A brief recap... Most websites have a search function. If you search for something which cannot be found, the site will often say "No results found for XYZ."

If we can convince the search engine to spit out HTML, we can inject malicious content into the page.

This is usually done by searching for something like <script>alert("h4X0r");</script>
Three's website detects script elements as hostile and refuses to serve them back.

But, curiously, it does allow some HTML elements through. The <u> underline element, for example.

It wouldn't allow <img> or <video> or most other troublesome content. But I was surprised to see it let through SVG (Scalable Vector Graphics). This means some minor naughtiness can be had!

Doing a search for

<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 128 128" width="128px"><circle cx="64" cy="64" fill="#006add" r="64"/>

Results in a big blue circle being drawn on the page. ...and that's when I stopped and tried to find someone to report it to!

Why is this a problem?

Drawing a circle is not malicious. But SVGs are complex. They can store intricate graphics.

Because the search parameter is sent in the URL - http://www.three.co.uk/Search/?q=<svg... - it would be easy for a spammer to send a message saying "Click here for great deals on Three!!!" and then use the SVG to draw a graphic encouraging the hapless user to visit a malicious site.

Or they could create a form to phish users' details. Or... Well, use your imagination.

Reporting it to Three

*sigh* Three don't publish any security contact details. Nor do they participate in any bug bounties that I could find.

I reached out to my friends in the mobile industry - because I didn't have much faith in reporting it via Twitter...

Kieran

@REALSgtBrdStk

Replying to @ThreeUKSupport@ThreeUKSupport your site "three.co.uk" is showing up as 'Not Secure' and there's no valid SSL Certificate for the site. So it will appear as this. pic.x.com/0trepindah

---

ThreeUKSupport

@ThreeUKSupport

Replying to @REALSgtBrdStk@REALSgtBrdStk don't worry, if you go to any pages where you need to enter any personal details or sensitive info the webpage will be https secure ☺🔐 >KH

---

Eventually a friend of a friend sent me a security email address which Three do not publicise. I fired off a quick disclosure and was pleasantly surprised at how seriously they took the issue.

Timeline

• 2019-08-22 - Discovered and disclosed. Got a reply in under an hour that it was being looked at and that a 90 day disclosure was fine.
• 2019-09-20 - Three informed me the issue was fixed, which I verified. They offered to send me a token of their appreciation in lieu of a formal bug bounty.
• 2019-09-22 - Bug Bounty delivered! Big ol' box of chocolates!

The first time a customer holds your product in their hands should be a moment of joy. Something to reinforce the notion that they have been wise with their investment.

I'm going to walk through an example of a poor unboxing usability, in the hope that it will show you what not to do.

This is the Three Home Signal Box - it is a femtocell to improve reception at home.

It arrived in a fairly anonymous postal sack, and has an easy to open box.

Knowing that the audience aren't likely to be technical, it comes with some reassuring messages on it. Good!

This is, of course, a lie.

The instruction card is a little boring, but does the job.

Just plug in the cables! Easy. There's even a picture guide. So, I followed the instructions, plugged in the cables, but nothing worked.

I checked the packaging. There was a warning sticker on there - obviously added after the box was printed. Revisions to packaging in response to customer feedback is sometimes necessary. A slightly ugly hack, but better than nothing.

I checked the flashing lights on the unit. Then re-read the instructions. The very last troubleshooting tip is check that the SIM card is inserted.

What SIM card? This was all that was in the box.

I retrieving the postal sack from the bin. This is what I found inside:

I've no idea why there's a spare PAYG SIM there - or how many people get confused and put the wrong SIM in. But I do know that this is a crappy way to bundle necessary equipment.

Ideally, this is what Three should do:

1. Pre-install the SIM.
2. If they can't, put the SIM in the same box as the device.
3. Make sure the instructions tell people to plug in the SIM before they attach the cables.
4. Stick some instructions on the back of the box, perhaps.

To be fair, once I'd found the SIM, it did tell me what to do with it. Well, I say that. It didn't tell me that I had snap the SIM from the holder. But the instructions on the card's packaging say "For more instructions, see the getting started guide." The same guide that doesn't mention you need to install the SIM!

There is, of course, nothing on the Three website relating to this problem.

Usability testing isn't finished until the user has the product in their hands and have successfully set it up. I've no idea how may dejected customer service agents are giving an exasperated sigh of "and have you put the little green card in the box?"

Make it easy. Make it right.