Slashdot Mirror

← Back to Stories (view on slashdot.org)

UK Mobile Operator O2 Leaks MMS Photos

Posted by Soulskill on from the like-a-sieve dept.

Anonymous Hero writes "UK Mobile Operator O2 allows its customers to send Multimedia Messaging Service (MMS) photos to email recipients by way of a web interface. The URLs published by the MMS-to-email application are not authenticated, so a simple Google search reveals hundreds, if not thousands of private photos." Reader ttul points out similar coverage of this issue at InformationWeek.

20 of 154 comments (clear)

  1. Tomorrow's news by Anonymous Coward · · Score: 5, Funny

    Under pressure from the NY attorney general, major telecoms have agreed to permanently stop offering MMS service.

    1. Re:Tomorrow's news by duguk · · Score: 3, Informative

      Probably, O2 have already disabled access to email for non-contract users.

      I tried to post this on /. the other day but hasn't been accepted; being as anyone on O2 is probably reading this article, I'll post it here. "It's been reported in a number of places that UK Mobile Phone company, O2 are blocking some internet ports for some customers.

      It appears that although Contract customers on the mobile network are fully able to access email and SSH via their mobile phone, yet customers subscribed through 'Pay as you Go' (PAYG; a non-subscription service, paid up in front as credit), are only given WAP access, which only provides very basic HTTP access.

      Essentially this means that anyone with a pay-in-front service agreement won't be able to access their email or use anything apart from basic HTTP, even though O2 are now selling and advertising the new Apple iPhone on PAYG and stating it will support "all the same features as contract customers".

      It's been reported that on contacting O2, they state its a technical problem and one that can't be resolved, yet it's also been mentioned that their own O2 POP3 mail service does work, but access to any other service doesn't.

      Are O2 right to restrict access for customers not on a fixed contract? Does your mobile phone company do the same thing? And are O2 advertising unfairly?"

      More information here.

    2. Re:Tomorrow's news by William+Robinson · · Score: 5, Funny
      Imagine, Judge being presented his own private MMS as evidence.

      Reminds me of a joke:

      A small town prosecuting attorney called his first witness to the stand in a trial -- a grandmotherly, elderly woman. He approached her and asked, "Mrs. Jones, do you know me?"

      She responded, "Why, yes, I do know you Mr. Williams. I've known you since you were a young boy. And frankly, you've been a big disappointment to me. You lie, you cheat on your wife, you manipulate people and talk about them behind their backs. You think you're a rising big shot when you haven't the brains to realize you never will amount to anything more than a two-bit paper pusher. Yes, I know you."

      The lawyer was stunned. Not knowing what else to do he pointed across the room and asked, "Mrs. Williams, do you know the defense attorney?"

      She again replied, "Why, yes I do. I've known Mr. Bradley since he was a youngster, too. I used to baby-sit him for his parents. And he, too, has been a real disappointment to me. He's lazy, bigoted, he has a drinking problem. The man can't build a normal relationship with anyone and his law practice is one of the shoddiest in the entire state. Yes, I know him."

      At this point, the judge rapped the courtroom to silence and called both counselors to the bench. In a very quiet voice, he said with menace, "If either of you asks her if she knows me, you'll be in jail for contempt of court!"

      --
      hilarious
  2. All your creativity are belong to google.com by AHuxley · · Score: 5, Insightful

    I blame web 2.0 and young people.
    Back in the good old days you would have used safe ftp.
    ftp never hurt anyone.
    I do harbour dreams of being a Tor node operator.

    --
    Domestic spying is now "Benign Information Gathering"
  3. eh? by Anonymous Coward · · Score: 4, Funny

    hundreds or thousands..... or maybe 40? someone can't count very high before jumping to 1000!

    1. Re:eh? by duguk · · Score: 4, Informative

      I think you'll find that there's still the same number as yesterday - I'm the DugUK as mentioned in the InformationWeek article.

      I posted the comment in the O2 Forums, and they not only deleted my comments, they disabled my account too! I'm glad people are finally beginning to realise this is a problem and can't just be hidden up.

      For my next trick, I'd like everyone to also know that EMAIL DOES NOT WORK ON PAY AS YOU GO on O2! They've blocked port access.

      Thanks!

  4. Disappointing by LighterShadeOfBlack · · Score: 5, Funny

    Arr, not a looker in the bunch!

    --
    Spelling mistakes, grammatical errors, and stupid comments are intentional.
    1. Re:Disappointing by GradiusCVK · · Score: 5, Insightful

      Funny it includes the sender's phone number... oughta MMS everyone back and tell them to start taking some photos of hot chicks.
      Presents an interesting new way for us Slashdotters to meet girls...

  5. no problem by Anonymous Coward · · Score: 3, Funny

    Right now the web is being slashdotted, your pictures will be safe

  6. Of course that is not all. by lantastik · · Score: 5, Informative

    Google can dig up all kinds of wonderful information.

  7. Problem solved! by Joce640k · · Score: 5, Funny

    Heartfelt thanks to all the people of slashdot for mounting a DDOS attack on our servers.

    The O2 team.

    --
    No sig today...
    1. Re:Problem solved! by duguk · · Score: 3, Insightful

      At least it might get O2's attention! All the action they've taken so far is deleting forum posts from their own forums and ignoring any email or telephone complaints.

      Are you really from the O2 Team? If so, I've got a few words for you...

  8. Not as bad as it sounds by srjh · · Score: 5, Insightful

    Try searching for each of those 16-character IDs, and you'll see that each has already been posted publically, and most seem to be from just the one user. Which makes sense, if Google managed to index them in the first place.

    Sure, 02 should have taken steps to avoid being indexed, but they aren't responsible for leaking the photos.

    And It would be quite easy to write a script to try various combinations of 16 hex digits to try and randomly view a photo but depending on how many photos are being hosted the hit rate could be quite low.? Yeah, seeing as there are about 10^19 combinations, the hit rate would be fairly low. Did the author seriously consider this to be flaw?

    1. Re:Not as bad as it sounds by duguk · · Score: 3, Insightful

      Sure, 02 should have taken steps to avoid being indexed, but they aren't responsible for leaking the photos.

      Their site is not suitabled secured, usually it would require a mobile number and pin code but this 16-digit code circumnavigates this requirement.

      From TFA, apparently these are also being picked up by Google's Toolbar.

      Surely if you'd MMS'd a friend a picture message, and they'd changed to a phone without MMS without you knowing - your picture will most likely be available on O2's website. Is this right? Should it be more secured? Or don't you care about who see's your 'private' conversations?

    2. Re:Not as bad as it sounds by daviddcawley · · Score: 3, Interesting

      I'm the author of the post. It's true that there are 10^19 combinations if the 64-bit "keys" are secure and generated with a good PRNG. As I'm able to access the "keys" (without using any type of web based search) directly from O2 due to a security hole, it entirely circumvents the URL based authentication. I don't even need to guess any keys! I will update the blog next week with details of the full attack but I'd like to give O2 some time to fix this.

  9. what is wrong with you people? by speedtux · · Score: 5, Insightful

    Worse still, the majority of the images taken on cameras turns out to be children. Ironically, O2 has a website dedicated to "Protect Our Children", well a good first step would be to avoid leaking customer photos.

    What bullshit idea is it that pictures of children need to be removed from the world? If you look at the history of photography, pictures of children have always been an important part of street photography, portraits, and artistic photography. In the US and many other places, it's legal to take pictures of children, even without permission of their parents. There are many pictures of children on Flickr and elsewhere.

    There is no evidence that pictures of children place them at risk. Can we please stop and reverse this meme that there is anything wrong with taking pictures of children?

    I don't really give a damn about pictures of children per se, but demonizing legitimate and legal content is a serious threat to free speech and democracy.

  10. Its not O2, its Google by plierhead · · Score: 3, Interesting

    Ridiculous summary that does not seem to be based on the actual article. This sounds like an issue with Google, not with O2.

    It seems that O2 posts the images with a pretty well randomized URL (16 hex digits is not too bad in most people's books). And the URLs are not linked to any publicly crawlable page on O2's web site. So how does Google reach them?

    The reason (if anyone cares to FTA) that they can be googled is that according to "Ken Simpson, CEO of anti-spam company MailChannels, is that one's Google Toolbar may be configured to pass URLs that one visits to Google for indexing. "If you run Google Toolbar, it knows pages you visit," he said."

    So if the article is correct, Google in its wisdom has decided to treat a URL sent to someone with the Google toolbar in a private email as a publicly reachable URL.

    I find this whole story pretty non-sensicle though - presumable Google would not make "click here to reset your password" links publicly reachable?

    If the article is correct then I'd be stripping off the Google toolbar as quick as I could.

    --

    [x] auto-moderate all posts by this user as insightful

    1. Re:Its not O2, its Google by El_Muerte_TDS · · Score: 3, Informative

      No robots.txt
      http://mediamessaging.o2.co.uk/robots.txt

      Nothing is telling Google (or Yahoo, or ...) not to index a page somebody linked to on some other page.

  11. Look out, it's a trap! by Airw0lf · · Score: 3, Funny

    1. Leak MMS Photos
    2. Watch people as they go through the photos
    3. Arrest anyone who stumbles upon an underage photo (Someone please think of the children!)
    4. ???
    5. Profit! (Or at the very least, create a big carnival sideshow about capturing hordes of perverts in the act in order to distract attention from the massive privacy breach.)

  12. Unfortunately no nude pics by thetoadwarrior · · Score: 4, Funny

    It's amazing how many people have boring pictures and enjoy sending pictures of their ugly kids.

    I think O2 should have the decency to warn people about this but they haven't and I know that because I'm an O2 customer. Thankfully I only use my phone for calls so this doesn't affect me.