Comments on: Researcher: T-Mobile UK is secretly disrupting secure communications, leaving customers vulnerable to spying

By: Daniel Meah

Daniel Meah — Sat, 14 Jan 2012 15:34:00 +0000

There not blocking openvpn via TCP, infact am using it now.

By: TranslatedWebEn

TranslatedWebEn — Thu, 12 Jan 2012 22:04:00 +0000

Hello,
one of our translators has translated this article into Spanish, we hope that this translation will serve to support the spread of this information. Regards.
http://www.translatedweb.com/es/translated/t-mobile-en-reino-unido-esta-interrumpiendo-secretamente-comunicaciones-seguras-dejando

By: taras

taras — Wed, 11 Jan 2012 21:20:00 +0000

Must be a different T-Mobile UK to the one I’m on.

I’ve been on PAYG with them for years, always get extremely good speeds for data, and always get a 2+ Mbit HSDPA connection at my folks’ house out in the countryside, where even the landline broadband maxes out at 0.5 Mbit.

By: Ito Kagehisa

Ito Kagehisa — Wed, 11 Jan 2012 20:29:00 +0000

Yeah, I’m sure you’re right, but organizations like Comcast are so short-sighted they routinely pass up titanic profits next week in order to make a tiny profit this very minute. For example, they are too cheap to hire a serious crew of highly-paid network architects, so the very few smart people they have are overworked and underpaid, so they fail to maximize the profit-making potential of the network.

By: stumo

stumo — Wed, 11 Jan 2012 14:34:00 +0000

According to http://www.theregister.co.uk/2012/01/11/t_mobile_security/ there were 2 separate issues, both of which were oversights – and should be fixable.

Conspiracy or cock up? I could believe either…

By: dpg

dpg — Wed, 11 Jan 2012 01:31:00 +0000

I raised this issue on the T-Mobile “support” forums after I spotted I could no longer send TLS-secured email around October last year. After several weeks of banging my head against the wall and getting nowhere with the official technical support channels (and some unofficial ones), I can report that today they lifted the block on TLS handshakes. Hurrah!

The person I spoke to today told me the block was due to misconfigured equipment, and that the previous information I had been given about a deliberate policy being rolled out to combat spam was incorrect.

So, I’m not sure what the truth is or whether the publicity from Mike’s blog and elsewhere helped them find the misconfiguration, but it is “fixed” now.

The news isn’t so good for PAYG customers, though. T-Mobile are still blocking their SSL-secured SMTP on port 465 with TCP resets – which I can confirm – and Mike reports that OpenVPN over TCP is also being killed.

By: technogeekagain

technogeekagain — Wed, 11 Jan 2012 00:23:00 +0000

This is part of why I don’t want a smartphone. I want a phone, and a WiFi-enabled palmtop. It would be nice if they can communicate with each other to share phonebook info and the like — if you wanted to get really fancy, put bluetooth in the palmtop so it can act as a handset for the phone, so you don’t have to handle two devices — but I have absolutely no interest in sending data through the cellular network.

By: Brooklyn_Guy

Brooklyn_Guy — Tue, 10 Jan 2012 18:15:00 +0000

baby, meet bathwater.
nose, meet face.

By: awjt

awjt — Tue, 10 Jan 2012 17:41:00 +0000

It’s probably the inverse of them trying to screw you. Everything they do is protective of profits and there is no other motive. Inefficiency creeps in, but the actual DIRECTIVE is maximal profit.

By: Nathan Hornby

Nathan Hornby — Tue, 10 Jan 2012 17:34:00 +0000

To an equally bad one no doubt.

Mobile networks are like politicians; they’re all as bad as each other, just in different ways.

By: coffee100

coffee100 — Tue, 10 Jan 2012 17:22:00 +0000

So you expect a German company doing business with a British citizen in the UK

No. That's if this horseshit policy of theirs is limited to the UK, but nobody is stupid enough to believe that. Noted, though with some amusement how quickly people line up to leap to the defense of this company oh so deserving of the benefit of the doubt.

By: Bink Binkerson

Bink Binkerson — Tue, 10 Jan 2012 15:37:00 +0000

T-Mob UK has long dicked around with GPRS data. Their PAYG data service in the UK is SOOOO slow and spotty as to be nearly useless anyway. I would not dream of slapping a TCP-based tunnel over that, it would be absolutely worthless. The author is married to TCP VPNs, which suck under all but perfect conditions. GPRS, et al is always a crap environment for this.

By: Ito Kagehisa

Ito Kagehisa — Tue, 10 Jan 2012 15:33:00 +0000

One of the reasons I switched from comcast to FIOS for my Intertubes connection is that Verizon breaks my crypto connections a lot less frequently. I could set my watch by Comcast’s poisoning of secure traffic to my home systems – it hit every 30 minutes, reliably, on my segment.

Using Verizon, the disconnects are less frequent and less predictable, and they almost never touch pure SSH (port 22) traffic.

Invoking Ockham’s razor, I attribute the behaviour of large commercial network providers to greed, carelessness and incompetence, rather than malice. They aren’t actually trying to screw you, they just don’t care if they do.

By: Jim Nelson

Jim Nelson — Tue, 10 Jan 2012 15:06:00 +0000

So it sounds like they’re filtering based on an OpenSSL handshake – wonder what doing OpenVPN on port 443 would do. I’ve had to play port-based games for a long time – people with “clever” firewalls blocking all kinds of things, requiring tricks right out of the black-hat bible.

I’m so glad I don’t deal with hospitals any more.

By: retepslluerb

retepslluerb — Tue, 10 Jan 2012 15:01:00 +0000

I don’t care about the companies here.

However I do not care at all about the USA extending their reach by flimsy pretenses that they are involved.

By: Jason Thaxter

Jason Thaxter — Tue, 10 Jan 2012 15:00:00 +0000

USD$100 says that deep down it’s just on pay-as-you-go cards to make it easier to spy on da terrists who would use pay-as-you-go cards to avoid scrutiny.

By: dragonfrog

dragonfrog — Tue, 10 Jan 2012 14:40:00 +0000

Presumably the plaintiff would have to prove that the compromise happened on T-Mobile’s network, that it was carried out in a way that worked because of how they were forced to send the email by T-Mobile, and that they would have been sending email securely otherwise. All very difficult to prove.

By: dculberson

dculberson — Tue, 10 Jan 2012 14:38:00 +0000

So you expect a German company doing business with a British citizen in the UK to be subject to US law because the customer might connect to a US server? that’s as scary a stance as T-mobile’s! Actually, scarier!

By: Paul Hayes

Paul Hayes — Tue, 10 Jan 2012 14:36:00 +0000

I don’t get this today on my t-mobile contract SIM. I can talk SSL on 465 to my email server just fine. So I guess it’s just PAYG.

By: Modesty Tarnish

Modesty Tarnish — Tue, 10 Jan 2012 14:35:00 +0000

Oh, I was going to add, I did have problems with OpenVPN, although, I didn’t really play with it that much.
I just use VPN over SSH now.
Hamachi also appears to work, although, I don’t know how trustworthy hamachi is.

By: Modesty Tarnish

Modesty Tarnish — Tue, 10 Jan 2012 14:34:00 +0000

I can give some insight into this.
I use mobile data access a lot.
I have an old tmobile sim that I have had the sense to keep around, although, whenever I call regarding it the sales people beg me to change my plan attached to it.
It has the old unlimited data, and the “favorite fives” grandfathered in.
It also has the free “vpn plan”.
I don’t know if they still offer it, but, if you call them, and say that you’re having trouble using vpn for work, they’ll give you a special account that gives your phone an external IP address, and very little firewalling, so you can use PPTP.
It doesn’t cost extra.

That said, I’ve noticed, they now sniff for android (I think based on the IMEI number) and try to charge you more, based on what OS you use.
Of course, you can bypass it by changing the APN, but, it’s still very insulting.
What’s next, charging you a convenience fee for using Firefox?And, they don’t seem to mind if I use a hacked device running Android, and they will try to charge me if I have a typically android device running a different os.

By: awjt

awjt — Tue, 10 Jan 2012 14:30:00 +0000

I hate to say it, because it has problems all its own, but I am a huge believer in port 443… instead of all this IMAP injection/interruption nonsense.

By: coffee100

coffee100 — Tue, 10 Jan 2012 14:28:00 +0000

O rly? So this guy never connects to a server in the U.S.? T-Mobile doesn’t do business in the U.S.? This policy of theirs only applies to UK mail servers?

I love it how these multinational companies are such dick-waving hotshits when they are lecturing recent layoffs about global markets, but when they shit the bed somewhere suddenly they are a roadside fruit stand.

By: Adam Vollmer

Adam Vollmer — Tue, 10 Jan 2012 14:15:00 +0000

An ISP is limiting the competing services that can be performed on their network for a prepaid user who hasn’t signed up for their more expensive options? Why I never!

Seriously, how is this news?

By: Forkboy

Forkboy — Tue, 10 Jan 2012 14:13:00 +0000

Except when the US ambassador threatens to put you on their “naughty list.”

By: ffabian

ffabian — Tue, 10 Jan 2012 13:57:00 +0000

Wait a moment …. US law does not apply world wide? Shocking…

By: Phil

Phil — Tue, 10 Jan 2012 13:42:00 +0000

I’m going to guess that this is a cack-handed attempt to block spam from payg customers. Just shows that deep-packet inspection is off-the-shelf these days though.

By: retepslluerb

retepslluerb — Tue, 10 Jan 2012 13:16:00 +0000

Apart from the little fact that it happens in the U.K., I guess.

By: failquail

failquail — Tue, 10 Jan 2012 13:11:00 +0000

I was already considering changing from t-mobile, as their service has gone downhill since the orange merger. But this is the final straw, i’m definitely changing networks now.

By: coffee100

coffee100 — Tue, 10 Jan 2012 12:39:00 +0000

Title 18 U.S.C. section 2511 would seem to be applicable to this situation.