topic MMS leaks your photos online in Discussions & Feedback

MMS leaks your photos online

Anonymous — Wed, 20 Jun 2012 08:07:45 GMT

As mentioned on this mailchannels.com, O2 have a rather major leak on their website, meaning anyone can access some customers photos and MMS messages without authentication. MMS messages are Picture Messages (Media Messages) that can contain images, video or audio.

Now MMS enabled phones are used much more frequently, O2 enabled a feature meaning that customers WITHOUT a MMS-capable mobile phone receive a text message informing them they can collect their message online, on o2's website.

You may assume that if you use this service to send a photo to a friend that your photo is protected and not broadcast for the entire world to see.

Unfortunately, O2's site has a fairly problematic bug meaning the images are only secured by a random passphrase.

After typing in your mobile phone number and PIN code, your web browser is given a 16 digit code, and this is the only code required to view images.

The URL for these images is protected by only a 16 digit HEX code. It would be quite easy to write a script to try various combinations of 16 hex digits to try and randomly view a photo but depending on how many photos are being hosted the hit rate could be quite low.

David at MailChannels has come up with a Google search which locates some of the images that could be found with this service:

http://www.google.com/search?hl=en&q=in ... N&filter=0

Worse still, the majority of the images taken on cameras turns out to be children. Ironically, O2 has a website dedicated to "Protect Our Children", well a good first step would be to avoid leaking customer photos.

I have reported the case to several agencies in the UK - including the ICO, Ofcom, O2 and my excellent local MP. Hopefully something will be done about this. In the mean time, please spread the news, and any advice you can offer would be excellent.
More information about this problem is listed at:

http://xcns.co.uk/o2/mmsleak.php

http://www.google.com/search?hl=en&q=in ... N&filter=0

and

http://blog.mailchannels.com/2008/07/o2 ... hotos.html

Thanks very much for reading this email, I look forward to any advice and any replies,

Dug Stokes with parts from Kirk Saywell and blog.mailchannels.com

MMS leaks your photos online

Anonymous — Fri, 18 Jul 2008 20:38:07 GMT

Could be simply fixed by requiring authentication on the actual image result pages ... but O2 don't seem to care much about their MMS legacy platform, I've been trying to discuss various aspects of it with them for ages 😞

MMS leaks your photos online

Anonymous — Sat, 19 Jul 2008 06:58:43 GMT

It'd be nice if they sent me text's telling me I had MMS, instead of just ignoring them....

Just posted on Slashdot

Anonymous — Wed, 20 Jun 2012 08:07:42 GMT

This has just been posted on Slashdot too, so expect a lot more people being aware of this problem too:

http://search.slashdot.org/article.pl?s ... 19/0121228

Amazingly, as the posted - O2 haven't deleted my Forum Account this time (yet!), but I suspect they will soon, they deleted my last account ('dug') and deleted both the previous posts.

Luckily I posted this after they all went home

Oh, is anyone aware that e-mail doesn't work on PAYG and won't work on the iPhone either?

http://www.xcns.co.uk/o2

Thanks everyone for your comments.

MMS leaks your photos online

Anonymous — Sat, 19 Jul 2008 08:00:16 GMT

Odd.. I've been emailing quite happily from my iphone on PAYG so far.

Re: Just posted on Slashdot

Anonymous — Sat, 19 Jul 2008 08:06:00 GMT

Oh, is anyone aware that e-mail doesn't work on PAYG and won't work on the iPhone either?
http://www.xcns.co.uk/o2
Thanks everyone for your comments.

Would be nice if they (and you) did some research before posting this rubish. Email works just fine on the iPhone with PAYG.

MMS leaks your photos online

Anonymous — Mon, 21 Jul 2008 07:34:50 GMT

Weird, doesn't work on any other non-iPhone device such as windows mobile. I was just going by what Customer Services at O2 said.

Seems like O2 have managed to enable it for iPhone users but won't for any other user, such as those of us with Windows Mobile - aren't trusted with eMail unlike iPhone users.

Seems a tad unfair and discriminatory, O2.

(Watch as this forum post gets deleting in 3... 2... 1...)

MMS leaks your photos online

Anonymous — Sat, 06 Mar 2010 09:56:58 GMT

It'd be nice if they sent me text's telling me
Odd.. I've been emailing quite happily from my iphone on PAYG so far.

MMS leaks your photos online

Anonymous — Mon, 31 May 2010 04:40:04 GMT

sounds good to me