Screwing Local Telecommunication Service
Monday, October 31st, 2005The biggest local telephone company in my country (lets call it X) had the option to search for personal details of its users by using their phone number. This was accesible from both web interface and through an SMS request. Recently though they changed their privacy policy. The new policy stated the following:
Αναστολή της λειτουργίας του πεδίου έρευναςμε αριθμό τηλεφώνου σύμφωνα με τον περί Προστασίας Δεδομένων ΠροσωπικούΧαρακτήρα Νόμο 138(Ι 2001)
In English it simply says that the this feature was disabled due to a new law about personal privacy!
The challenge was to get the info that i wanted no matter what were the laws..besides, laws and rules are made to be broken (:
Anyway X removed this functionality but the implementation on their servers is still there. So i did some research using some underground tools called..erm..’the Internet‘ and found what i was looking for! It was right there as if they wanted me to find it (: Their JavaScript code was easy enough to read but useless since the functionality was disabled. It just help me to understand how their system worked. I then tried retrieving the info using a simple form and voila! I could get fullname and exact location of any phone number without even using the big green phonebook! Then Iacovos helped me some of his l33t PHP skills and we created a PHP script that would retrieve all the required info and drop the garbage. It works like a charm now!
Another service exploited succesfully!
Update 01/11/05: I added this script to my blog! Created a page using AJAX to retrieve the info.

