One of Israel's largest mobile carriers left open a gap through which thousands of customers' personal messages leaked. According to an investigation published yesterday by TheMarker, Partner stopped holding a domain it had previously used to receive its customers' MMS, or picture, messages. An Israeli security researcher bought the domain and began receiving thousands of messages, some of them intimate and sensitive, along with information about the senders.
According to the report, the researcher contacted Partner and the National Cyber Directorate, but his reports were not acted on. The headline of the investigation quotes the reply he received: "The matter has been passed on to the relevant parties." According to TheMarker, the gap was closed only after the newspaper approached the company.
How an abandoned domain becomes a leak
This problem is well known to security professionals, and it is more common than it seems. Old systems sometimes keep sending data to addresses the company no longer uses. When the company stops renewing a domain's registration, anyone can buy it, and from that moment everything still sent to that address reaches the new owner. In the case of MMS messages, that means photos and messages users never imagined a stranger would see.
The lesson for organizations is that cleaning up old infrastructure is also part of security. Before giving up a domain, make sure no system, supplier or device is still using it. Sometimes it is better to keep paying to register a domain you no longer need than to hand it to someone who might exploit it.
Open questions
It is not known how many customers were affected, how long the exposure lasted, or whether Partner or the Cyber Directorate will notify customers that their data was exposed. The case also raises a question about how reports from security researchers are handled: a researcher who responsibly reports a problem should get a quick response, not a generic reply that the matter has been "passed on".
Anyone still using MMS to send sensitive photos should consider switching to apps with end-to-end encryption, in which even the carrier cannot see the content.
