how does Facebook iOS app know the mobile carrier in its WebView User-Agent

Question

Today I was analyzing User-Agents in WebViews on different iOS apps, like Facebook and Twitter.

That's when you click a link in a post/tweet and it opens the in-app browser (still using the iOS browser engine).

I retrieved the User-Agent by writing a small PHP script that I put online:

echo "PHP HTTP_USER_AGENT: " . $_SERVER['HTTP_USER_AGENT'] . PHP_EOL;

And then you just create a new facebook post with that URL, i.e. http://mywebserver.com/get-my-ua.php - and open it in the in-app browser.

To my surprise, one particular User-Agent looked very interesting: from the Facebook app:

Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/603.3.8 (KHTML, like Gecko) Mobile/14G60 [FBAN/FBIOS;FBAV/133.0.0.11.22;FBBV/65438308;FBDV/iPhone8,4;FBMD/iPhone;FBSN/iOS;FBSV/10.3.3;FBSS/2;FBCR/Telekom.de;FBID/phone;FBLC/de_DE;FBOP/5;FBRV/0]

The beginning looks as usual, but the attachment is very interesting:

1. There is some kind of private IP included: 133.0.0.11.22 (I have censored the last 2 parts)
2. it knows the mobile carrier name! Telekom.de

I run the same thing on an iPad, which actually does not have a SIM card installed right now and runs on WiFi only, but for testing I had installed a SIM card months ago. The mobile carrier profile is still visible in Settings - General - About - Carrier - it remains there even after reboots.

I couldn't find any information on the web about it. The private IP seems boring (it's also the same on the iPad), but how on earth does Facebook get the mobile carrier name? I'd be surprised that's allowed in iOS apps, Apple seems to be very strict on leaking such data. Safari's User-Agent does not have such an attachment of course.

I'm pretty sure Facebook did not just use some geoip-location service like maxmind to look-up the IP and its ASN. Because 1) maxmind shows Deutsche Telekom AG for that mobile IP and 2) it will still show Telekom.de even when I use a WiFi which is not running Telekom at all.

You can switch WiFi on and off, disable mobile data, it will always show the same User-Agent. I think that's because the mobile carrier profile is still installed. But how does it get this information?

Here is the User-Agent from Twitter's in-app browser: Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_3 like Mac OS X) AppleWebKit/602.3.12 (KHTML, like Gecko) Mobile/14G60 Twitter for iPhone

Both the iPhone and the iPad have the latest apps installed, aswell as the latest iOS 10.3.3.

Answer 1

The mobile carrier is available in the SIM info that iOS provides. Here's what I have:

#import <CoreTelephony/CTTelephonyNetworkInfo.h>

@property (nonatomic, strong) CTTelephonyNetworkInfo* networkInfo;

- (void)setup
{
    self.networkInfo = [[CTTelephonyNetworkInfo alloc] init];
}

- (NSString*)simCarrierName
{
    return [networkInfo subscriberCellularProvider].carrierName;    
}

- (NSString*)simIsoCountryCode
{
    if ([[networkInfo subscriberCellularProvider].isoCountryCode length] == 2)
    {
        return [[networkInfo subscriberCellularProvider].isoCountryCode uppercaseString];
    }
    else
    {
        return nil;
    }
}

- (NSString*)simMobileCountryCode
{
    if ([[networkInfo subscriberCellularProvider].mobileCountryCode length] == 3)
    {
        return [networkInfo subscriberCellularProvider].mobileCountryCode;
    }
    else
    {
        return nil;
    }
}

- (NSString*)simMobileNetworkCode
{
    return [networkInfo subscriberCellularProvider].mobileNetworkCode;
}