2

Recently I had to disable some paid services on a mobile phone (those kind of annoying services that automatically enable when you visit some particular websites and cost lots of money). To do so I visited the website

http://selfcare.mobilepay.it

I was expecting some kind of authentication like

put your mobile number here - receive an SMS - enter the SMS code you just received here

Instead I was presented with a page where I was already authenticated and my mobile number was displayed, there I could manage my payments etc.

How can websites like mobilepay.it know my mobile number?

I checked the website https://www.mulliner.org/pc.cgi to see if my mobile number was shared via HTTP headers but I couldn't see anything suspicious.

Note: Sometimes visiting the mobilepay selfcare webpage from a computer connected to the internet via a portable router with a sim inside (and a mobile number) shows you the administration page for that number, visiting the selfcare from a mobile phone connected in the same way of the computer before (so with a portable router) shows you a page where you have to put your mobile number.

4
  • Most likely: Either you entered it somewhere you don't remember, or something you can remember sold your data. Solution: Stop giving personal data to each nonsense site that asks for it. And stop using a modern mobile phone altogether.
    – user155462
    Aug 18, 2017 at 7:24
  • @user155462 I don't think i entered the phone number anywhere as is a mobile router phone number so you don't use it often, if ever. If someone sold my data i can't see how they can relate the number with my connection, so that doesn't make sense to me. Also i am interested on how that works not how to prevent information leaks. Aug 18, 2017 at 7:54
  • @user155462 "Stop using a modern mobile phone altogether". With a rooted/jailbroken smartphone, you can fake information. Most "dumb" phones won't let you do that. Aug 18, 2017 at 7:57
  • @S.L.Barth ...and the lowlevel malware still is there. ... Well, as you said, it has positive aspects too.
    – user155462
    Aug 18, 2017 at 9:11

2 Answers 2

1

I believe the MSISDN (phone number) is passed over by the Mobile operator directly to the mobilepay.it server. When you are connected to a 4G or 3G network your mobile network operator knows this information and it can pass over to any application server if it has an agreement. I am also interested to know what protocol they use, anyway for sure mobilepay.it has agreements will all service providers in Italy. When you browse using a PC on a Wifi, or your mobile phone on a wifi they don't detect your number. If you use a wifi but your connection is a 3G/4G, e.g. tethering on a mobile phone or 4G router, they may detect the 3G router SIM MSISDN, but it depends on the device and hotspot configuration, I guess.

1
  • 1
    Sounds reasonable and is similar to my findings. I am curious to know if someone can spoof the MSISDN to bypass the authentication mechanism Aug 18, 2017 at 18:39
-3

Short answer: Some carriers do store phone number in the SIM cards and if it's stored, a web application can retrieve it if it's built that way.

If the phone number is not stored anywhere from where it can be automatically retrieved (most cases, I think) then the user has to enter their number manually.

There is a development related discussion about it here: https://stackoverflow.com/questions/2480288/programmatically-obtain-the-phone-number-of-the-android-phone#comment2472240_2480307

but if that's not what interests you then it's enough to know that some carriers do store phone numbers in their SIM cards and it's possible to retrieve them.

6
  • 1
    Thank you for the answer but it looks like that discussion is about applications running on the mobile phone not web applications. I am interested in web applications Aug 18, 2017 at 8:10
  • Same principle stands for web applications.
    – skooog
    Aug 18, 2017 at 8:12
  • 1
    I don't think i can execute java code on web applications the same way i can do on android applications Aug 18, 2017 at 8:15
  • 3
    @aistesik It's not possible for things regarding mobile numbers as the code should communicate to OS APIs which aren't available to web applications Aug 18, 2017 at 8:28
  • 1
    It would be odd if any Website could just read your phone number. that's definitely not possible.
    – Lukas
    Aug 18, 2017 at 10:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .