A database of Facebook users’ phone numbers found online • Hacker News Board

Re: A database of Facebook users’ phone numbers found online

#31

Post by LocalPCGuy » Wed, Sep 04, 2019, 9:45 PM UTC

cbau wrote: post #21

edm0nd wrote: post #12

Earlier quoted context omitted.

Security researchers use search engines like Shodan to find these databases, not Google.

Is protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.

Depending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case.

As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.

Re: A database of Facebook users’ phone numbers found online

#32

Post by ben174 » Wed, Sep 04, 2019, 9:47 PM UTC

raisedbyninjas wrote: post #30

Heads up: T-mobile will allow you to take over an account if you can guess one of the most recent phone numbers that the target account has called.

Is this true? Got a link for reference?

Re: A database of Facebook users’ phone numbers found online

#33

Post by inetknght » Wed, Sep 04, 2019, 9:50 PM UTC

raisedbyninjas wrote: post #30

Heads up: T-mobile will allow you to take over an account if you can guess one of the most recent phone numbers that the target account has called.

That sounds very secure indeed. Nobody would ever guess that I'd recently called my folks! /s

Re: A database of Facebook users’ phone numbers found online

#34

Post by devy » Wed, Sep 04, 2019, 9:50 PM UTC

bifrost wrote: post #18

pedrocx486 wrote: post #2

Kinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to look. I don't use Facebook but I always suspected my data is there due to friends having me in their contacts and using their apps.

Google only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.

Is the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?

Re: A database of Facebook users’ phone numbers found online

#35

Post by dvtrn » Wed, Sep 04, 2019, 9:56 PM UTC

sleavey wrote: post #25

Heads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identify your other profiles in datasets they've bought/own (e.g. WhatsApp). If you've ever given the service your number, you should consider your real identity linked to it.

Brings to mind a question, I've got a throwaway google voice number for precisely this reason, some services will let me use it, others (even Google-tried using a GVoice number as a recovery phone number for a gmail account for my grandmother, nothing doing) wont, few just throw back a generic error, others will say they don't allow virtual DIDs.

Someone's going to say that's to cut down on fraud/increase security, right? Yet these services are going to (against many in the InfoSec world who are screaming "STOP DOING THAT") use SMS as a means of 2FA...

I'm a bit confused where the value add is for account security in making virtual telephone numbers such a hit or miss.

Re: A database of Facebook users’ phone numbers found online

#36

Post by birdyrooster » Wed, Sep 04, 2019, 9:59 PM UTC

shiftpgdn wrote: post #6

pedrocx486 wrote: post #2

Kinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to look. I don't use Facebook but I always suspected my data is there due to friends having me in their contacts and using their apps.

You are likely in this database if you added your phone number to your Facebook account. There was a point where if you just typed a phone number into facebook it'd return the person who associated their account with that number.

What would happen if millions of people changed their phone numbers and did not re-register them with new accounts? Does anyone believe a social effort could dissuade the use of phone numbers for tracking people? How much entropy would need to be added to the system before using phone numbers as identifiers became useless?

Re: A database of Facebook users’ phone numbers found online

#37

Post by dataflow » Wed, Sep 04, 2019, 10:08 PM UTC

bifrost wrote: post #29

1000units wrote: post #22

Earlier quoted context omitted.

This appears to be for emails and passwords, neither of which are reported to exist in this dump.

It was still reported to HIBP, its probably a worthwhile search.

Off topic, but I'm amused to see xkcd was hacked. And that its database used MD5 for hashing emails, passwords, and IP addresses!

Re: A database of Facebook users’ phone numbers found online

#38

Post by Bnshsysjab » Wed, Sep 04, 2019, 10:09 PM UTC

cbau wrote: post #21

edm0nd wrote: post #12

Earlier quoted context omitted.

Security researchers use search engines like Shodan to find these databases, not Google.

Is protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.

It’s never good to disclose PII. Dropping vulns after responsible disclosure is mostly considered ok, not so much with PII - it’s not the victims fault and can be damaging longer term.

If the vendor refuses to fix the issue, providing the media with enough redacted info to have them publish a story will force the vendors hand.

Re: A database of Facebook users’ phone numbers found online

#39

Post by chrisseaton » Wed, Sep 04, 2019, 10:10 PM UTC

sleavey wrote: post #25

Heads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identify your other profiles in datasets they've bought/own (e.g. WhatsApp). If you've ever given the service your number, you should consider your real identity linked to it.

> you should consider your real identity linked to it

What is the point of these products if not linked to my real identity? That’s the whole idea of them. I use Facebook and WhatsApp to talk to people who know me. That’s why they want to talk to me. If they didn’t know my identity they would want to talk to me.

Re: A database of Facebook users’ phone numbers found online

#40

Post by rhizome » Wed, Sep 04, 2019, 10:10 PM UTC

Avamander wrote: post #9

reaperducer wrote: post #3

Facebook: "This dataset is old and appears to have information obtained before we made changes last year to remove people’s ability to find others using their phone numbers." Not that "old." Some of those "update" dates are just a few days ago.

> changes last year to remove people’s ability to find others using their phone numbers. What? That's not true, I reported the issue about user enumeration via phone numbers being possible in Whatsapp, Messenger and Instagram to them last week and they claimed (paraphrased) "it's a feature, not a security issue".

They removed "people's" ability, but not their own.