Subscribe

Vodacom leak overstated

Nicola Mawson
By Nicola Mawson, Contributor.
Johannesburg, 30 Oct 2014
Vodacom has fixed a security flaw that left some users vulnerable.
Vodacom has fixed a security flaw that left some users vulnerable.

Vodacom has denied media reports that it is providing information that identifies subscribers to every Web site they visit, and that it is selling its customers' information.

This comes in the wake of a MyBroadband report yesterday that claimed the cellular operator - SA's largest with 33 million subscribers - is providing cellphone numbers and unique device numbers to Web sites.

Subsequently, Times Live reported Vodacom had confirmed it supplies some information about its subscribers to some Web sites, and questioned whether the company was receiving any financial benefit from this.

Vodacom spokesman Richard Boorman concedes there were leaks in certain instances, but says this was limited and has been blown out of proportion. He explains the issue happened because the company ran a security update, but this has now been rolled back and a fix is being developed.

ITWeb has tested and confirmed that browser connections from a mobile phone using Vodacom's network appear to no longer leak the user's phone number or IMEI number to the remote site.

Boorman says information was sent in headers when subscribers made purchases that were debited to their bills. The update was run to ensure the wrong person was not billed.

Contrary to other reports, Boorman says Vodacom does not sell customer information to third parties. "At no point do we disclose personal information such as customer names, billing information or anything else along these lines."

(Testing undertaken by Jon Tullett.)

Share