2

Recently I had to disable some paid services on a mobile phone (those kind of annoying services that automatically enable when you visit some particular websites and cost lots of money). To do so I visited the website

http://selfcare.mobilepay.it

I was expecting some kind of authentication like

put your mobile number here - receive an SMS - enter the SMS code you just received here

Instead I was presented with a page where I was already authenticated and my mobile number was displayed, there I could manage my payments etc.

How can websites like mobilepay.it know my mobile number?

I checked the website https://www.mulliner.org/pc.cgi to see if my mobile number was shared via HTTP headers but I couldn't see anything suspicious.

Note: Sometimes visiting the mobilepay selfcare webpage from a computer connected to the internet via a portable router with a sim inside (and a mobile number) shows you the administration page for that number, visiting the selfcare from a mobile phone connected in the same way of the computer before (so with a portable router) shows you a page where you have to put your mobile number.

  • Most likely: Either you entered it somewhere you don't remember, or something you can remember sold your data. Solution: Stop giving personal data to each nonsense site that asks for it. And stop using a modern mobile phone altogether. – user155462 Aug 18 '17 at 7:24
  • @user155462 I don't think i entered the phone number anywhere as is a mobile router phone number so you don't use it often, if ever. If someone sold my data i can't see how they can relate the number with my connection, so that doesn't make sense to me. Also i am interested on how that works not how to prevent information leaks. – Rocco Mancin Aug 18 '17 at 7:54
  • @user155462 "Stop using a modern mobile phone altogether". With a rooted/jailbroken smartphone, you can fake information. Most "dumb" phones won't let you do that. – S.L. Barth Aug 18 '17 at 7:57
  • @S.L.Barth ...and the lowlevel malware still is there. ... Well, as you said, it has positive aspects too. – user155462 Aug 18 '17 at 9:11
1

I believe the MSISDN (phone number) is passed over by the Mobile operator directly to the mobilepay.it server. When you are connected to a 4G or 3G network your mobile network operator knows this information and it can pass over to any application server if it has an agreement. I am also interested to know what protocol they use, anyway for sure mobilepay.it has agreements will all service providers in Italy. When you browse using a PC on a Wifi, or your mobile phone on a wifi they don't detect your number. If you use a wifi but your connection is a 3G/4G, e.g. tethering on a mobile phone or 4G router, they may detect the 3G router SIM MSISDN, but it depends on the device and hotspot configuration, I guess.

  • 1
    Sounds reasonable and is similar to my findings. I am curious to know if someone can spoof the MSISDN to bypass the authentication mechanism – Rocco Mancin Aug 18 '17 at 18:39
-3

Short answer: Some carriers do store phone number in the SIM cards and if it's stored, a web application can retrieve it if it's built that way.

If the phone number is not stored anywhere from where it can be automatically retrieved (most cases, I think) then the user has to enter their number manually.

There is a development related discussion about it here: https://stackoverflow.com/questions/2480288/programmatically-obtain-the-phone-number-of-the-android-phone#comment2472240_2480307

but if that's not what interests you then it's enough to know that some carriers do store phone numbers in their SIM cards and it's possible to retrieve them.

  • 1
    Thank you for the answer but it looks like that discussion is about applications running on the mobile phone not web applications. I am interested in web applications – Rocco Mancin Aug 18 '17 at 8:10
  • Same principle stands for web applications. – skooog Aug 18 '17 at 8:12
  • 1
    I don't think i can execute java code on web applications the same way i can do on android applications – Rocco Mancin Aug 18 '17 at 8:15
  • 3
    @aistesik It's not possible for things regarding mobile numbers as the code should communicate to OS APIs which aren't available to web applications – Rocco Mancin Aug 18 '17 at 8:28
  • 1
    It would be odd if any Website could just read your phone number. that's definitely not possible. – Lukas Aug 18 '17 at 10:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.