Risk
7/18/2008
03:51 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Picture Leak: O2's Security Through Obscurity Can't Stop Google

Some O2 customers' private photos taken with their mobile phones are publicly accessible online.

Customers of U.K. mobile network operator O2 may believe that photos taken with their mobile phones and sent via MMS to friends are private. But if the recipient's phone isn't capable of receiving MMS data, as is the case with Apple's iPhone 3G, those pictures may be publicly accessible.

O2's security for this scenario is security through obscurity: It makes pictures sent via MMS viewable on non-MMS devices by posting them online with a URL that's difficult to guess.

But thanks to Google, there's no need to guess the URL. It can be found using the inurl: search query operator with mms2legacy as the argument.

The reason for this, explained Ken Simpson, CEO of anti-spam company MailChannels, is that one's Google Toolbar may be configured to pass URLs that one visits to Google for indexing. "If you run Google Toolbar, it knows pages you visit," he said.

As Google explains in its Google Toolbar privacy policy, "Certain optional Toolbar features operate by sending Google the addresses or other information about sites when you visit them. Web History, PageRank, and Safe Browsing in Enhanced Mode all work this way."

The ostensibly private O2 picture-share URLs could probably be guessed even without Google. The code that protects them is a 16-digit hexadecimal number and many people are capable of writing a script to try every code combination.

A spokesperson for O2 wasn't immediately available for comment because it was late Friday evening in the United Kingdom.

Simpson, however, believes that someone at the company is aware of the problem and has been trying to cover it up. He said that someone had posted information about the issue in the online forum for O2 customers and that the post had subsequently vanished.

Another O2 customer, however, has chimed in. "I have reported the case to several agencies in the U.K. -- including the ICO, Ofcom, O2, and my excellent local MP," said someone using the name "duguk." "Hopefully something will be done about this."

Simpson said that while he hadn't come across any overly embarrassing pictures, many of the photos that are exposed show people's children.

In a post on the MailChannels blog, senior software engineer David Cawley notes that, ironically, O2 maintains a Protect Our Children Web site. "Well, a good first step would be to avoid leaking customer photos," he said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.