o2 – Terence Eden’s Blog

O2 UK's Weird MSISDN Lookup API

@edent — Mon, 04 Mar 2024 12:34:15 +0000

It's always fun keeping your network inspector tab open. While looking around the O2 UK website, I found this page all about eSIMs. For some reason, it wants to know the user's phone number.

I put in a random number, and it refused to let me in.

Putting in a genuine O2 number let me through. So what is it doing to validate numbers?

It is making an API call to this URl:

https://www.o2.co.uk/o/customer/mods/lookup/447700900123

After a bit of testing, this is how I think it works.

If you give it an O2 phone number, it replies with:

{"type":"ONE"}

If you give it a number which isn't on O2, it gives:

{"type":"ZERO"}

A number it doesn't recognise gives:

{"message":"Unable to find the requested resource."}

A malformed or incomplete phone number gives:

{"message":"Something's wrong. Please try again later."}

Responsible Disclosure?

As far as I can tell, O2 no longer have a Bug Bounty or Responsible Disclosure offering. So I'm publishing it here to let people know.

It is possible that someone could use this API to disclose a (minor) piece of personal information about you - namely whether your phone number is on O2 or not. I don't think that's particularly sensitive, but it is probably worth knowing.

Responsible Disclosure: Abandoned Buckets and Billing Emails

@edent — Mon, 27 Feb 2023 12:34:21 +0000

A few weeks ago, I received a billing email from my phone provider O2⁰. While glancing at it, I noticed all the images were broken.

Viewing the source of the email showed that they were all coming from http:// mcsaatchi-email-preview.s3.amazonaws.com/o2/...

What happens if we visit that domain?

Ah, the dreaded "The specified bucket does not exist" error. At some point the images were served from that domain but someone deleted the bucket.

This is a problem. Amazon doesn't reserve bucket names after they're abandoned. Which means digital miscreants can claim them.

Imagine if, say, Vodafone¹ registered that bucket name. All of a sudden they could inject their logos or adverts into their rival's billing emails.

An attacker could go further. They could replace the images with ones saying "Please note our bank details have changed, send BitCoin to...."

It gets worse. The emails contain a link to an external font.

An attacker could craft a font with specific ligatures which would replace the text of the email!

I quickly defensively registered the bucket on AWS and sent an email telling O2's security team about the problem. I suggested they update their future emails. Of course, that doesn't help all the emails which have been already been sent and are lingering in their customers' inboxes. So I offered to transfer the bucket name back.

I received an automated response saying they'd look in to it.

Lessons you should learn

You should be very wary about hosting your critical infrastructure on a sub-domain outside of your control. And you should never point directly to an S3 bucket if you can help it.

Ideally, O2 would have spun up a domain like images.billing-emails.o2.com, pointed it to S3, and used that in their emails. That way, if they decided not to continue using Amazon's services, all their existing billing emails would be unaffected.

If an attacker gets control of a domain used to show images in emails, the can directly target your customers.

Timeline

2023-01-26 Issue detected. Defensively registered. Email sent.
2023-02-21 Reminder email sent informing them that I'd be publishing this post.
2023-02-22 O2 said they were investigating and asked me to delete the bucket, which I did. They swiftly reclaimed the bucket and repopulated its content.
2023-02-27 Blog post automatically published.

No bug bounty, but O2 did raise my bill by 17.3%…

My (very) former employer. ↩︎
Another of my (very) former employers. ↩︎

Can You Power an iBeacon with a Lemon?

@edent — Thu, 27 Mar 2014 12:34:08 +0000

This is a necropost - resurrected from the now defunct blog of a previous employer. Sadly, most of the photos have fallen down the memory hole. So use your imagination.

Energy efficiency is the next battleground for electronics. As the price of electricity soars, people will become less and less enamoured with charging their devices every single day. Even if cold-fusion brings us unlimited free energy - plugging your gadgets into a wall just seems so primitive!

That's where BlueTooth Low Energy (BLE) comes in. It's an ultra low powered transmitter which can be found in FitBits, iBeacons, pacemakers, and all sorts of other devices.

The key, as per its name, is that it uses very little energy. A simple watch battery should be enough to power an iBeacon for a year.

When Life Gives You Lemons…

Today was one of The Lab's regular hackdays. We challenge ourselves to spend a day playing with new technology, trying to get it to do something interesting.

I'm sure you remember from school building a simple power source using a lemon or potato. Zinc plated nails, copper wiring, an acid source, and - hey presto - a lightbulb comes on.

So, can we harness the awesome power of fruit to bring life to a little iBeacon?

We used RedBear Lab's BLE Mini board. It can be powered via USB (boring!) or via a direct electrical contact on the back.

Better BlueTooth Through Chemistry

It's been ages since any of us in The Lab did basic physics and chemistry at school, so we turned to the Mighty Internet for help.

With three lemons wired in parallel, we got approximately 0.5 Volts and 120μAmps.

According to Red Bear's support forum, we'd need about 3 volts and 340μAmps.

With 6 lemons, we were at ~200μAmps, closing in on the figure we needed.

It occurred to us that we may need to construct some kind of super-fruit mega battery in order to get the voltage up as well. I really wish I'd paid more attention in GCSE physics. Sorry Mrs Perkins…

10 is the Magic Number

With 10 C. limon in parallel, we hit 369μAmps! Perfect!

That still wasn't enough to get the BLE Mini board to power up - we needed to raise the voltage. But how?

Errr…. with difficulty…! Turns out it's really frickin' hard to get enough power out of a bunch of lemons to power modest hardware.

So we did what any enterprising startup does - pivot!

Power Extreme!

Ok, so can our juicers deliver sufficient juice to act as an emergency battery for your smartphone?

We found the lowest powered phone we could - the GeeksPhone Keon - running FireFox OS.

In keeping with our fruit theme, we butchered an old BlackBerry charger - and got to work…

Wires stripped, plugged into our lemon battery… What was the result?

Errr… The square root of nowt! Nothing happened. The power wasn't high enough for the phone's charging circuitry to register anything.

We grabbed a Nexus 5, installed a power monitor widget, and tried again.

Ooooooh!

This is the very definition of trickle charging. The amount of energy from 10 lemons, zinc plated nails, and copper wire is just enough to give you a few more minutes of talk time - nothing more. In a MacGyver situation, you're probably better off squeezing the lemons into your enemies' eyes.

Lessons Learned

Hackdays are a great way of playing about with technology and having a bit of experimental fun.

It's temping to think BLE is so efficient that it can be powered from harvested kinetic energy and stray WiFi beams - that's not the case. Modern battery technology is pretty complex - and that's why tiny button cells can power modern electronics and a whole bunch of lemons doesn't even get close.

One of the reasons The Lab exists in O2 is to develop a culture of "Fast Failure". We didn't spend millions of Euros and half-a-dozen months in planning meetings, requesting proposals from suppliers, and updating PowerPoint decks to do this - instead, two of us spend half a day actually trying to build something and finding out pretty quickly that it wasn't going to work.

For those of you wondering just how much of your monthly bill we spent on this? The cost was a couple of quid for the nails and wire, and we had the multimeter already. The lemons cost £3.00 for 10. I wonder if I should have splashed out on organic ones…. ;-)

What's Next

It's possible to power Xmas tree lights from hundreds of Brussels Sprouts. Would it be possible to set up a "Charge your Apple with apples" stand at one of O2's larger stores? Sure! It could make a great marketing stunt - and teach people a little basic science - but, for now, I'll stick to my wall socket.

Toodle pip!

QR Codes on Energy Bills

@edent — Mon, 10 Mar 2014 14:09:57 +0000

This is a necropost - resurrected from the now defunct blog of a previous employer. Sadly, the follow-up post has fallen down the memory hole. You can still read Sharon's response to it.

Well, we can finally unwrap one of the little projects The Lab has been working on. Along with the Department of Energy and Climate Change we're aiming to stick QR codes on customers' energy bills.

The proposal has the grand name of: "A consultation on proposals to amend domestic energy supply licence conditions - requiring provision of key energy data in a machine readable format"

How Will It Work?

Customers will receive their energy bill as normal. Printed on the bill will be a QR code which lets the customer compare their usage, get energy efficiency advice, and potentially switch to a cheaper tariff.

You can read more on BBC News, The Guardian, Sky News, ITV News, MarketingWeek, The Drum and City AM.

This project has been gestating for a while - being first mentioned in the House of Commons in October 2012 - and is now being empowered via the Energy Act.

This is the first time The Lab has helped with such a stately project - and we certainly hope to do more of this sort of work in the future.

What Next?

We know that QR codes are divisive for some - but they remain the cheapest way to put complex information on a piece of paper. They don't require a proprietary app, and can be used even on really quite basic phones.

We'd love it if you were to respond to the consultation.

Credits

Terence Eden led this project, along with Lab Intern Yuan Phoon.

3D Printing at Over The Air

@edent — Wed, 02 Oct 2013 15:44:53 +0000

This is a necropost - resurrected from the now defunct blog of a previous employer.

We had an amazing time at Over The Air 2013. We’ve teamed up with ThingMaker to digitally scan attendees. Our long term aim is to release on GitHub a collection of faces which artists and game designers can re-use.

The definite highlight was scanning Annie, one of the veterans of Bletchley Park.

Our thanks also to Faberdashery who were able to supply us with filament for the 3D printer in exactly the right shade of blue for our logo.
I’m really looking forward to getting my hands on some of their glow-in-the-dark material.

Here are some of the great photos taken by us and our new friends. Special thanks to Rachel Clarke and Simon Kisner

Demoing BlipDrop at Mobile Monday London

@edent — Wed, 11 Sep 2013 16:01:15 +0000

This is a necropost - resurrected from the now defunct blog of a previous employer. I really loved the idea of geolocated ephemeral content. And I was a little disappointed that the business never saw the potential for it. Maybe I'll find a way to relaunch it in the future.

I’ve been attending Mobile Monday London for years. It’s a great (free!) way to meet people in the mobile industry, to learn about new trends, and to demo products.

Because I know so many people there, it’s always a bit nerve-wracking when I stand up to demonstrate some crazy new idea. Obviously I crave the approval of my peers but, more than that, I don’t want to look like an idiot in front of my friends.

On Monday, I gave BlipDrop its first public demonstration at Mobile Monday Demo Night. We’ve been running for a couple of days with a closed group of 10 beta users so I was eager to see what people thought of it.

I can really recommend getting involved in Mobile Monday. They offer some great free talks, and provide excellent opportunities for new and established businesses.

Massive thanks to Julia Shalet for all her organisational skills, and to Jo Rabin for being such an effective host – indeed, the whole team put on a fantastic event.

Are Megabytes Meaningless To Customers?

@edent — Thu, 04 Apr 2013 15:25:36 +0000

This is a necropost - resurrected from the now defunct blog of a previous employer..

youtube.com/watch?v=nTEqKd92kcI

Pop quiz: How many MB did you use watching that YouTube video?

When dealing with data usage, a familiar cry in the telco world is “Customers just don’t understand what a MB is!”

Is this true?

The theory goes something like this…

Some elements of a phone bill are easy to conceptualise.
Customers understand how many minutes they’ve used, texts they’ve sent, etc.
Telcos are able to explain the usage limits that apply to these elements of their customers’ tariffs.
Customers are happy because they know what to expect.

So far, so good. But now we move to data usage…

Data is fairly ephemeral.
There’s no way for customers to know how much data they are using.
Customers get angry and complain because they don’t know what a MB is and what it allows them to do.

It’s fairly easy for anyone to guess how long their last phone conversation was.
I’m fairly technical – I know the difference between my Megabyte and Mebibyte – but I couldn’t tell you how many MBs a paritcular YouTube video uses.

Is This A Problem?

There’s a very superficial solution to this problem – give everyone unlimited* data.
*Fair use policy applies, not between 9AM and 7:30AM, except weekends, terms and conditions apply, excludes P2P, VoIP cost extra, only on a 36 month contract, see back of pack for details.

Let’s assume, for now, that’s a little way off.

We have three questions:

Do customers understand what a MB is?
Can customers tell how many they have used?
How can Telcos educate their customers?

Does The Average Customer Understand?

No. I wish they did – hell, I wish I understood.
A recent article on the BBC goes some way to explain how widespread the confusion is.

This confusion spreads to the fixed line Internet world.

The New York Times conducted a brief survey which reflected just how hard it is to explain this to customers.

So, How Much Is A MB?

Try to visualise how much Internet usage 1MB is. Various providers in the UK have tried – and all produce fairly different estimates.
According to O2.co.uk:

Every 500MB of UK data will allow you to (approx):

Send 500,000 emails, without attachments

or send 1,000 emails, with photos attached

or visit 5,000 simple sites, like Twitter or your favourite blog

or visit 1,500 rich content sites, like bbc.co.uk, guardian.co.uk or yahoo.co.uk

or download 50 (low quality) or 12 (high quality) music tracks

or watch 60 YouTube videos, about 4.5 minutes long

According to Vodafone.co.uk:

Service	Usage	Average data size
TV	Watching a 30 min episode of a series	90MB
You Tube	Music Video – 4 mins	11MB
Radio App	10 mins	15MB
Facebook	15mins with no video streaming	5MB
Email	100 emails sent/received with no attachment	2.5MB
Email with photo or doc attachment	10 emails sent/received containing attachment	18MB
Web Browsing	100 web pages	20MB
Web Browsing	1 hour	26MB
Google Maps	10mins	6MB

Whereas Everything Everywhere talk about how much you can do in general.

A chat with a T-Mobile UK rep reveals that PAYG customers get “unlimited browsing – but a 500MB download limit.” Huh?

So, as clear as mud.

What Is Data?

One of the problems is that the amount of data a service uses changes over time. Recent studies have shown the average webpage now consumes 30% more data than it used to.

This is vividly illustrated by looking at Orange’s old data advice, which used to state.

1MB is approximately equal to:

160 wap pages
or viewing 20 web pages
or downloading 10 games
or downloading one high quality music track
sending around 100 short emails each containing up to 100 words
or sending/downloading up to four video clips

Reasonable enough in 2009 – but today you’d struggle to find 1 game – let alone 10 – that weighs in at under 1MB.

Even if we assume that users know that 1MB = 1024KB, and that YouTube uses roughly 1MB per minute, and that their emails are all under 1MB – they still don’t know what all the apps on their device are doing.

What if Angry Birds decides to download new levels? What if someone emails them a 10MB attachment? What if their DropBox app decides to upload all their photos?

How can anyone keep track?

Keeping Track

Modern versions of Android have a data use tracker hidden away in the menus.

The iPhone gives its users a slightly less detailed view.

But the problem with these is that the customer needs to make a conscious choice to view these apps.

In my decade in the mobile industry (not all of it spent at Telefonica!), I’ve tried half a dozen different ways to help customers understand their usage.

I was involved in a crazy plan to bill users by time. With the rise of background data usage, that died an ignoble death.
One company tried to sell me a system which would charge for web browsing, but not for email.
I looked at artificially slowing down data once a certain cap was reached.
We investigated charging for separate services – YouTube is £X per month, Facebook is £Y per day etc.
Using operator apps and portals which would give a real-time summary of where all your data allowance had gone – YouTube was 50MB today, Facebook 3MB this week etc.
Sending reminder texts to customers to inform them of their usage.

All these services exist throughout the world. All of these services fail at their primary purpose – educating customers. They serve only to confuse customers and obfuscate the process by which they are billed.

I’ve come to the conclusion that it’s impossible – even for a committed geek like me – to understand data usage in the same way that call and text usage is intuitively understood.

I know that my minutes have gone down because I placed a call to my mother. I have no idea when my PodCast client decides to kick off a download – nor how much data it is using by doing so.

What we need to do is constantly inform customers of how much they’re using and how much of their allowance they have left. Either daily or weekly alerts – or when they’ve used 10%, 25% of their allowance.

An interesting alternative is Vodafone UK’s Data Test Drive. They give customers 3 months of unlimited data – at the end of the trial, Vodafone tells the customer how much data they used on average. The goal being that the customer can then make a more educated choice of tariff based on experience of “regular” data usage.

Until we can give every user unlimited data (at what speed? With “fair use”? Domestic or international?) we need to clearly communicate to users what they’re using and how much they have left.

What do you think? Would you appreciate a regular SMS telling you how many of these ethereal data packets you’ve used? Or is there a better way?

Fairwell InMobi - Hello Telefónica!

@edent — Fri, 20 Jul 2012 15:30:13 +0000

Sixteen months ago, I climbed a rattly staircase behind a restaurant to a fairly typical "start-up loft". My first taste of InMobi. I was enthralled! I've spent the last year driving the developer relationship process in the company, watching as we've grown from 15 people in a small room to 70 people in swanky London offices on the Strand.

InMobi has sent me all over the world - South Africa, San Francisco, Romania, Barcelona, Bangalore, Cologne, and Bath!

It has been an amazing adventure, working with some incredibly talented people. I've been challenged and stretched, I've presented in front of hundreds of people, launched the first RCS-e enabled adverts, started up blogs, wikis, and forums, and - most importantly - helped developers make money from their apps.

It's been a very busy year-and-a-bit! So now it's time for a change! Come August, I'll be beavering away in O2's The Lab. I've been consistently impressed with the way Telefónica has been innovating - and the presentations from their geeks at events have been phenomenal.

I'll be working on new and interesting products which take advantage of Telefónica's network. No, I can't help you if your iPhone is broken.

No doubt it will be strange moving from a start-up to a behemoth. And it will be odd driving round the M25 rather than suffering South West Trains every day. But I'm looking forward to a brand new set of challenges, meeting new colleagues, working with old friends, and a chance to get my hands dirty!

As ever, this blog remains personal - but please adjust your bias filters appropriately.

#O2Fail - What You Need To Know About Mobile Phone Content Control

@edent — Thu, 03 Mar 2011 16:22:25 +0000

WARNING This article and pages it links to, contain information about pornography and sex education which may be offensive to Daily Mail readers. These are the hurried lunchtime writings of a chap with too much on his plate.

So, O2 has apparently angered the Internet Gods by switching on its Adult Content Filter. This means anyone who wants to look at adult material on the web will have to pay a fee to prove they are over 18. Of course, their filter is broken - so it's caught sites like Google Translate and B3ta and banned access to them. And, naturally, there's no easy way to unlock this bar without walking into an O2 store and shouting loudly and proudly "I LIKE MASTURBATING AND WOULD LIKE MY PHONE UNLOCKED SO I CAN LOOK AT PORNOGRAPHY AND MASTURBATE. And then translate it into Russian via Google Translate."

I've written before about censoring the web. I also used to work for a Mobile Network Operator looking after, in amongst everything else, adult media. You can watch my video from SMC London discussing how (some) MNOs approach adult material. I think it's fair to say I know a little bit about this subject.

In my attempt to educate the world, let me explain some things about mobile Internet filters.

There are only five things you need to know...

Government Isn't Involved

There is no government regulation, nor law telling mobile phone operators they have to block adult content. The government has said "Regulate yourselves, or we'll impose regulation upon you."

This is a fairly common trick. You may have heard it expressed as "Nice business you've got there. It would be a shame if anything ... happened to it..."

But, as we will see, it's not just the threat of red tape that keeps people up at night.

Fear Is A Great Driver

What every MNO live in fear of, is the Daily Mail headline which runs...

PERVERTS! Now Sick Mobile Phone Bosses Peddle Porn To YOUR CHILDREN (and you have to pay for it!)

That's it. Game over. Share price plummets, you lose your job, your name's in the papers and you lose your kids in a custody battle. Fear drives people to be ultra-conservative even when they realise what they are doing is irrational.

This Isn't Porn

I know what you're thinking. That's a porno-shot of Linda Lusardi. Obviously, that's unsuitable for children.

You could not be more wrong. Ever since 17th November, 1970 - when The Sun published a nude photo of Stephanie Rahn - shots like this have been counted as "family friendly".

Essentially, Rupert Murdoch doesn't run a porn empire - therefore, anything which appears in The Sun is family friendly. And if you try to classify it under "Adult" they'll sue the arse off you. Allegedly.

Simply put: porn isn't porn when it appears in The Sun. That's why most UK MNOs don't block page three - indeed, it's why they're quite willing to sell soft-core pornography to anyone, regardless of age.

The hypocrisy of the tabloid media is quite something to behold.

This Is Banned

Campaign's like Brook's Sex Positive often fall foul of automated content checking. Because they have words like "vagina", "orgasm", and "contraception" - it's easy for computers to get confused and think that they are porn.

So, kids can see topless women but they can't learn how to put on a condom. Helpful.

It Doesn't Work

There are two things which regularly fail with censoring.

False Negative. You can't catch every dirty image on the Internet.
False Positives. It's easy to misclassify "safe" sites as "bad" sites.

Conclusion

Wanking is legal in this country. There's no good reason why anyone should have to go on record as saying that want to look at wobbly bits.

Because it's easy for a kid to find a site that isn't blocked - or to "borrow" mum or dad's credit card - it's of no serious concern to the intrepid kid. It does suck if they want to find out how not to get AIDS though.

So, we're stuck with a situation that's expensive for MNOs, embarrassing and annoying for consenting adults, and trivial for a child to bypass.

Everyone knows that mobile web censorship doesn't work. But it has to be done otherwise the media will get upset. If the press get upset - then you get upset. So it's all for your own good.