Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

From email to phone number, a new OSINT approach (2019)

martinvigo.com

Post reply on HN
Print view View original

91–100 of 127 posts

Re: From email to phone number, a new OSINT approach (2019)

#91

Post by DaiPlusPlus »

rsync wrote: post #79
miki123211 wrote: post #24

There's one missing piece in that article, and it's the CNAM database (US only). CNAM is the database that carriers use to give you alphanumeric caller ID ("SMITH JOHN" instead of "+1 (555) 123-4567"). Many carriers don't display this data as far as I believe, but most of them make it available. Querying that database isn't free, but you could probably find a way to do it for a few hundred numbers relatively cheaply.…

"Querying that database isn't free, but you could probably find a way to do it for a few hundred numbers relatively cheaply." /usr/local/bin/curl -s -X GET "https://lookups.twilio.com/v1/PhoneNumbers/$number?Type=carrier&Type=caller-name" -u $accountsid:$authtoken | /usr/local/bin/jq '.' I don't even know what it costs ... maybe a penny per lookup ? I forget ... It also shows carrier and whether it is a mobile or lan…

> I don't even know what it costs ... maybe a penny per lookup ? I forget ...

$0.01/lookup: https://www.twilio.com/en-us/trusted-activation/pricing/look...

Re: From email to phone number, a new OSINT approach (2019)

#92

Post by DaiPlusPlus »

b112 wrote: post #62
navigate8310 wrote: post #36

Earlier quoted context omitted.

Why is this not tied to a person's SSN (if possible)?

Why would a phone company know a person's SSN?!

> Why would a phone company know a person's SSN?!

As Brit-expat+US-resident (since 2012) T-Mobile got my SSN when I signed-up for my pre-paid first mobile phone plan in 2012. Paying $50/mo was quite a shock when equivalent (or rather: far superior) service was available in the UK on a PAYG (not even pre-paid!) basis for £10/mo.

...and now I'm on a $110/mo postpaid plan because eventually you get tired of the limitations and just grin-and-bear-it.

Re: From email to phone number, a new OSINT approach (2019)

#93

Post by DaiPlusPlus »

josephg wrote: post #67
RecycledEle wrote: post #46

Earlier quoted context omitted.

An objective observer would conclude PayPal only exists to cause security problems. I once called PayPal to report an "your account is suspended" phishing email and they angrily told me to follow the directions in the email.

My sister got married and changed her surname. PayPal has inexplicably also changed my surname to my sister’s new surname. I can’t for the life of me figure out why, or why they would do that without notifying me. At least no good reason. It’s the strangest thing. I haven’t even fixed it. I just stopped using PayPal because I don’t trust them any more.

Is it possible you had the "Edit your details" page open and your web-browser "helpfully" auto-filled the form with her details and you submitted the form without noticing?

It gets worse: there's a lot of web-apps out there (both SSRs and SPAs) with elements for personal details which are in the DOM, but "hidden" by doing tricks like `position: absolute; left: -99999px` inside a div with `overflow: hidden` (instead of doing something like `display: none;`) - or have the form hidden by using a z-index behind some curtain/cover element - and I've seen browsers auto-fill those fields and they get POSTed and cause a data overwrite on the server without the user being aware.

It's a fun way to steal PII from people: have a random public webpage that contains a registration form with all kinds of personal details, but has HTML+CSS such that it's visually obscured from the user, but the browser thinks it's a fully visible form, and simply yet the browser autofill it and submit it using JS (getting around the "user must interact with the page" filter by binding it to a big pink button that says "click here to see dancing bunnies!").

Browser auto-fill is dangerous.

Re: From email to phone number, a new OSINT approach (2019)

#94

Post by xp84 »

maxerickson wrote: post #86
Gh0stRAT wrote: post #66

Earlier quoted context omitted.

So that they can seamlessly upsell you on upgrading to a new phone that you'll pay off in installments over the next couple years. Also, many postpaid plans (like my home ISP) require SSN because they are providing you service on credit. Postpaid cell paone plans have been the "default" in the US for a long time, though prepaid seems to be gaining market share.

We are kind of assuming a lot when a $100 a month account obviously requires a credit check. They require a SSN because people don't care and it makes it cheaper to offer the accounts, not because it would actually be a big problem to sell internet service without credit checks.

The credit checks, the carriers would tell you, are to try to protect them against people who sign up for service with a "free" phone on a 3 year commitment (phone paid for in part by 36 installments of credits) and then they stop paying the bill. Sure the phone will be blacklisted and remain SIM-locked, but could still be used on Wi-Fi and either way the carrier can't have it back and is therefore out their cost of the phone.

Now, as for why they still do the same credit checks when you bring your own phone, I suspect "Because F you, that's why" is the gist of it.

Re: From email to phone number, a new OSINT approach (2019)

#95

Post by WirelessGigabit »

saltminer wrote: post #20

> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away. For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US. When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good wa…

Google voice numbers can be detected, even you have one ported from say AT&T. Twillio's API marks it as Google Voice.

And for dual SIM phones:

> An iPhone XS, iPhone XS Max, iPhone XR,

Source: https://support.apple.com/en-us/HT209044

That's 6 generations of iPhone that have dual SIM, in which there is at least 1 eSIM.

Re: From email to phone number, a new OSINT approach (2019)

#96

Post by jimmaswell »

saltminer wrote: post #20

> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away. For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US. When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good wa…

Windows phone link is pretty nice for sending and receiving texts through your phone on a desktop.

Re: From email to phone number, a new OSINT approach (2019)

#97

Post by josephg »

DaiPlusPlus wrote: post #93
josephg wrote: post #67

Earlier quoted context omitted.

My sister got married and changed her surname. PayPal has inexplicably also changed my surname to my sister’s new surname. I can’t for the life of me figure out why, or why they would do that without notifying me. At least no good reason. It’s the strangest thing. I haven’t even fixed it. I just stopped using PayPal because I don’t trust them any more.

Is it possible you had the "Edit your details" page open and your web-browser "helpfully" auto-filled the form with her details and you submitted the form without noticing? It gets worse: there's a lot of web-apps out there (both SSRs and SPAs) with elements for personal details which are in the DOM, but "hidden" by doing tricks like `position: absolute; left: -99999px` inside a div with `overflow: hidden` (instead o…

Uh, I don't think so. We don't live together and we don't share computers.

Its strange that Paypal would even consider our accounts associated in any way. I wonder if she put a support ticket in to change her name and they changed mine too because we shared the same surname? Does paypal know we're related somehow, or did they just change another random account with our surname when they changed her name, and happened to get her brother? The more I think about it the more questions I have.

Re: From email to phone number, a new OSINT approach (2019)

#98

Post by BenjiWiebe »

swozey wrote: post #12
jwally wrote: post #8

Can someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...

Basically what they did was do password reset processes at a bunch of different services like PayPal, LastPass, Ebay.. yeadda yadda. He found that they all display different portions of a phone number. PayPal being the worst shows someone starting the reset process 5 digits. Most showed 2 or 3 but different portions. So what he then did was essentially merge/correlate that data along with the area code and "exchange"…

Have an upvote. I preferred your summary. Thanks!

Re: From email to phone number, a new OSINT approach (2019)

#99

Post by ahoka »

1nd1ansumm3r wrote: post #81
1nd1ansumm3r wrote: post #52

Fun to see this issue get talked about. Ancedote- I bought some car parts from a semi-scammer. Not a full-on scam but the guy wouldn't ship the complete order even though he had my money for several weeks. We had communicated on a few different platforms. Each platform offered up a little piece of his identity. Last four of this. First four of that. It was enough to piece it all together. I gave him a call at his pla…

I re-read this, not to fire back but to understand how you arrive at your conclusion. I think you are interpreting (or assuming maybe), from when I asked about his employer, that I suspected he stole the parts from his employer. That's not the case at all. I just needed a pressure point.

Didn’t you basically blackmail the guy?

Re: From email to phone number, a new OSINT approach (2019)

#100

Post by dylan604 »

ahoka wrote: post #99
1nd1ansumm3r wrote: post #81

Earlier quoted context omitted.

I re-read this, not to fire back but to understand how you arrive at your conclusion. I think you are interpreting (or assuming maybe), from when I asked about his employer, that I suspected he stole the parts from his employer. That's not the case at all. I just needed a pressure point.

Didn’t you basically blackmail the guy?

your point?
Post reply on HN