MMS leaks your photos online

[Anonymous]

As mentioned on this mailchannels.com, O2 have a rather major leak on their website, meaning anyone can access some customers photos and MMS messages without authentication. MMS messages are Picture Messages (Media Messages) that can contain images, video or audio.

Now MMS enabled phones are used much more frequently, O2 enabled a feature meaning that customers WITHOUT a MMS-capable mobile phone receive a text message informing them they can collect their message online, on o2's website.

You may assume that if you use this service to send a photo to a friend that your photo is protected and not broadcast for the entire world to see.

Unfortunately, O2's site has a fairly problematic bug meaning the images are only secured by a random passphrase.

After typing in your mobile phone number and PIN code, your web browser is given a 16 digit code, and this is the only code required to view images.

The URL for these images is protected by only a 16 digit HEX code. It would be quite easy to write a script to try various combinations of 16 hex digits to try and randomly view a photo but depending on how many photos are being hosted the hit rate could be quite low.

David at MailChannels has come up with a Google search which locates some of the images that could be found with this service:

http://www.google.com/search?hl=en&q=in ... N&filter=0

Worse still, the majority of the images taken on cameras turns out to be children. Ironically, O2 has a website dedicated to "Protect Our Children", well a good first step would be to avoid leaking customer photos.

I have reported the case to several agencies in the UK - including the ICO, Ofcom, O2 and my excellent local MP. Hopefully something will be done about this. In the mean time, please spread the news, and any advice you can offer would be excellent.
More information about this problem is listed at:

http://xcns.co.uk/o2/mmsleak.php

http://www.google.com/search?hl=en&q=in ... N&filter=0

and

http://blog.mailchannels.com/2008/07/o2 ... hotos.html

Thanks very much for reading this email, I look forward to any advice and any replies,

Dug Stokes with parts from Kirk Saywell and blog.mailchannels.com

[Anonymous]

Could be simply fixed by requiring authentication on the actual image result pages ... but O2 don't seem to care much about their MMS legacy platform, I've been trying to discuss various aspects of it with them for ages 😞

[Anonymous]

It'd be nice if they sent me text's telling me I had MMS, instead of just ignoring them....

[Anonymous]

This has just been posted on Slashdot too, so expect a lot more people being aware of this problem too:

http://search.slashdot.org/article.pl?s ... 19/0121228

Amazingly, as the posted - O2 haven't deleted my Forum Account this time (yet!), but I suspect they will soon, they deleted my last account ('dug') and deleted both the previous posts.

Luckily I posted this after they all went home

Oh, is anyone aware that e-mail doesn't work on PAYG and won't work on the iPhone either?

http://www.xcns.co.uk/o2

Thanks everyone for your comments.

[Anonymous]

Odd.. I've been emailing quite happily from my iphone on PAYG so far.

[Anonymous]

Oh, is anyone aware that e-mail doesn't work on PAYG and won't work on the iPhone either?
http://www.xcns.co.uk/o2
Thanks everyone for your comments.

Would be nice if they (and you) did some research before posting this rubish. Email works just fine on the iPhone with PAYG.

[Anonymous]

Weird, doesn't work on any other non-iPhone device such as windows mobile. I was just going by what Customer Services at O2 said.

Seems like O2 have managed to enable it for iPhone users but won't for any other user, such as those of us with Windows Mobile - aren't trusted with eMail unlike iPhone users.

Seems a tad unfair and discriminatory, O2.

(Watch as this forum post gets deleting in 3... 2... 1...)

[Anonymous]

It'd be nice if they sent me text's telling me
Odd.. I've been emailing quite happily from my iphone on PAYG so far.

[Anonymous]

sounds good to me