Just saw this website via Twitter, tested it and sure enough my phone number is being sent to every website that I visit.
For people that aren't familiar with HTTP headers: when you visit a web page, the device that you're using sends some important information which defines the request and receiving of the web page. The headers sent usually include things like what character sets and encoding your device supports, what browser it is running, and so on.
For example, the headers that my computer sends when requesting a web page are as follows:
Host: lew.io
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.75 Safari/535.7
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
X-Forwarded-For: 188.223.231.XXX
Browsers can send any HTTP header that they like though, and certain companies use non-standard headers, which usually start with the letter X to signify this. The most common non-standard header is "X-Forwarded-For", which is often used when you're using a proxy and it forwards your request. The "X-Forwarded-For" header will be followed by the IP address of the original device that requested the page.
Yesterday, it was discovered that O2 - and subsequently giffgaff - include a non-standard header in all of your requests to websites. This header is added by their proxy (in addition to the X-Forwarded-For header). The header name is "x-up-calling-line-id" and O2 appear to be the only ones using this title, but evidence could emerge in the future to show otherwise.
The headers that my phone sends to request a web page follow:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.3; en-gb; Nexus S Build/IML74K) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Accept-Encoding: gzip,deflate
Accept-Language: en-GB, en-US
Accept-Charset: utf-8, iso-8859-1, utf-16, *;q=0.7
x-up-calling-line-id: 447949425XXX
Host: lew.io
X-Forwarded-For: 82.132.248.XXX
In the examples in this post, I have replaced the last three digits of my IP addresses and phone number in order to protect my devices!
To be clear, each time you request a web page on your phone, your phone number is sent to the server. This is an extremely important issue: HTTP headers are often logged by servers (and logs are kept for a long time), and it would be trivial for a server administrator to extract a list of phone numbers from the logs.
If you're still not seeing the security implications, about 99% of people sending their number to every web page are on O2, so someone could easily extract a list of numbers and call them pretending to be O2. They might get caught out by a few giffgaff users and Tesco Mobile users (who I assume are also affected).
Another scenario: you visit the website of a company that offers laser eye surgery (for example). That company now have your phone number, and could easily bombard you with calls trying to sell you their services.
Finally: you might find these scenarios unlikely, but now that this problem is out in the open, word will spread. That's not to say that criminals and shady companies weren't already aware of it though.
