Slashdot Mirror
It's Not Just O2 Leaking MMS Messages
wiedzmin writes "A recently publicized issue with UK's O2 leaking private MMS to the Internet by making them available and searchable in Google has gained a lot of momentum and forced the company to promptly fix the problem. However a quick internet search shows that other mobile server providers, including those located in US and Canada, also make all MMS messages available in a similar manner. In fact, operators like Sprint and Boost Mobile will even let you see the phone number from which the picture or video was sent, download it, print it, forward it or reply to it from the same web page. Other operators like Canada's Bell, Solo Mobile, Verizon, Rogers and Quest appear to have removed or otherwise protected all MMS messages recently as all the cached search listings that show up for these providers are no longer available. There is no telling how many other operators' MMS listings can be accessed given correct search terms, but it looks like they are starting to get the idea and remove them from the web."
It should be O2 (Oh 2), not 02 (zero 2)...
Red Leader Standing By!
I feel a great disturbance in the Internet, as if millions of webmasters suddenly cried out in terror and suddenly updated their robots.txt file.
You just got troll'd!
This was the same with the O2 MMS leak over the weekend. Google's cache was showing the mobile number from which the MMS originated - highly controversial IMO.
ilovegeorgebush
Most users i looked at seem to send around pictures of houses and cars they are planning to buy. Or maybe the want to sell them. In any case, looks like the US economy is not THAT bad.
i use e-mail instead
mov ax,4c00h
int 21h
ASF Files containing URL's meant to be auto-followed, large telecoms publishing "private" messages on the public-accessible net.
Neither of these are old enough for the "it was before we knew" excuse, so wtf is going through these guys heads?
1) Take naked picture of self
2) Send to SO
3) Find on internet
4) Sue
6) PROFIT!
5 pages of URLs and not a single nude picture! How is that possible??
At least we know AT&T isn't leaking our MMS messages.
And how do search engines find the pages? Not likely via links, or if they do, what's wrong with that? I believe the most plausible explanation is that the viewers of such pages are using Google Toolbar or a similar tool, which I believe can report (reports all the time?) viewed pages to Google, so it can index then, even if they don't have any inbound links.
The lack of robots.txt is an oversight, though.
But why should a secret URL not be a decent security feature? Especially if they don't have outbound links that could put them into another server's log in the form of the Referer-field of the header. Why is it an advantage that part of the URL is moved to web page credentials? The pages themselves can still be in plain text (or are they SSL-protected?) and any system between the client and the server can see the credentials no matter where they are put. There is the slight difference that a server more commonly logs only the URL, not the password, but that's just another configuration issue and not in my opinion any real security; an attacker could modify the web server produce any kinds of logs he wanted.
I did try, with one such URL, to find its inbound link with Google's linkto-search, but found nothing. This does suggest a tool such as Google Toolbar or manual page entry was used to get the pages in. The low number of images found this way suggests this too.
If the providers had a page that linked to all the MMS images that way, now that would have been a grave mistake. But relying on secret URLs on a plain text medium in any case, is not. The search engines have no magic fairy dust in them to help them find such pages - and they sure aren't brute forcing the web..
I've got some +1 informatives to hand out here... somebody go find me some pictures of naked ladies!
But I guess you consider the contents of your phone conversations private.
Why? That makes ZERO sense. Anyone with a scanner used to be able to pick up your cell phone conversation, and today since the signal is digital it's a little harder but the same basic premise still applies - NO phone conversation is encrypted unless you do so yourself. Apart even from freely transmitting your conversation to anyone in range who wants to listen, there's the stuff that happens with your voice signal downstream on the way to where it is going....
Any expectation of privacy from a phone conversation is more a reflection of willful ignorance as to how telephone networks work than any actual basis for belief.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Easy to intercept doesn't mean not private (or public).
Private, in this sense, means that it's illegal to intercept my communication (except for lawful interception). I could sue anyone who intercepts my phone calls and uses the obtained information in any way and I become aware of it. This applies to phone, SMS/MMS, email, web activity, whatever. (IANAL, but I guess it could also apply to my WLAN at home) Of course I am aware of the fact that these communication channels are insecure, so I use them accordingly. But if anyone has the means to intercept my communication, it does not mean they can legally do it.
.sig: No such file or directory
I am confident the message I send is intended not to be seen by anyone but who I intended to see it.
I am confident the MMS message I might send is meant to be seen by others.
And that is all the difference. You are nitpicking fine details of the possible security weaknesses, while totally missing the big picture.
"There is more worth loving than we have strength to love." - Brian Jay Stanley