O2 apologizes for 'unintended' number-leak cockup
Will cooperate with Information Commissioner's probe
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
O2 has issued a public apology for leaking the phone numbers of some 3G customers in header information sent to website managers.
“We would like to apologize for the concern we have caused,” the company said in a statement.
The cellco said it was standard industry practice to send out user’s phone number information in this way to “certain trusted partners”, (as El Reg has pointed out) but blamed a botched maintenance job on January 10 for the data spillage. O2 said it had plugged the leak as of 14:00 GMT Wednesday.
“Technical changes we implemented as part of routine maintenance had the unintended effect of making it possible in certain circumstances for website owners to see the mobile numbers of those browsing their site,” it explained.
The UK's Information Commissioner is looking into the incident, and O2 said it had been in contact and would cooperate fully with any inquiry. It has also made a call to Ofcom to offer what one would assume to be a grovelling apology.
The problem occurred with O2 bundling in phone numbers of 3G users to websites that were visited – but this didn’t affect Wi-Fi users. The number appeared in an x-up-calling-line-id line and was storable by the site, although there are no reports yet of anyone being contacted. ®
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
COMMENTS
So, Phorm's offspring has gone mobile, then?
Given that Phorm-style technology can work both ways, a careful read of the article would seem to indicate so: According to the article, O2 customers who were surfing the web on their phones via Wi-Fi were not affected, but those who were surfing through the O2 network were affected.
Given that two given HTTP requests to identical static URLs/pages hosted by the same web server should be semantically identical, the fact that they are not indicates that O2 is doing some on-the-fly request header rewriting.
So if O2 is rewriting outgoing requests, how do we know that it's not rewriting inbound responses?
"Unintended" (alternative definition)
"We didn't mean to get found out"
So they do intend to give your number to certain people...
...just that they were caught doing it.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
