Elisa sends your phone number to every web site

Did you know that if you use the wireless browser in your mobile handset, your operator might be leaking your identity to every single web site you are visiting? I didn't, until today...

I whipped up a short jsp page to show the headers that my phone browser is sending, and lo and behold! there is my mobile phone number in plain text, sent to every web site. Check below for the log file, look for the x-msisdn and x-network-info -fields.

27/06/05 21:00:52 (213.161.40.46): user-agent: Nokia3220/2.0 (03.60) Profile/MIDP-2.0 Configuration/CLDC-1.1
27/06/05 21:00:52 (213.161.40.46): via: HTTP/1.1 wgw3.radiolinja.fi (XMG 724Solutions HTG BA_PC5_M1_B012 20041105.230426)
27/06/05 21:00:52 (213.161.40.46): x-msisdn: 358505476XXX
27/06/05 21:00:52 (213.161.40.46): x-network-info: GPRS,85.156.35.135,358505476XXX,unsecured
27/06/05 21:00:52 (213.161.40.46): x-wap-profile: "http://nds1.nds.nokia.com/uaprof/N3220r100.xml"

(The XXX is my own doing; the phone number is really fully visible.)

I would tell you if this is true also if you are using your phone as a modem, but as my luck has it, my Mac died this morning (I tried to install Windows 98 under QEmu: it did the Microsoft thing and forced me to reinstall OSX after playing havoc with it, and now the entire computer is dead), and none of my cell phones work with my work laptop (after an upgrade to XP). Or actually, one of them would, if it hadn't just died last week thanks to a flashing mishap. I have now four dysfunctional phones and two dysfunctional laptops. As a personal note, I'm having a really lousy week already. Update. Chris says it's only when you're using the WAP gateway. So modem users are fine.

So, if anyone is using Elisa GPRS or 3G on their laptop, I would appreciate it if you could test it here, drop me a comment here and I'll publish the findings (without your phone number). Other operators are welcome, too. It should work with non-Finnish operators, too.

While sending the mobile phone number is probably not illegal, I still feel a bit iffy thinking that anyone can trivially figure out who I am when I browse their web site. There is no option to turn this off, and Elisa is not publicizing this fact either - in fact, a google for x-msisdn yields 23 results. So this thing is not even very well known. It would also be interesting to know if this still happens if you have an unlisted phone number.

I sent an email to Elisa's customer service and asked about their policy towards publishing subscriber information. I'll let you know if I get any answers. Until then, I would recommend that you are careful as to which web/wap sites you go to with your cell phone. Unless, of course, you don't mind them getting your phone number.

(Thanks to Jaakko Rajaniemi for the tip.)

Update: Saunalahti seems to also leak the phone number.



Comments

Doesn't seem to do it using the phone as a modem - which access point are you using? From your headers it looks like the wap gateway rather than the internet one.

It's probably jsut a misconfigured gateway - normal the operator portal/walled garden uses these fields for authentication and identity (which should be done with a unique id, rather than msisdn, to be honest). They should be stripped when going outside the operator's network, though. Monumentally bad.

--ChrisH, 27-Jun-2005

Yes, my guess is that it's the gateway as well... I agree, monumentally bad.

--JanneJalkanen, 28-Jun-2005

Just tested with Saunalahti, same thing here. The via header says it's a Nokia WAP Gateway 4.1 though, which kind of casts doubt on the assumption that it's just a misconfigured gateway. The phone number appears in the x-network-info and x-nokia-msisdn headers.

--Ilkka, 28-Jun-2005

I just realized that was the first time I'd used WAP in the last six months, thanks to Opera and Putty on S60 =)

--Ilkka, 28-Jun-2005

Saunalahti propably sends your number if you happen to use Elisa's network. Elisa, at least few years ago, was the only operator that sent the phone number.

--Tuomas, 28-Jun-2005

I noticed this a couple years ago and found it disturbing. The operator responded that even if the number would be "secret" the number will still be send. Finnish Communications Regulatory Authority found no reason why the operator couldn't do it. So we have to bear with this non-user friendly fact. And they mention the fact that the number is sent in some of their User Agreement sheet, I've seen it in my own eyes.

--mr X, 28-Jun-2005

Some years ago when working for a startup that created mobile applications (WAP anyone ;) I remember us thinking of how to use the msisdn data for personalization as it was often (if not always ?) available.

I don't remember the details too well because I didn't work on that product or project. But it doesn't surprise me at all.

--Ramin, 28-Jun-2005

mr X: I couldn't find such a statement on my own User Agreement (which, admittedly, is a bit old). Could you be more specific, please?

(I found something here (Finnish), and section 6.8 seems to say something to that effect, but... It's quite vague.)

--JanneJalkanen, 28-Jun-2005

Mindboggling.

According to the test page, dna wap gw does not broadcast your number.

--bronx, 28-Jun-2005

At least Sonera Internet Access Point does not broadcast the number, though I cannot confirm their wap gateway.

--som, 29-Jun-2005

Sonera WAP GW (nwg3.mv.sonera.fi) does not broadcast the number, either.

--era, 01-Jul-2005

I as not even able to graph the x-msdisn header. When I tried to read it tomcat crashed. (my crappy code I supposed)

The bottom line is, it would be useful to identify the user who is viewing the website and here is my reasoning:

Web navigation is extremely difficult on most phones (no mine I have a motorola Q) but even the fancy PDA phones are not as easily to surf as a Desktop PC. I would provide a streamlined experience for the user if we could identify and save settings based on your phone number.

I think the posters main point is more an issue of paranoia than any real threat. It is like someone who deletes their cookies everyday and wonder why they have to enter there password even though they click remember me.

If anyone knows of a way to read a phone number from a mobile web device when it is view a page please let me know.

Thanks!

--SkiOne, 10-Mar-2007

It seems Elisa WAP GPRS gateway is still providing msisdn headers. This does not happen if use Elisa Internet connection type.

--AnonymousCoward, 25-Jan-2008


More info...     Comments?   Back to weblog
"Main_blogentry_270605_2" last changed on 28-Jun-2005 16:43:50 EEST by JanneJalkanen.