16 ms·
A database of Facebook users’ phone numbers found online
- pedrocx486 7y agoKinda curious how you never find those dumps by a normal search on Google, basically you have no way to know if your data is there if you don't know where to look. I don't use Facebook but I always suspected my data is there due to friends having me in their contacts and using their apps.
- shiftpgdn 7y agoYou are likely in this database if you added your phone number to your Facebook account. There was a point where if you just typed a phone number into facebook it'd return the person who associated their account with that number.
- docker_up 7y agoEven worse. You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. The probability of your phone number not being uploaded to Facebook is basically 0.
- gatherhunterer 7y agoThe article says that each entry has an ID associated with a Facebook account. What leads you to think that there are entries in this dataset for non-users?
- ineedasername 7y agoIt's well known that Facebook collects information on non users as well, frequently called "shadow profiles.", Zuck admitted as much to Congress although he claimed not to know what shadow profile meant. [0] Whether or not that information was part of this database isn't clear, but it also isn't something the parent comment claimed. [0] https://slate.com/technology/2018/04/facebook-collects-data-on-non-facebook-users-if-they-want-to-delete-it-they-have-to-sign-up.html https://slate.com/technology/2018/04/facebook-collects-data-...
- gatherhunterer 7y agoThat is exactly what the parent comment claimed. > You are likely in this database if even a single one of your contacts uploaded their contacts to Facebook. Shadow profiles are old news. The suspect claim is that the parent comment is more informed on this database than the source that published it. > Whether or not that information was part of this database isn't clear Yes it is. According to the source this particular public data dump consists only of entries with IDs linked a Facebook account. > Each record contained a user’s unique Facebook ID and the phone number listed on the account. A user’s Facebook ID is typically a long, unique and public number associated with their account
- ineedasername 7y agoI don't see why shadow profiles couldn't use the same ID system. why not? For the parent comment saying they were in the data set: My initial interpretation was they meant if one Facebook user had done so, and you were also a Facebook user, whether or not you had provided your #, it was now associate with you. Your interpretation might be correct though.
- birdyrooster 7y agoWhat would happen if millions of people changed their phone numbers and did not re-register them with new accounts? Does anyone believe a social effort could dissuade the use of phone numbers for tracking people? How much entropy would need to be added to the system before using phone numbers as identifiers became useless?
- pedrocx486 7y agoWell, I never had an FB account. But I have friends who I know have contact search enabled on their phones, so they probably have my phone and maybe first name.
- edm0nd 7y agoSecurity researchers use search engines like Shodan to find these databases, not Google.
- cbau 7y agoIs protocol if you find these things a security researcher not to share the link? I read about these leaks a lot and am always interested in viewing them but never can find them. I assume the links are shared with people carefully because a small number of people will use them maliciously.
- LocalPCGuy 7y agoDepending on the severity of the breach, yes it's generally considered best practice to notify the service first and give them time to deal with it. Depending on how bad it is, the person reporting it may be compensated for finding it. The company would generally fix the issue, and then the person who found it can make it public (based on their agreement with the company sometimes). The time period is often 90 days, but it could be worked out independently per case. As with anything like this, consult a lawyer who knows this area of the law of you find yourself in this situation.
- Bnshsysjab 7y agoIt’s never good to disclose PII. Dropping vulns after responsible disclosure is mostly considered ok, not so much with PII - it’s not the victims fault and can be damaging longer term. If the vendor refuses to fix the issue, providing the media with enough redacted info to have them publish a story will force the vendors hand.
- bifrost 7y agoGoogle only really does http/https, finding mongodb requires scanning for 27019 and then pointing a client at it. I believe Shodan does this.
- devy 7y agoIs the background image on the TechCrunch article an UI for monogodb? Or is it just a FB GraphQL query browser UI?
- MapleWalnut 7y agoIt's MongoDB Compass, a client for Mongo.
- userbinator 7y agoIt also indexes ftp, but that may unfortunately be coming to an end[1]. Ironically enough, Google's mission statement is still "to organize the world's information and make it universally accessible and useful", which if taken to its logical conclusion would mean such humorously delightful things as scanning for mongos and indexing their contents too... [1] https://news.ycombinator.com/item?id=20721609 https://news.ycombinator.com/item?id=20721609
- lioeters 7y ago> to organize the world's information ..including any private data they can gather on you, via search, maps, analytics, browser.. I wouldn't put it past Google to be already indexing exposed databases (or continue indexing ftp), just not making it publicly available.
- bifrost 7y agoIts almost like people need a tool to tell them not to leave stuff open like that... Between MongoDB, Jenkins and Elasticsearch, thats a whole ecosystem of pwnability that is probably just starting to be exploited.
- reaperducer 7y agoFacebook: "This dataset is old and appears to have information obtained before we made changes last year to remove people’s ability to find others using their phone numbers." Not that "old." Some of those "update" dates are just a few days ago.
- dvtrn 7y agoYes but "But the data appeared to be loaded into the exposed database at the end of last month — though that doesn’t necessarily mean the data is new." Somewhat curious what the Status key represents in this dump, personally.
- akerro 7y ago>ability to find others using their phone numbers." Ah right, that's why I couldn't find someone...
- Avamander 7y ago> changes last year to remove people’s ability to find others using their phone numbers. What? That's not true, I reported the issue about user enumeration via phone numbers being possible in Whatsapp, Messenger and Instagram to them last week and they claimed (paraphrased) "it's a feature, not a security issue".
- 1000units 7y agoDo you intend to publish this correspondence? I think some companies prefer to sue people using these "features" instead of changing them. It's a good thing to have on record.
- Avamander 7y agoThere's not much to publish. It is just me saying that a custom contact book allows finding out a lot of people's accounts, them saying that the behavior respects people's settings and is working as intended.
- rhizome 7y ago
- ydnaclementine 7y agoproper link? I'm curious to see if I'm on there
- input_sh 7y agoCheck Settings -> Privacy -> Who can look you up using the phone number you provided? If I understood this story correctly, it was scraped from accounts that had this preference set to public.
- Avamander 7y agoIt can be scraped even when it's "Only people who you have in contacts" (can't recall the exact wording right now), Facebook thinks it's a feature and that their privacy measures are working properly.
- 1000units 7y agoDoes anyone know where to obtain this dump? I would like to know if I am compromised.
- bifrost 7y agoYou can check with "Have I Been Pwned" URL -> https://haveibeenpwned.com/ https://haveibeenpwned.com/
- 1000units 7y agoThis appears to be for emails and passwords, neither of which are reported to exist in this dump.
- pawelk 7y agoFor now. Let's throw some money their way to make search by phone number happen? I have donated just last week and I will do that again next month.
- 1000units 7y agoA less virtuous person would just pay criminals a hundred bucks or some other trivial fee to have direct access to the data that's being collected (and mishandled) about him. The song and dance required to keep these leaks out of public sight only enables victimizers, and there would be a magnet link in this very thread if they didn't have deep pockets and a vested interest in relegating this news to a one-and-half-page internet news blurb.
- bifrost 7y agoIt was still reported to HIBP, its probably a worthwhile search.
- mehrdadn 7y agoOff topic, but I'm amused to see xkcd was hacked. And that its database used MD5 for hashing emails, passwords, and IP addresses!
- shakezula 7y agoIt's clearly a mongo database. I'm curious if there was no password because mongo doesn't password protect by default or if it was intentionally left public.
- brlewis 7y agoIf I never associated a phone number with my account am I safe, or does it also include phone numbers from contacts lists people let Facebook copy?
- sapski 7y agothe latter, see https://gizmodo.com/facebook-is-giving-advertisers-access-to-your-shadow-co-1828476051 https://gizmodo.com/facebook-is-giving-advertisers-access-to...
- sleavey 7y agoHeads up: when Facebook asks you to give them your phone number to "prevent you getting locked out of your account", they really just want it so they can identify your other profiles in datasets they've bought/own (e.g. WhatsApp). If you've ever given the service your number, you should consider your real identity linked to it.
- dvtrn 7y agoBrings to mind a question, I've got a throwaway google voice number for precisely this reason, some services will let me use it, others (even Google-tried using a GVoice number as a recovery phone number for a gmail account for my grandmother, nothing doing) wont, few just throw back a generic error, others will say they don't allow virtual DIDs. Someone's going to say that's to cut down on fraud/increase security, right? Yet these services are going to (against many in the InfoSec world who are screaming "STOP DOING THAT") use SMS as a means of 2FA... I'm a bit confused where the value add is for account security in making virtual telephone numbers such a hit or miss.
- jethro_tell 7y agoReal security is picking a unique password and not forgetting it. Letting someone handle your security by giving them your phone number in case you can't handle it was never a good idea. Get a password safe, and don't forget your complex passwords.
- derefr 7y ago2FA (through an third-party like an email provider or, even, dare I say it, an SMS provider; not TOTP) continues to protect you when your password is compromised by a backend-side database breach. They might get your password; they might get your TOTP token seed; but there's nothing in the DB that will allow them to receive an email as you and then click the link in said email. Yes, allowing someone to reset their password through a second factor is bad; but that's not 2FA, that's two independent 1FAs.
- 7y ago
- raisedbyninjas 7y agoHeads up: T-mobile will allow you to take over an account if you can guess one of the most recent phone numbers that the target account has called.
- ben174 7y agoIs this true? Got a link for reference?
- raisedbyninjas 7y agoSorry, no link. Just personal experience when we lost the account info for an employees phone.
- tzs 7y agoDid you have a PIN/Passcode on the account [1]? That a 6-15 digit number you can set on an account that you have to supply when you call support, or have to give to your new carrier for them to get your phone number ported off of T-Mobile. [1] https://support.t-mobile.com/docs/DOC-37477 https://support.t-mobile.com/docs/DOC-37477
- inetknght 7y agoThat sounds very secure indeed. Nobody would ever guess that I'd recently called my folks! /s
- drusepth 7y agoNo one would ever guess that my target called me back after I left a frightening voicemail also!
- trungdq88 7y agoIn Vietnam, scammers use a few numbers to call the target first, making those number the "most frequent recently", then take over the target phone number. This security model is terrible.
- 7y ago
- cm2012 7y agoWow, a phone book. Do HN readers know you can buy lists of millions of people's names and phone numbers from companies whose sole purpose is collecting them, like infogroup?
- Barrin92 7y agodepends on the jurisdiction. In Germany this is a grey area or outright forbidden depending on the case, and this dump apparently contains numbers from numerous jurisdictions. Also, needlessly to say someone who gives facebook their phone number for verification purposes does likely not expect that the data is leaked or sold without their permission.
- auiya 7y ago> needlessly to say someone who gives facebook their phone number for verification purposes does likely not expect that the data is leaked or sold without their permission. Sadly, this isn't the case anymore. People absolutely expect companies to sell or leak every last bit of PII data they have on all their customers now.
- bpchaps 7y agoYes, you can get tons of personally identifiable information from things like public records laws and such. That's irrelevant, though. This is a phone number tied to a facebook account, not just their name. A major difference here is the ability - at scale - to associate people with their facebook accounts. There are people who do not want to be associated with by their facebook account, and reasonably so. Not sure why you don't think that wouldn't be a big deal.
- paulddraper 7y ago> There are people who do not want to be associated with by their facebook account I figured that ever since Facebook instituted the "real name" policy, this isn't necessarily possible.
- 7y ago
- chasing 7y agoHas there been any kind of class action lawsuit against FB for this kind of crap?
- mancerayder 7y agoThat's egregious but have you ever looked yourself up on any one of those crazy info scraping sites? usphonebook.com and dozens of their ilk? You might be shocked by what you find. Some colleagues had all old email addresses listed, not to mention correct current address and associated persons. Point is, Facebook probably already have it, the Enemy probably can easily get it. Facebook is of course evil, I don't want to diminish their scraping and also security mishaps.
- Zenst 7y agoIs this just Facebook users? Or does this include people who just use say, Whatsapp? Then rememberings this: https://arstechnica.com/information-technology/2018/03/facebook-scraped-call-text-message-data-for-years-from-android-phones/ https://arstechnica.com/information-technology/2018/03/faceb... Makes you wonder.
- subcosmos 7y agoBetter headline : "FaceBook disrupts the phonebook business with knew lookup app"
- discordance 7y agoIf this had European users, will they get slugged with a 4% of their revenue fine under GDPR?
- el_dev_hell 7y agoThe article screenshots show a redacted Facebook user in the UK.
- jefftk 7y agoIt sounds like this was scraped before the GDPR went into effect.
- oriettaxx 7y agoin https://techcrunch.com/wp-content/uploads/2019/09/fb-3-2.jpg https://techcrunch.com/wp-content/uploads/2019/09/fb-3-2.jpg I see "update 2019-8-28", updated from where?
- lioeters 7y agoFrom the article: > ..The data appeared to be loaded into the exposed database at the end of last month — though that doesn’t necessarily mean the data is new. EDIT: Oh, you were asking "from where". I'd be curious to know the source of this database too, since it's probably just one of countless copies circulating..
- ecesena 7y agoWill haveibeenpwned add phone numbers? That'd be neat.
- aledalgrande 7y agoThat would be dangerous: it would be much easier to mine haveibeenpwned by enumerating phone numbers and see what sites have been hacked with a certain number. You would then know exactly which sites to target with which phone number, and that's already eliminating a lot of work. Get a password dataset or two in the darknet and you can now hack into many accounts.
- rolltiide 7y agowhere is the database, I want a copy What are they calling it on Empire market?
- amatecha 7y agoSo... any way I can see if my number was in this database? Pretty funny. Years ago I very-begrudgingly verified my phone# on my FB account as my employer had me working on a FB integration... I knew I should have upheld my principles and not used my personal account.
- userbinator 7y agoMy general rule is that the only personal resource I will use in a software job is my brain.
- amatecha 7y agoOh yeah, this was a long time ago, and I have since adopted the same mentality :) I think at the time the only way to be a Facebook Developer was to verify your identity via SMS (or something like that) and you couldn't just create a fake/pseudonymous account for development purposes. I assume that is still the case, but I have no clue.
- ieoeo9 7y agoThey have these already, it’s called a Yellow Pages. It was opt out for a fee. They shipped internationally. Anyone in the world could get your phone number and it was nigh untraceable! The world did not end because of it. I’d take the freak outs online seriously if anyone seemed to realize they’ve been “compromised” or easily could have been for years. Much more easily in fact, with less paper trail. Increased awareness by the general public is not indicative of increased threat.
- hollerith 7y agoYou mean white pages :)
- ieoeo9 7y agoAt one point as a kid we were getting a single FAT combo. Maybe that was a regional thing.
- chaboud 7y agoSo racist... I’ve lived in regions where the white and red sections were part of the yellow pages, a separate book, and yellow with black edge markings. I don’t think phone book experiences are particularly uniform, based on my own having had a lot of variation.
- justinclift 7y agoPeople could opt out of that though.
- ForFreedom 7y agoSo how does one check if their data is compromised?
- viach 7y agoImagine what's going to be found online after Libra is implemented - accounts, phone numbers and the history of purchases including supplier's name and type - a dream database for target advertising.
- captain_qwark 7y agoIs it that difficult to encrypt phone numbers before storing to a database? Or do they just use ridiculously easy to break encryption algorithms? Or does Facebook just not care?
- nroets 7y agoFacebook used to have a feature that allowed users to find a profile if they have a phone number. I found it useful when I received a text from an unknown number. Especially to protect myself from being catfished. If I understand correctly, someone collected all the queries and all the results and made a phonebook. I think Facebook cares, but at the same time they always benefited from these measures where they let their users see as much as possible.
- bee-boop-19 7y agoThere real catch with this is how all this information was public for so long. The average user still doesn't understand that they posted their PII to a searchable database, and ultimately the ramifications of doing so. Even now, yes FB has restricted phone numbers, but a simple bot friending ppl on FB, which many users would blidnly accept requests from, would once again reveal all this data
- mtgx 7y agoThis is why I strongly advocate for "data being a liability when you have experience a data breach." This solves two things: 1) services will only store the user's data they REALLY NEED 2) lack of strong security: services will be much more incentivized to secure the data they do collect and store. Not only did Facebook fail to protect this data, but much of it they also collected without most users even realizing, such as when "accepting to install the Facebook application" and then retrieving the contact list in the background.
- goatinaboat 7y agoMy guess: the data was exfiltrated by a FB employee intending to use it for their own startup.
- deleted 7y ago[deleted]
- bubble_talk 7y agoSo let us say I go to some page which lists some "potentially well off" folks, like this one: https://github.com/orgs/google/people https://github.com/orgs/google/people or this: https://github.com/orgs/microsoft/people https://github.com/orgs/microsoft/people or even this :-) https://github.com/orgs/facebook/people https://github.com/orgs/facebook/people Given GitHub actually even provides a convenient, public, unauthenticated API, it makes it even more easy: https://api.github.com/orgs/facebook/public_members https://api.github.com/orgs/facebook/public_members And then I match it with their personal phone numbers in the dataset (apparently its now offline, but maybe another one will reappear at some point). And then I can just call these phone numbers and sell them stuff? And its perfectly OK because even if a dataset like this goes into the wild it acts as nothing more than "just a phone book"?
- wodenokoto 7y agoCouldn’t you already match those lists against the phone book?
- cmbailey 7y agoCellphone numbers do not appear in regular phone books.
- keymone 7y agoWhat’s a phone book?
- paulddraper 7y agoIf you knew their locality.
- iyw 7y agonull comment
- lovecg 7y agoYeah but who answers calls from unknown numbers anymore? It’s pretty much 99% spam already.
- etxm 7y agoThis isn’t getting old to me yet!!1
- Yuval_Halevi 7y agoFacebook is proving itself over and over again as a company who don't care at all about their users. the amount of data scandals they had in the last few years is insane
- wmeredith 7y agoThey care greatly about their users-advertisers. Their product on the other hand-people with Facebook accounts-are to be sold to the highest bidder.
- RyanAF7 7y agoIntentional. Zuck should go to jail.
- deleted 7y ago[deleted]
- collyw 7y agoGlad I didn't give them my phone number despite them pestering me for it.
- cruano 7y agoOh don't worry, some of your friends probably already gave it to them when allowing facebook to see their contacts
- 09683878008 7y ago09683878008
- no7kai 7y agodose anyone know how to get this dataset?