17 ms·
From email to phone number, a new OSINT approach (2019)
- hipadev23 3y agoGreat technique for those VCs who think they can just ignore my emails
- xhkkffbf 3y agoThis kind of uncoordinated leaking is a deeper problem. Many share the last four digits of a SS#. Okay. But often the first five are easy to guess from the birthday and the birth state. The first few digits tell the state where the number was issued.
- birdman3131 3y agoOnly for ones issued prior to 2011. While this encompasses any current adult it is something to keep note of.
- swozey 3y agoHell a lot of people have a last 4 digit that is literally just their mothers birth year.
- myself248 3y agoLast four of their SSN? That makes no sense, those digits are sequentially assigned at the issuing office.
- swozey 3y agoYes, last four. Don't ask me how I know.. Might be a "born on base" thing but it's no coincidence.
- evan_ 3y agoIt is a coincidence. You have a 1-in-10000 chance of getting any 4 digit number and they assign 5.5M a year, so we can expect that 550 people get their mother's year of birth every year. You just happened to get 1961. (Total guess but how cool would it be if I was right?)
- swozey 3y agoI have a REALLY hard time believing that but I've never looked into it. Like you said, 550 people a year get it. I just happened to be in the 0.01%? I should be luckier, lol. https://www.quora.com/What-are-the-odds-that-your-birthday-is-the-same-as-the-last-4-digits-of-your-social-security-number-For-example-SS-4772-DOB-4-7-72 https://www.quora.com/What-are-the-odds-that-your-birthday-i...
- myself248 3y agoIt's a coincidence. http://web.archive.org/web/20070203124309rn_1/www.cpsr.org/prevsite/cpsr/privacy/ssn/ssn.structure.html http://web.archive.org/web/20070203124309rn_1/www.cpsr.org/p...
- nerdbert 3y agoAnyone alive today would be born between 1900 and 2023, right? And their mothers, assuming they were between 13 and 50 when they gave birth, would therefore have been born between 1850 and 2010. So that's 161 out of 9999 available last-4's (0000 is not used) that could possibly be someone's mother's birth year. And then, of course, it has to be the right year within that space. I am guessing this was something that happened to a few folks by chance and then was blown up by people who don't understand how many coincidences can occur across a population of millions.
- hotnfresh 3y agoThe core problem is that we have an utterly idiotic system in which knowing a nine-digit number lets you do any harm whatsoever. We have all the worst parts of a proper national ID system—tracking and data gathering by government and other large organizations isn’t hindered a bit, and we’re required to engage with our ad-hoc national ID system all the time for anything important—but none of the benefits. Tons of suffering and wasted time, for no damn reason.
- swozey 3y agolol > Paypal, which displays five digits including area code to anyone knowing the email address (but only three if the attacker knows the target’s password), decided this is working as designed and will not take action. Wild. Does anyone know how scammers are getting numbers off of LinkedIn? Or correlating them to numbers from elsewhere? I know a company whose employees are constantly getting fake CEO texts.
- DalasNoin 3y agoI just realized this is from 2019 and confirmed this literally still works on PayPal. SMH
- RecycledEle 3y agoAn objective observer would conclude PayPal only exists to cause security problems. I once called PayPal to report an "your account is suspended" phishing email and they angrily told me to follow the directions in the email.
- josephg 3y agoMy sister got married and changed her surname. PayPal has inexplicably also changed my surname to my sister’s new surname. I can’t for the life of me figure out why, or why they would do that without notifying me. At least no good reason. It’s the strangest thing. I haven’t even fixed it. I just stopped using PayPal because I don’t trust them any more.
- DaiPlusPlus 3y agoIs it possible you had the "Edit your details" page open and your web-browser "helpfully" auto-filled the form with her details and you submitted the form without noticing? It gets worse: there's a lot of web-apps out there (both SSRs and SPAs) with <form> elements for personal details which are in the DOM, but "hidden" by doing tricks like `position: absolute; left: -99999px` inside a div with `overflow: hidden` (instead of doing something like `display: none;`) - or have the form hidden by using a z-index behind some curtain/cover element - and I've seen browsers auto-fill those fields and they get POSTed and cause a data overwrite on the server without the user being aware. It's a fun way to steal PII from people: have a random public webpage that contains a registration form with all kinds of personal details, but has HTML+CSS such that it's visually obscured from the user, but the browser thinks it's a fully visible form, and simply yet the browser autofill it and submit it using JS (getting around the "user must interact with the page" filter by binding it to a big pink button that says "click here to see dancing bunnies!"). Browser auto-fill is dangerous.
- jwally 3y agoCan someone summarize this? I think the site is struggling with traffic and I'm getting 503'd...
- Techbrunch 3y agoMartin Vigo's article discusses the security vulnerabilities in password reset options for various websites and how these can lead to the exposure of personal phone numbers. Vigo highlights that during a password reset process, websites often partially reveal the user's phone number. This partial display varies across websites; some show the last four digits, others the first, and so on. By initiating password resets across different sites, one can potentially piece together most of the digits of a phone number just from an email address.
- _the_inflator 3y agoAwesome TLDR; Thx!
- joeframbach 3y agoIt's clearly AI generated, blatantly so.
- Techbrunch 3y agoIt is but it was proofread by a human with expertise in the domain, and honestly I wouldn't have done better in such a short amount of words. If someone wants to know more they better read the article which I did to make sure the generated text wasn't bullcrap :)
- jasonjayr 3y ago... just an email address, and publicly available information on the phone numbering system assignments + strategies.
- swozey 3y agoBasically what they did was do password reset processes at a bunch of different services like PayPal, LastPass, Ebay.. yeadda yadda. He found that they all display different portions of a phone number. PayPal being the worst shows someone starting the reset process 5 digits. Most showed 2 or 3 but different portions. So what he then did was essentially merge/correlate that data along with the area code and "exchange" (the part of number after area code) from sources like https://www.nationalnanpa.com/ https://www.nationalnanpa.com/ Then he has a python script the queries (not sure how I didn't read the code, I'm assuming NOT through an API but who knows) the aforementioned services and somehow determines the likelihood of a number out of several hundreds being registered to an email or not. I kind of dozed off at the end so I can't explain that part very well. edit: Why am I getting downvoted? This is literally what the blog is. My other comment is at the top.. lol. What a waste of my time giving an explanation. Ya'll like that low detail TechBrunch ChatGPT explanation more? Wild.
- egberts1 3y agoLOL! DOA! Next: Signal app, method
- egberts1 3y agoMy, this will age well.
- fudged71 3y ago@dang please append (2019) to the title
- Luc 3y agoFair enough, I did so.
- SpaceLawnmower 3y agoOne thing I've always wondered is how security researchers feel justified in releasing tools like the one in this blog post to the public. I can almost certainly say that the number of bad or creepy uses for an automated email to phone number generating tool massively outweighs the good reasons for having one. Does he get a pass because he's doing this for "research" and it's a grey area anyways? Does he feel better because he talked to the companies who exposed the vulnerability and it's neutered now?
- dj_mc_merlin 3y agoI think there's a good ethical argument for releasing the knowledge, not so much the tool. I think the open secret is that most people who go into cybersecurity do so because they enjoy breaking security through clever methods rather than actually helping others stay secure.. but security research is legal and hacking random targets isn't.
- viccis 3y agoI'm in the security industry, and this is absolutely correct. There are definitely many who carefully release PoCs when appropriate (giving vendors enough time to patch, etc.), but a LOT of these tool releases are done mostly to show off how smart we are and get clout. You see this big time every summer, as researchers all scramble to get a Defcon tool talk slot with some new thing they wrote, before immediately abandoning it post-con. Obviously, it's not like anything can or should be done to change this, as it's mostly just human nature, and keeping the security industry capable of operating legally and in the open is paramount. But sometimes people just wanna brag. And they get big mad about it and sputter about how literally any possible end justifies literally any actual means if you point it out (see: the other person responding to the top level comment lol)
- pmarreck 3y ago> I can almost certainly say that the number of bad or creepy uses for an automated email to phone number generating tool massively outweighs the good reasons for having one Meanwhile, I can almost certainly say that the number of ways to bury your head in the sand instead of simply facing an uncomfortable problem massively outweighs the good reasons for doing so anyway. A person who is in need of money and lacking in empathy will not fail to use any technique available and it is thus good to know the defenses of that or at least be aware of it. "Creepy" arguments (appeals to shame or disgust) are fallacies. Security researcher types are well aware of the good-actor motivations behind white-hat-hackerdom. Is it wrong that I can buy a book on lockpicking? Would I be seen by some as a bad parent if I taught it to my kid when he expressed curiosity about it?
- pmarreck 3y agoKeeping a phone number secret is "security by obscurity" and therefore the whole point of this article is rather moot.
- realusername 3y agoNot completely, when you have the email + the phone number, you can make much more sophisticated phishing attempts
- pmarreck 3y agoThat doesn't change the fact that these are not "secrets" (except by accident) and that their current secrecy-by-coincidence therefore should not be relied upon
- saltminer 3y ago> If it is a requirement, consider using a virtual number like Google Voice or even a dedicated SIM that you only use for this purpose and never give the number away. For the second SIM option, that requires a dual-SIM device, which are still fairly niche in the US. When it comes to VOIP numbers, unfortunately, many sites look up phone numbers and block VOIP providers, which sucks because Android still has no good way of sending/receiving carrier texts on the desktop (and before someone suggests the Google Messages web interface, it "forgets" my device too often for me to take it seriously). Occasionally, this can create a catch 22, where the VOIP blocking is implemented after the fact and prevents you from ever using the account again because the VOIP blocking was also implemented on the SMS 2FA. And then there's services which don't even bother to check if they can actually reach a number before accepting it. Harris Teeter pharmacies, for example, will happily accept a VOIP number, but their system is unable to call or text VOIP numbers, so you never get your prescription notices. (And I'd bet this applies to all Kroger brands since they share a lot of systems.)
- miki123211 3y agoThere's one missing piece in that article, and it's the CNAM database (US only). CNAM is the database that carriers use to give you alphanumeric caller ID ("SMITH JOHN" instead of "+1 (555) 123-4567"). Many carriers don't display this data as far as I believe, but most of them make it available. Querying that database isn't free, but you could probably find a way to do it for a few hundred numbers relatively cheaply. People's names and emails are often similar, so you could probably figure out an algorithm to give you the most likely candidates. The data is often wrong in interesting ways (I've seen everything from deadnames to people's exes they still share a plan with), but it is still pretty useful.
- toomuchtodo 3y agoAt least in T-Mobile's customer UX, you can set this to whatever you want per line [1]. Have tested by changing line CNAM and querying with Twilio number lookup [2]. You're supposed to be honest wrt person's name, but it's honor system. [1] https://www.t-mobile.com/support/tutorials/device/app/ios/topic/t-mobile-app/user-and-account-management-caller-id-name-change https://www.t-mobile.com/support/tutorials/device/app/ios/to... [2] https://www.twilio.com/code-exchange/lookup https://www.twilio.com/code-exchange/lookup
- navigate8310 3y agoWhy is this not tied to a person's SSN (if possible)?
- miki123211 3y agoWhy would it be? The point of that database is to display a recognizable name to the people you call, so that they know it's you. A recognizable name isn't always the one on your birth certificate (particularly in the US). There are also businesses, who want their business name there.
- evan_ 3y agoIs there an accessible database somewhere that would allow T-Mobile to get a name from an SSN (or verify that an SSN and a name match)?
- bunabhucan 3y agoAll this hassle using different email addresses for each service and a Google voice number was worth it.
- hackideiomat 3y agoif anyone does not do this yet and wants an easy solution: Firefox Relay
- GaryNumanVevo 3y agoI made an email randomizer that makes scrambled emails using the "+" feature. So any external service sees "gary+FqZWMK@gmail.com" and it automatically creates an unscrambled folder in my email that takes "FqZWMK" and converts it to the name of the service like "Netflix" or whatever. What's nice is that I completely control the mapping of ids, so if I can make multiple random addresses go to a "one-time" inbox that automatically sends emails to spam after a while.
- dang 3y agoRelated: Email to Phone Number Osint Tool - https://news.ycombinator.com/item?id=30476792 https://news.ycombinator.com/item?id=30476792 - Feb 2022 (2 comments)
- shivz45 3y agoOh i tried this technique just now to confirm one scammer's real phone number details. Paypal here again
- RecycledEle 3y agoThe author ignores number portability. Just because I currently live in a city and have AT&T does not mean they issued my phone number.
- 1nd1ansumm3r 3y agoFun to see this issue get talked about. Ancedote- I bought some car parts from a semi-scammer. Not a full-on scam but the guy wouldn't ship the complete order even though he had my money for several weeks. We had communicated on a few different platforms. Each platform offered up a little piece of his identity. Last four of this. First four of that. It was enough to piece it all together. I gave him a call at his place of employment which happened to be in the exact same industry as the parts that were being sold. I asked him to ship the parts and casually asked if his employer was involved in the sale. He perked right up and the next day he shipped everything I had bought and a few extras.
- dotBen 3y ago[flagged]
- wizerdrobe 3y agoHe easily could have bought parts for a better price seeing as his has the hook-up through his employer. Without further detail none of us can know the results. Calling someone a thief is a bit of a move…
- cooper_ganglia 3y agoI read it multiple times and fail to understand this interpretation at all. Even in context, I don’t see even a drop of “reasonable suspicion”. Is it a possibility that the goods were stolen? I suppose, but that’s the case with literally anything you purchase online. I wouldn’t have even thought twice about it. I bought stuff, you didn’t send me stuff, so now I’m upset and want you to send me my stuff.
- romwell 3y agoWhy assume that person was stealing anything from the employer, rather than simply being a shitty reseller that only ships when they get a good discount from working in the industry. A call like that can incentivize them to buy at full price and sell at a loss when their inventory is lacking.
- jmprspret 3y ago
- dools 3y agoAs an Australian I can only ever recall seeing the last 2 or 3 digits of my mobile number. The first 2 digits of all mobile numbers are the same and you can't send text messages to landlines.
- BHSPitMonkey 3y ago"Good morning class. A certain agitator, for privacy's sake let's call her Lisa S... No, that's too obvious. Let's say L. Simpson."
- sp0rk 3y agoI check GitHub's Trending page for Python projects every day or so. I was a little confused why this repo was trending today, particularly because the note at the top indicates that a lot of the services patched the exploit long ago. It's interesting to see that this being posted here on Hacker News is presumably enough to push the GitHub repo to the trending page for Python.
- Uptrenda 3y agoI noticed that some websites also reveal different parts of the credit card. Really hope that this attack also doesn't work there. Lmao...
- hackideiomat 3y agoThe amazon thing bugs me, as someone with a custom domain :D I literally get 1 or 2 * in my name and the rest is public knowledge due to this
- alkonaut 3y agoI use my real name as my email (as many of us do). And my phone number is publicly listed in many phonebooks. In Sweden it's standard practice for everyone to have their address and phone number searchable unless you opt out. Basically what used to be in the phone books in the 80s (which was everyone) just moved online in the 90s so now everyone's adress and phone number is publicly searchable. This can be really useful, but of course it can be used for evil as well. But one of the really positive things about having so much "public PII" (SSNs, Addresses, phone numbers, birth days) is that people don't have to treat this information as some sort of secret. Everyone needs proper ID and eID because knowing someones digits doesn't make it any easier to impersonate them. If someone wants my phone number, they take my email which has first- and last name, go to any of the N search sites and they find 100 people sharing my first and last name. If they know a city and approximate age (Which they can easily get from a social platform) they can narrow it down to just a couple of people. Public records then shows my birthdays, my cars, my income, who's also registered on the address, and so on. It's not difficult doing OSINT in Sweden...