LOL! DOA!
Next: Signal app, method
From email to phone number, a new OSINT approach (2019)
11–20 of 127 posts
Re: From email to phone number, a new OSINT approach (2019)
#12Can someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...
Basically what they did was do password reset processes at a bunch of different services like PayPal, LastPass, Ebay.. yeadda yadda. He found that they all display different portions of a phone number. PayPal being the worst shows someone starting the reset process 5 digits. Most showed 2 or 3 but different portions.
So what he then did was essentially merge/correlate that data along with the area code and "exchange" (the part of number after area code) from sources like https://www.nationalnanpa.com/
Then he has a python script the queries (not sure how I didn't read the code, I'm assuming NOT through an API but who knows) the aforementioned services and somehow determines the likelihood of a number out of several hundreds being registered to an email or not. I kind of dozed off at the end so I can't explain that part very well.
edit: Why am I getting downvoted? This is literally what the blog is. My other comment is at the top.. lol. What a waste of my time giving an explanation. Ya'll like that low detail TechBrunch ChatGPT explanation more? Wild.
Re: From email to phone number, a new OSINT approach (2019)
#13Can someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...
Martin Vigo's article discusses the security vulnerabilities in password reset options for various websites and how these can lead to the exposure of personal phone numbers. Vigo highlights that during a password reset process, websites often partially reveal the user's phone number. This partial display varies across websites; some show the last four digits, others the first, and so on. By initiating password resets…
Awesome TLDR;
Thx!
Re: From email to phone number, a new OSINT approach (2019)
#14@dang please append (2019) to the title
Re: From email to phone number, a new OSINT approach (2019)
#15@dang please append (2019) to the title
Fair enough, I did so.
Re: From email to phone number, a new OSINT approach (2019)
#16Can someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...
Re: From email to phone number, a new OSINT approach (2019)
#17One thing I've always wondered is how security researchers feel justified in releasing tools like the one in this blog post to the public. I can almost certainly say that the number of bad or creepy uses for an automated email to phone number generating tool massively outweighs the good reasons for having one. Does he get a pass because he's doing this for "research" and it's a grey area anyways? Does he feel better because he talked to the companies who exposed the vulnerability and it's neutered now?
Re: From email to phone number, a new OSINT approach (2019)
#18Can someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...
Martin Vigo's article discusses the security vulnerabilities in password reset options for various websites and how these can lead to the exposure of personal phone numbers. Vigo highlights that during a password reset process, websites often partially reveal the user's phone number. This partial display varies across websites; some show the last four digits, others the first, and so on. By initiating password resets…
... just an email address, and publicly available information on the phone numbering system assignments + strategies.
Re: From email to phone number, a new OSINT approach (2019)
#19One thing I've always wondered is how security researchers feel justified in releasing tools like the one in this blog post to the public. I can almost certainly say that the number of bad or creepy uses for an automated email to phone number generating tool massively outweighs the good reasons for having one. Does he get a pass because he's doing this for "research" and it's a grey area anyways? Does he feel better…
I think there's a good ethical argument for releasing the knowledge, not so much the tool. I think the open secret is that most people who go into cybersecurity do so because they enjoy breaking security through clever methods rather than actually helping others stay secure.. but security research is legal and hacking random targets isn't.
Re: From email to phone number, a new OSINT approach (2019)
#20> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away.
For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US.
When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good way of sending/receiving carrier texts on the desktop (and before someone suggests the Google Messages web interface, it "forgets" my device too often for me to take it seriously). Occasionally, this can create a catch 22, where the VOIP blocking is implemented after the fact and prevents you from ever using the account again because the VOIP blocking was also implemented on the SMS 2FA.
And then there's services which don't even bother to check if they can actually reach a number before accepting it. Harris Teeter pharmacies, for example, will happily accept a VOIP number, but their system is unable to call or text VOIP numbers, so you never get your prescription notices. (And I'd bet this applies to all Kroger brands since they share a lot of systems.)