“I noticed that the responses from the network were extremely long, and upon inspection noticed that extra information from the recipient of the call was sent to the call initiator,” he told the Guardian.
This included normally private information, such as the cell ID, which is the current cell tower a caller is connected to; information about sim card, which could be used for a cyber-attack; and the phone model, which can be used to work out how to access it.
He believed that it was “possible this was used in the wild and not reported against” though there was no way to quantify that. If it had been that would be “quite a large problem”, as “there are situations where this data is extremely, extremely sensitive”, for example domestic abuse survivors or government workers, he added.
chrisjj•8mo ago
“I noticed that the responses from the network were extremely long, and upon inspection noticed that extra information from the recipient of the call was sent to the call initiator,” he told the Guardian.
This included normally private information, such as the cell ID, which is the current cell tower a caller is connected to; information about sim card, which could be used for a cyber-attack; and the phone model, which can be used to work out how to access it.
He believed that it was “possible this was used in the wild and not reported against” though there was no way to quantify that. If it had been that would be “quite a large problem”, as “there are situations where this data is extremely, extremely sensitive”, for example domestic abuse survivors or government workers, he added.