].
Parent
Re: (Score:2)
'Essentially this means that anyone with a pay-in-front service agreement won't be able to access their email or use anything apart from basic HTTP, even though O2 are now selling and advertising the new Apple iPhone on PAYG and stating it will support "all the same features as contract customers"'
They aren't selling a PAYG iPhone yet, and are now only saying it will be available 'in time for Christmas':
http://www.reghardware.co.uk/2008/07/07/cw_payg_iphone_launch [reghardware.co.uk]
Re: (Score:2)
You can stick in a PayG SIM in a 2G iphone and it'll work fine.. it's one of the things O2 recommend you do with your old iphone when you upgrade to the 3G.
The story is *total* BS though. Email works just fine on the iphone over PayG, as does everything else. They even allow you to get unlimited internet and wifi as a package for £10/mo if you want.
Re:Tomorrow's news (Score:5, Funny)
Reminds me of a joke:
A small town prosecuting attorney called his first witness to the stand in a trial -- a grandmotherly, elderly woman. He approached her and asked, "Mrs. Jones, do you know me?"
She responded, "Why, yes, I do know you Mr. Williams. I've known you since you were a young boy. And frankly, you've been a big disappointment to me. You lie, you cheat on your wife, you manipulate people and talk about them behind their backs. You think you're a rising big shot when you haven't the brains to realize you never will amount to anything more than a two-bit paper pusher. Yes, I know you."
The lawyer was stunned. Not knowing what else to do he pointed across the room and asked, "Mrs. Williams, do you know the defense attorney?"
She again replied, "Why, yes I do. I've known Mr. Bradley since he was a youngster, too. I used to baby-sit him for his parents. And he, too, has been a real disappointment to me. He's lazy, bigoted, he has a drinking problem. The man can't build a normal relationship with anyone and his law practice is one of the shoddiest in the entire state. Yes, I know him."
At this point, the judge rapped the courtroom to silence and called both counselors to the bench. In a very quiet voice, he said with menace, "If either of you asks her if she knows me, you'll be in jail for contempt of court!"
Parent
Re: (Score:2)
I bet Apple apologisers will party like... "See, how future ready iPhone is?"
Re: (Score:3, Funny)
Under pressure from the NY attorney general, major telecoms have agreed to permanently stop offering MMS service.
So what, anybody actually used MMS?
Re: (Score:2)
I never realised the NY Attorney General had such power over British phone operators.
Only google has:
http://www.google.com/search?hl=en&q=inurl:mms2legacy&start=20&sa=N&filter=0 [google.com]
All your creativity are belong to google.com (Score:5, Insightful)
Back in the good old days you would have used safe ftp.
ftp never hurt anyone.
I do harbour dreams of being a Tor node operator.
Re: (Score:2, Insightful)
Aw, you gotta be kidding! You are not a sys admin, I suppose? ftp is a fucked up protocol (passive ftp? active ftp? gimme a break) that was a nightmare to manage, specially if you had firewalls.
Re: (Score:3, Informative)
Even so, eMail doesn't work on Pay as you Go on O2. [xcns.co.uk]
So yeah, it does affect customers. Anyone who sends an MMS to a non-MMS capable phone (presumably if the phone can't do MMS, it probably can't do eMail either), the MMS is posted to O2's website, and that's where the problem starts.
Did you bother to read the article? [xcns.co.uk]
Re: (Score:3, Informative)
Even so, eMail doesn't work on Pay as you Go on O2.
Total BS. That site is making shit up to get advertising hits. It's not even believable shit this time around, as anyone with an iphone on PayG will tell you.
eh? (Score:4, Funny)
hundreds or thousands..... or maybe 40? someone can't count very high before jumping to 1000!
Re:eh? (Score:5, Informative)
I posted the comment in the O2 Forums, and they not only deleted my comments, they disabled my account too! I'm glad people are finally beginning to realise this is a problem and can't just be hidden up.
For my next trick, I'd like everyone to also know that EMAIL DOES NOT WORK ON PAY AS YOU GO on O2! They've blocked port access.
Thanks!
Parent
Re: (Score:3, Informative)
Re: (Score:2)
For my next trick, I'd like everyone to also know that EMAIL DOES NOT WORK ON PAY AS YOU GO on O2! They've blocked port access.
So it's you making this BS up? You've already been called on it on the O2 forums and it's not surprising they deleted your account.
Email works *perfectly* on pay as you go. As you damned well know. Troll.
Re: (Score:3, Informative)
I still get 40 results. And google isn't real time, if the pictures were taken down from the servers that wouldn't change the search results right away.
Disappointing (Score:5, Funny)
Arr, not a looker in the bunch!
Re:Disappointing (Score:5, Insightful)
Presents an interesting new way for us Slashdotters to meet girls...
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Watch out, they are making laws against this "cyber-stalking" stuff. Crazy times we live in!
no problem (Score:3, Funny)
Right now the web is being slashdotted, your pictures will be safe
I hear a thundering herd of feet.... (Score:3, Insightful)
3.....
2.....
1.....
Ohhhh, settled out of court and everyone gets 1000 free picture and MMS messaging while we fix our system.
(Im calling 3 weeks to the system being fixed)
Re: (Score:2)
Re: (Score:2)
settled out of court and everyone gets 1000 free picture and MMS messaging while we fix our system.
And $100 million in attorney's fees for those representing the class action suit.
Re: (Score:2)
IANAL but, In the UK they cant write you out of something you are legally entitled to....
question is, are we legally entitled to a class action? hmmmm
Well that's just great (Score:2)
Oh well, it could be worse - I could have stayed with Virgin.
Of course that is not all. (Score:5, Informative)
Google can dig up all kinds of wonderful information [ihackstuff.com].
Problem solved! (Score:5, Funny)
Heartfelt thanks to all the people of slashdot for mounting a DDOS attack on our servers.
The O2 team.
Re:Problem solved! (Score:4, Insightful)
Are you really from the O2 Team? If so, I've got a few words for you...
Parent
Not as bad as it sounds (Score:5, Insightful)
Sure, 02 should have taken steps to avoid being indexed, but they aren't responsible for leaking the photos.
And It would be quite easy to write a script to try various combinations of 16 hex digits to try and randomly view a photo but depending on how many photos are being hosted the hit rate could be quite low.? Yeah, seeing as there are about 10^19 combinations, the hit rate would be fairly low. Did the author seriously consider this to be flaw?
Re:Not as bad as it sounds (Score:4, Insightful)
Sure, 02 should have taken steps to avoid being indexed, but they aren't responsible for leaking the photos.
Their site is not suitabled secured, usually it would require a mobile number and pin code but this 16-digit code circumnavigates this requirement.
From TFA, apparently these are also being picked up by Google's Toolbar.
Surely if you'd MMS'd a friend a picture message, and they'd changed to a phone without MMS without you knowing - your picture will most likely be available on O2's website. Is this right? Should it be more secured? Or don't you care about who see's your 'private' conversations?
Parent
Re: (Score:2, Interesting)
Surely if you'd MMS'd a friend a picture message, and they'd changed to a phone without MMS without you knowing - your picture will most likely be available on O2's website. Is this right? Should it be more secured? Or don't you care about who see's your 'private' conversations?
Yes, it probably should be more secure. Not allowing the pages to be indexed by Google would be a good start. But as it stands, unless there are further flaws I'm not aware of, you still need the 64 bit key to intercept the message. Unless the person I've sent a private message to makes that key public, the message should remain private.
On the other hand, I'm not under any delusions that privacy exists for SMS/MMS messages here in Australia, so I wouldn't send sensitive information through SMS/MMS in the
Re: (Score:3, Interesting)
what is wrong with you people? (Score:5, Insightful)
Worse still, the majority of the images taken on cameras turns out to be children. Ironically, O2 has a website dedicated to "Protect Our Children", well a good first step would be to avoid leaking customer photos.
What bullshit idea is it that pictures of children need to be removed from the world? If you look at the history of photography, pictures of children have always been an important part of street photography, portraits, and artistic photography. In the US and many other places, it's legal to take pictures of children, even without permission of their parents. There are many pictures of children on Flickr and elsewhere.
There is no evidence that pictures of children place them at risk. Can we please stop and reverse this meme that there is anything wrong with taking pictures of children?
I don't really give a damn about pictures of children per se, but demonizing legitimate and legal content is a serious threat to free speech and democracy.
Re: (Score:2)
This isn't about the children, its about a mobile phone operator having an insecure website.
Its not O2, its Google (Score:4, Interesting)
Ridiculous summary that does not seem to be based on the actual article. This sounds like an issue with Google, not with O2.
It seems that O2 posts the images with a pretty well randomized URL (16 hex digits is not too bad in most people's books). And the URLs are not linked to any publicly crawlable page on O2's web site. So how does Google reach them?
The reason (if anyone cares to FTA) that they can be googled is that according to "Ken Simpson, CEO of anti-spam company MailChannels, is that one's Google Toolbar may be configured to pass URLs that one visits to Google for indexing. "If you run Google Toolbar, it knows pages you visit," he said."
So if the article is correct, Google in its wisdom has decided to treat a URL sent to someone with the Google toolbar in a private email as a publicly reachable URL.
I find this whole story pretty non-sensicle though - presumable Google would not make "click here to reset your password" links publicly reachable?
If the article is correct then I'd be stripping off the Google toolbar as quick as I could.
Re: (Score:2)
It's a bit out of date, but this Matt Cutts blog entry [mattcutts.com] claims that the toolbar doesn't feed URLs into the web search index.
Re: (Score:3, Insightful)
You missed a key point in the TFA:
I looked at the URL in the e-mail and found the only requirement was a 16 digit hex number. [Update: A few readers pointed out that a 64-bit key results in a HUGE number of possibilities to guess 10^19. However, as I can obtain the keys via another security hole no guessing is required - I'm not going to release that information yet as I'd like O2 to fix this]. As these web pages were wide open to the internet, not requiring any authentication a very small handful were indexed by Google. I was able to craft a Google search that results in some matches to show an example of how this is an insecure method of hosting:
In other words, the stuff that's on google is merely the tip of the iceberg. He can start randomly plucking valid hex codes out of thin air and start viewing random people's random MMS's. The google search is just a "proof of concept" if you will, of the larger flaw.
This could be, of course, untrue -- as we really only have his word to take for it that there is some "pattern" in picking valid hex codes.
Re: (Score:2)
No, this isn't an issue with Google. A search engine's job is to index things it finds on the web. If you put something on the web without any kind of password protection, then don't be surprised if it ends up being indexed by search engines. Just because you don't consider it an "official" part of your website because there isn't a link to it on your homepage, it doesn't mean that's true.
Incompetent web developers have been complaining about this for as long as search engines have been around. It's
Re:Its not O2, its Google (Score:4, Informative)
No robots.txt
http://mediamessaging.o2.co.uk/robots.txt [o2.co.uk]
Nothing is telling Google (or Yahoo, or ...) not to index a page somebody linked to on some other page.
Parent
Look out, it's a trap! (Score:4, Funny)
2. Watch people as they go through the photos
3. Arrest anyone who stumbles upon an underage photo (Someone please think of the children!)
4. ???
5. Profit! (Or at the very least, create a big carnival sideshow about capturing hordes of perverts in the act in order to distract attention from the massive privacy breach.)
Unfortunately no nude pics (Score:5, Funny)
I think O2 should have the decency to warn people about this but they haven't and I know that because I'm an O2 customer. Thankfully I only use my phone for calls so this doesn't affect me.
Don't think O2 is that at fault here (Score:3, Informative)
Given the small number of results here I'd say that those pages were linked from somewhere else (a forum or someones homepage maybe?) which allowed google to index them.
Google's spider isn't magic, it can only find things that are linked to from another public site (given google's don't be evil mantra I doubt they'd start indexing links from emails etc.)
Still O2 should probably add some no index tags as it does give people a way to list all O2's public mms', with probably a broader audience then whoever posted them would like
Re: (Score:2)
Also, have you tried this with non-O2 mail servers? With IMAP? I'd love to know how you can get this to work on 'normal' handsets, because O2 say its a 'technical limitation'.
Re: (Score:2)
Re: (Score:3, Insightful)
This is a SERIOUS breach of privacy. This will hit mainstream media. The fact that I can hit a google link and listen to people voice attachments, look at their photos - that's too public of a mistake. I look forward to watching this unfold.
Umm... yesterday it hit the TV news that in the last 4 years the MoD has lost ~650 laptops - many containing classified information. It made the mainstream news, I'm sure people are moaning, and there'll probably be an "enquiry" which will take a few months and cost a few million eventually leading to nothing and, as always, nothing will change.
By comparison a few photos and sound-bites is nothing. This will probably be a 1/8th page article on page 32 and that'll be the end of that.
In the UK the prevalence
Re: (Score:3, Informative)
You're pretty new here, so let me give you a bit of advice: If anyone on Slashdot purports to show you pictures of naked chicks ...
Put your welding goggles on before you hit the link. And for damned sure don't do it at work.