5

I came across a site that is able to know all the information about my mobile phone including my telephone number, what network I'm on and much more. It only works if people visit the site via the phones Internet Browser what is installed on every phone. So don't use a browser you would have downloaded such as Chrome or Firefox. So for example for people with the new Samsung if you click App and then the Samsung folder and then click Internet that is your standard internet browser.

If you visit OffersAlerts.com using your standard mobile browser and also make sure you load the page using your mobile data and not via WiFi. You will see if you look at the URL that the site now has grabbed your information.

I thought this was no longer possible to do in the UK? How are they doing this? I understand its all based off the headers used and grabbing the MSISDN but i thought this was no longer possible?

Is this site doing something illegal/dodgy? Is it the standard internet browsers that are allowing our information to be leaked since it doesn't work on browsers like Chrome?

Have I stumbled up on something which should be reported?

4

Extended HTTP headers are propagated by your mobile operator, at their discretion, as described in Detect an MSISDN (mobile number) with the browser.

They won't work when you are on Wi-Fi, or if you are browsing on a secure HTTPS connection. But otherwise, your mobile operator is free to add or not add any of the HTTP x-headers, based on the browser you are using, page you are visiting, your contract (or lack of) with that operator, and any other info they may find relevant. Often, the operators only pass these headers for their own 'mobile portal'.

None of these headers should be trusted by the backend, they all can be easily spoofed.

A long list of such headers, caught in the wild, may be found here: https://mobiforge.com/design-development/useful-x-headers.

You can use a simple service at http://www.mulliner.org/pc.cgi that shows you all information that external web sites receive from your phone.

0

I'm not sure, but the service you stated could be part of your network territory, so it could be possible that your network either append some data in header(if it's http) or better the service ask the operator in background for some data.

As you stated only using the mobile data, and not the wifi, or a 3rd. party network, I think having this service as a sub system of your network looks possible.

You may contact the operator and ask about it.

It could be a shopping service which would allow you shop and then pay it with your bill, or etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.