10 ms·
WhatsApp data leak: 500M user records for sale
- gautamsomani 4y agoStupid question, but still out of curiosity: what's that site of which the screenshot has been posted?
- onetimeusename 4y agobreached.vc
- andrewallbright 4y agoSo... what advise is there for technology comfortable people who want to mitigate the effects of data leaks like these? It seems like data provided is will be exposed eventually and company size doesn't seem correlate with data safety. For example should people be advised to rotate phone numbers every N amount of time?
- Komodai 4y ago
- aliqot 4y agoIt's disgusting that this comment had to be vouched for, it's common sense.
- _puk 4y agoIt's also low quality. Not using WhatsApp isn't going to magically secure your details online. As per GP's point, most services eventually seem to leak data, so it may as well be saying "Don't go online". Compare that to the alternate response which provides solid actionable advice for how to limit exposure when these services ultimately leak your data, and you can see why that post was downvoted to oblivion.
- Kiro 4y agoI downvoted and flagged it. It's low-effort bait.
- solarkraft 4y agoExcept that even if I don't use WhatsApp and somebody I know and who has my contact information does, WhatsApp also has my contact information.
- deleted 4y ago[deleted]
- kadoban 4y agoThe basic stuff helps a decent amount. Assume your name, phone, email, address are all public. Don't reuse passwords, ever (use a password manager), use 2fa wherever possible, ideally not the SMS kind. Use a password manager that has a tie-in with haveibeenpwned or whatever so you know asap to change your creds. Some extras: use unique email addresses per site if you can. Some setups allow infinite aliases. Then you can blackhole one that gets leaked, and you can know where it got leaked from. If you can, have a separate setup (completely separate email account(s), not just aliases, and even separate hardware to access them if you can) for very important accounts, the ones that would ~ruin your life for a good bit if they got taken over (bank, retirement, etc.) There's also credit monitoring type stuff, which I've never been clear how useful it is, but might be worthwhile. You also may get it free if some company you use has a leak and they try to PR it away that way. I think there's some way to basically lock your credit against new accounts, I need to look into that someday, don't know the details or if it even exists.
- idiocrat 4y ago>Don't reuse passwords, ever Note to myself: change the combination on my luggage. https://www.youtube.com/watch?v=LcHnf7VQuhc https://www.youtube.com/watch?v=LcHnf7VQuhc
- MattDemers 4y ago>Some extras: use unique email addresses per site if you can. Some setups allow infinite aliases. Then you can blackhole one that gets leaked, and you can know where it got leaked from. If you pay for ProtonMail, you get a SimpleLogin Premium for free, which makes the creation of dummy/alias emails a lot easier. They're owned by the same company.
- kadoban 4y agoThat sounds nice. I use bitwarden's "plus addressed email" generator I think it's called, the downside being that I need to specifically blackhole anything that bypasses the plus-addressing, or it'd be easy for anyone that actually looks to bypass. There still is the chance that some spammer will figure out that "blah+any-random-string" works for my email, but I'll deal with that if someone bothers someday. I'd just need to add an allow-list or something probably.
- jsnell 4y agoThe advise is to do literally nothing about it. What effect do you think this specific leak has on you? What kind of adversary do you think will be able to benefit from this data, and how? The reality is that the data is useless trash, and there is no indication that this has actually leaked from Facebook or is showing any kind of security problem in their systems.
- A4ET8a8uTh0 4y ago<<The reality is that the data is useless trash, That remains to be seen. People are fairly ingenious when it comes to abusing information and information runs the world now. I will offer an unrelated example, partially because I do not want to give ideas on how to benefit from this. Do you remember when certain entrepreneurial billionaire offered a checkmark for sale, which resulted in people impersonating companies and manipulating their stock price[1]? Like with most things, any tool is worth what one is able to do with it. << The advise is to do literally nothing about it. I would not advise to panic, but doing nothing is not exactly great advice either. Some re-assessment of one's current security posture may be warranted. [1]https://www.fiercepharma.com/marketing/eli-lilly-hit-new-twitter-blue-fake-account-forced-apologize-over-free-insulin-tweet https://www.fiercepharma.com/marketing/eli-lilly-hit-new-twi...
- jsnell 4y ago> Like with most things, any tool is worth what one is able to do with it. Yes, and given an attacker will not get new capabilities from this data, it is worth nothing. Any attack that could be feasibly run with a list of nothing but phone numbers associated with some (unknown) WhatsApp account could be done without that list just as easily. That's because of two things: a) phone numbers within a given country are easy to enumerate, b) the WhatsApp account space is dense, i.e. the odds of any legit phone number being used for WhatsApp is high. > I would not advise to panic, but doing nothing is not exactly great advice either. Some re-assessment of one's current security posture may be warranted. If you can't formulate a realistic threat from this data, how can you possibly re-evalate your security posture in light of it? You need a threat model for that. Pondering about the security of one's digital life can of course be worthwhile in general, but advising anyone to do so in the context of this linkbait is just advising them to waste their time. In your Twitter example, the impersonation did not come as a surprise. People were predicting that outcome within minutes of Musk announcing it. Can you make a prediction about what bad things will happen to the people whose phone number is in this dump, compared to people whose phone number isn't there?
- drdaeman 4y agoPeople should be advised to not use phone numbers at all. There was a joke "all phone numbers leaked" list that just listed everything from 000-000-0000 to 999-999-9999. If there is no other information associated (names, pictures, emails, anything) then this leak is of almost comparable severity.
- philjohn 4y agoWe used to have these things called Phone Books, that literally, contained everyone's phone numbers. We didn't call those leaks.
- lawtalkinghuman 4y agoThere's an important difference between people being able to do inefficient paper-based one-off `SELECT ... LIMIT 1` queries when needed and the entire world being able to find new and exciting ways to search, join and mix data at great speed—the latter tends to enable new and exciting ways for the data to be used both for commercial gain, criminal purposes, and abusive trolling. (See: the history of internet harassment for the last 20 years.) Pointing out that we used to put all the phone numbers in a book published by the phone company and now we don't is historically true but practically unimportant, just as "hey, sorry to hear your house got broken into, but you know, people in IDYLLIC_RURAL_HAMLET don't even lock their front doors like you BIG_CITY folks do" isn't useful unless giving up living and working in BIG_CITY and moving to IDYLLIC_RURAL_HAMLET is actually a practical option, which most likely it isn't (and if that were to happen en masse, IDYLLIC_RURAL_HAMLET would suddenly find they'd also need to lock their front doors if their population increased by a factor or two). Who could have predicted that technological change might lead to shifts in social attitudes? Or, indeed, that the rules, principles and institutions we collectively create to make society bearable have to adapt to said changes?
- taalrhack 4y agoWhat is the forum link ?
- lzooz 4y agohttps://breached.vc/Thread-Selling-262-MILLIONS-WHATSAPP-NUMBERS-November-2022-VERIFIED-NUMBERS https://breached.vc/Thread-Selling-262-MILLIONS-WHATSAPP-NUM...
- mhitza 4y agoWhat's the name of this "well-known hacking community forum"?
- TruffleLabs 4y agoSadly the WhatsApp 2 step really is just a pin and an email. I believe this really isn't 2 step as there is no ever-changing code. https://faq.whatsapp.com/2976081889094372/ https://faq.whatsapp.com/2976081889094372/
- krater23 4y agoThats just public data. You can check for every phone number if there is a Whatsapp account connected with it, there is no leak. Everyone know this, this databases are worth nothing, and the prizes are really low, as you see.
- TrianguloY 4y agoAre there any other data associated with the number, other than the country and whether it has a WhatsApp account? You can check if a given number is on WhatsApp easily, and associate the country based on the phone format itself. Make this for all possible phone numbers (big number, but not impossibly big) and you will have a "leak". Edit: having a list of WhatsApp users already generated for you is easier than checking yourself, so this is more of a "commodity database" rather than a leak. I guess this would be the same as testing randomly millions of email addresses for whether they bounce back or not, and sell this knowledge database.
- Gualdrapo 4y agoProfile pictures come to mind.
- krater23 4y agoMostly blocked when you not in the phone book of the user. Thats not a leak, it's just a database of public accessible data. I would say, someone needs a headline, thats all. Ob the prize of this databases you see that they are worth nothing.
- TrianguloY 4y agoProfile, last connection time and status is public unless configured to not be. I was thinking about data not obtainable without a normal use of the service.
- capableweb 4y ago> Profile, last connection time and status is public Isn't those details (+ profile pictures) only available only you've accepted the first message from another user? I think I recall that I cannot see a persons avatar when I message first unless they hit "Accept message" after me sending the message. Is it not like that everywhere perhaps? I use Whatsapp with a number in the EU region.
- 4y ago
- baxtr 4y agoThese seem to be “just” phone numbers. Most of which probably already leaked through the last Facebook leak. Not sure how significant the data is.
- glintik 4y agoThat’s not leak actually, phone information about active/inactive is open. Anybody can run a spider to collect this.
- krater23 4y agoYou can check whith your own cellphone, if a phone number have a Whatsapp account, without any hacker knowledge, this is not significant at all.
- tuyguntn 4y ago> this is not significant at all. I wonder if HN community would say same if Telegram data was leaked in a similar way
- throwup 4y agoI might be missing something here. Why would HN care any differently about WhatsApp vs Telegram?
- elashri 4y agoProbably he is referring to that WhatsApp is from a US company vs telegram with Russian origin.
- tuyguntn 4y agogeneral tendency in HN is Telegram bad, Signal/WhatsApp is good. Even small mistake made by Telegram will be judged harshly, when it comes to WhatsApp, their mistakes are not important. Yes I am a Telegram fanboy (how can you not like such a beautiful/fast app, in the Electron world where everything takes 10s of seconds to load)
- bertman 4y ago>To prevent personal data leaks, regular users should adopt common data security practices. This includes using a high-quality VPN and getting a reliable antivirus program. And since the shopping holidays are close, you can already find great market-leading NordVPN Black Friday and TotalAV deals. What a disgusting site... Adding this blurb to a "news" article with "security measures" that do absolutely nothing against phone number scraping just to get those affilliate clicks...
- deleted 4y ago[deleted]
- fareesh 4y agoThe norm for personal communications really ought to shift to a new protocol that doesn't expose phone numbers. It would be nice if I had a list of people who have my contact added and just remove their ability to do so without my consent. It would solve security, privacy, telemarketing, all sorts of nuisances.
- JoeAltmaier 4y agoHm. I could write it down.
- ddihfygdgf 4y agosignal does what you say and keep the convience of connecting people via phone numbers, if you optin. but they still have a closed server... so who knows what really is logged where. still infinitely better than whatsbook/telegram/appleID/google/microsoft alternatives
- worldsavior 4y agoA closed/open source server doesn't matter since you can't actually confirm if the open source version is actually running.
- kibwen 4y agoIf it's open source and has a reproducible build, then you can audit the codebase, compute the hash, then verify an attestation from the secure enclave that the code is running in.
- worldsavior 4y agoSo you need to trust the server to return a valid, unmodified hash?
- kibwen 4y agoIn the case of the above, you're not trusting the server, you're only trusting the CPU manufacturer. Attestation happens within the secure enclave inside the CPU, at which point having physical access to the machine doesn't (well, shouldn't, if it's correctly implemented) give you any insight into what code it's running or what data it's operating upon.
- freeduck 4y agoI only leaked 32000 ;-)
- argella 4y agoI really need to figure out how to save off all the pictures and videos from WhatsApp iOS so I can uninstall it.
- Razengan 4y agoExport each (or the most important) chats as zip files.
- Zuiii 4y agoHow? when I try to backup my chats, whatsapp says my only option is to send them to google (i dont want to do that even if they're encrypted)
- mulligan 4y agosomeone scraping numbers is enough to drive you off of whatsapp?
- nashashmi 4y agoI have ran into several crypto groups adding me to their group. I was not the only one. Several people were in this category who would be added randomly. They would eventually leave. And then another set of people would be added. I always wondered how they got my and people’s numbers. I think this is their database leak.
- ChipsNDip 4y agoYup, and there's a setting in WhatsApp I enabled that only allows my contacts to add me to groups. This should prevent this annoying issue.
- rvz 4y agoLet the SIM swapping, SS7 attacks and the one click zero-day SMS phishing games begin. As I said before, it is never a good idea to use phone number 2FA. [0] [0] https://news.ycombinator.com/item?id=32401284 https://news.ycombinator.com/item?id=32401284
- wstuartcl 4y agoI mean, all this data provides is phone numbers that have been used (at least once) in whatsapp and this is publicly available via apis and simple scraping.
- ratsmack 4y agoI wonder what percent of "hacks" are from insiders, or from inside information/credentials given to outsiders. With the huge number of people involved in these companies, there has to be some percentage of illicit leaking going on.
- loeg 4y agoE.g., https://www.wsj.com/articles/meta-employees-security-guards-fired-for-hijacking-user-accounts-11668697213 https://www.wsj.com/articles/meta-employees-security-guards-...
- habibumar181 4y agoI need it
- anshumankmr 4y agoWelp. More shitty work at home ads for me.
- ambhargava 4y agoVery interesting to note that India is not on this list even though it has the largest WhatsApp user base.
- wstuartcl 4y agoI believe india requires their whatsapp services to be segmented in countryand backdoors to data -- they have a bunch of laws like this regarding communications all the way up to sat phones.
- SergeAx 4y agoI would try to correlate this list with previous massive Facebook leak. Cross-validating it would be much easier feat than scraping from scratch.
- wstuartcl 4y agoSomeone just enumerated numbers via scraping -- seems like this only would have marginal value for spammers and maybe as a check if whatsapp was used by a given number.
- u1tron 4y ago
- kobalsky 4y agoso the leak isn't a leak but a database of numbers they scraped together > To prevent personal data leaks, regular users should adopt common data security practices. This includes using a high-quality VPN and getting a reliable antivirus program. And since the shopping holidays are close, you can already find great market-leading NordVPN Black Friday and TotalAV deals. this post is basically spam.
- sva_ 4y agoShould be changed to something like https://www.techradar.com/news/whatsapp-data-breach-sees-nearly-500-million-user-records-up-for-sale https://www.techradar.com/news/whatsapp-data-breach-sees-nea...
- godelski 4y agoI like that this article doesn't mention the county that is likely most affected: India. > More than 32 million of the leaked records are said to be from users in the US, with 11 million from UK users. Other affected nations include Egypt (45 million), Italy (35 million), Saudi Arabia (29 million), France (20 million), Turkey (20 million), and Russia (10 million).
- ck2 4y agolol who allows a result response that large to be exported from a production database regardless of IP or local Sure allow queries against the entire dataset but not a result that is infinite.
- stereoradonc 4y agoI am not surprised (or "shocked"). Despite the privacy snafus, it still remains ingrained in the user's habits. Unless the company crashes and burns, I don't see the end of the road for WhatsApp.
- bobcattz 4y agoAll meta software uninstalled