O2 VoLTE: locating any customer with a phone call

&gt; Attempts were made to reach out to O2 via email (to both Lutz Schüler, CEO and securityincidents@virginmedia.co.uk) on the 26 and 27 March 2025 reporting this behaviour and privacy risk, but I have yet to get any response or see any change in the behaviour.<p>This is really poor. And why is a Virgin Media address the closest best thing here? <a href="https:&#x2F;&#x2F;www.o2.co.uk&#x2F;.well-known&#x2F;security.txt" rel="nofollow">https:&#x2F;&#x2F;www.o2.co.uk&#x2F;.well-known&#x2F;security.txt</a> should 200, not 404.<p>To be clear, I have no problem with disclosure in these circumstances given the inaction, but I&#x27;m left wondering if this is the sort of thing that NCSC would pick up under some circumstances (and may have better luck communicating with the org)?

O2 <i>used</i> to have a responsible disclosure address - but they removed it a few years back.<p>When I worked there (many years ago) the security team was excellent. When I emaileld them about an issue last year, they were all gone.

The really interesting part of this issue is, that under most jurisdictions it probably won&#x27;t even qualify as hacking. The data is sent out by the network voluntarily and during normal use.<p>There are no systems at any point tricked into revealing personal data, which is often illegal, even if the hack is trivial. Even appending something like &quot;&amp;reveal_privat_data=true&quot; to an URL might be considered illegal, because there is clear intent to access data you shouldn&#x27;t be allowed to access. In this case none of that is done.

The wild part: this isn’t a theoretical bug. It’s implementation laziness that other UK networks already solved, as the post notes. ECI leaks have been called out since LTE rolled out—see papers like <a href="https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;2106.05007—and" rel="nofollow">https:&#x2F;&#x2F;arxiv.org&#x2F;abs&#x2F;2106.05007—and</a> automated location mapping is trivial given open mast DBs.

O2 has claimed that the problem is now fixed: <a href="https:&#x2F;&#x2F;www.ispreview.co.uk&#x2F;index.php&#x2F;2025&#x2F;05&#x2F;o2-uk-fixes-volte-flaw-that-exposed-user-mobile-location-data.html" rel="nofollow">https:&#x2F;&#x2F;www.ispreview.co.uk&#x2F;index.php&#x2F;2025&#x2F;05&#x2F;o2-uk-fixes-vo...</a>

Also very curious how the call initiator was able to see the call control messages (ie SIP). Arent all these messages wrapped inside an encrypted GRE tunnel between handset and cell tower (and MME)? Being able to unpick GRE tunnel encryption would be a gigantic hole. Perhaps this only works because the OP is running analysis on their device, but even then I&#x27;m surprised that the pre-encryption payload is available.

Seems to be a serious problem. It&#x27;s not that hard to root a phone, install NSG, and look at this info. O2 is also the largest mobile network in the UK and they have contracts with the government...<p>It&#x27;s disappointing that they didn&#x27;t reply, but I&#x27;m not surprised. O2 seems to be a mess internally. Anything that can&#x27;t be fixed by someone at a store takes ages to fix (eg: a bad number port). Their systems seem to be outdated, part of their user base still can&#x27;t use VoLTE, their new 5G SA doesn&#x27;t support voice and seems to over rely on n28 making it slow for many, their CTO blogs about leaving &quot;vanity metrics behind&quot;[0] even though they are usually the worst network for data, etc.<p>[0] <a href="https:&#x2F;&#x2F;news.virginmediao2.co.uk&#x2F;leaving-the-vanity-metrics-behind-and-focusing-on-what-matters-customer-experience&#x2F;" rel="nofollow">https:&#x2F;&#x2F;news.virginmediao2.co.uk&#x2F;leaving-the-vanity-metrics-...</a>

I’m not sure how O2 are still in business - they’re the worst network by far, even Three with their diabolical backhaul situation is better. Only reason I have an O2 SIM along with my EE one is for Priority tickets&#x2F;signal inside their venues

So giffgaff,who also use the O2 network, claim that they are unaffected as they have their own implementation of the service on top of O2s physical network. Which might be true, but I&#x27;m a bit suspicious as I know they are actually owned by the same company now,so consolidation is likely. If anyone tries replicating this on a giffgaff sim it would be good to know the result...

Could you mitigate this by turning off VoLTE? I can see docs online for turning it off on an iPhone 11 - but my iPhone 15 doesn&#x27;t have that option!

I don’t know anything about IMS but I assume they have to stay on the call long enough for the debug headers to be sent (like the tracing the call thing in every spy movie but real) and if that’s the case can this be mitigated by “just”* not answering calls from unknown numbers?<p>*yes I’m aware that means people you know who have your number could also exploit this

I’m curious to see if this exists on O2 in NZ. I switched to them last week because they do free roaming in Australia, and VoLTE calls.

According to GDPR this is clearly illegal. I am pretty sure their subscriber contracts don&#x27;t contain consent for sharing your location to any caller.<p>Now UK has left the EU so GDPR does no longer apply. But it is my understanding they have not changed any fundamental principles in whatever applies now?