12 ms·
Bruteforcing the phone number of any Google user
- onlygoose 1y agoOff topic, it was very interesting to peek into libphonenumbers metadata. I find it curious that we have so many ways to write down an already standardized identifier.
- msdrigg 1y ago[flagged]
- jeffbee 1y agoIt must be a daunting chore to maintain all the legacy pages. The amount of now-years-old stuff that long-standing sites have to maintain, or choose to maintain, is shockingly high, and testing the combination of all that stuff is impossible. If you want an example of how diverse in age these apps are, dig around in the Gmail settings panel. Eventually you will land on a popup that uses the original Gmail look and feel, from 2004.
- belter 1y ago> It must be a daunting chore to maintain all the legacy pages. Clearly $350 billion revenue in 2024 is not enough...
- staticshock 1y agoIn addition to having the money, Google also needs the incentive to spend that money on such projects. If the perceived return on capital is low (or negative!), the incentive is simply not there.
- reaperducer 1y agoIn addition to having the money, Google also needs the incentive to spend that money on such projects. If the perceived return on capital is low (or negative!), the incentive is simply not there. Perhaps Google should Google the concepts of "customer service," "standing behind your product," and "brand reputation."
- fsflover 1y agoWhy? Nobody is abandoning their services.
- IAmBroom 1y ago"Sure, Google retrieved the 10,285 results from my obscure query in a few milliseconds, but did you see how they stored their 12-year-old company icon image? Phhht.... I'm going with Bing!"
- xp84 1y ago> Google the concepts of "customer service," "standing behind your product," and "brand reputation." They're probably satisfied with their reputation with their customers, who are advertisers. The corporate IT folks who buy their G Suite products are also their customers, but overall the majority of the users of Google's software are not their customers, and Google cares about them the same way I care about how the gasoline in my car feels.
- Magmalgebra 1y agoSomething that can be hard to appreciate if you haven't managed this sort of project is that it can be surprisingly hard to throw money at the problem. If you try to hire at your regular "bar" for skill for boring work like this - people will often quit. This is one of the reasons many company's integrations are lacking despite it being a strategic interest - integration work is miserable and doesn't help your career. Hiring below the skillbar at the same pay, is dangerous and often doesn't actually work out - if it was that easy someone more skilled probably would have fixed this a while ago. So you try to pay more for the miserable work - but hold on, now you have to pay out of band salaries, and legal tells you that opens you to massive liabilities. Ok - maybe you can just level them differently? No, HR will tell you that will mess with all your internal level processes - which are key to running the company. They're going to add a lot of additional overhead tracking these "fake" leveling bands and dealing with the consequences. None of this means the problem is literally unsolvable, but it now requires a huge amount of time and effort from people near the top of the company who everyone would much rather spend their time on making the company better. All of this to say - sure you could solve this problem, but it's actually much more complex than adding some line items to a budget. Source: have watched many big companies try and fail for years to staff unsexy work like this.
- fer 1y ago> It must be a daunting chore to maintain all the legacy pages I always wonder who's the one maintaining the "poke" feature in Facebook.
- bix6 1y agoI thought it was gone but I’m reading it was just hidden but re-added to the UI in 2024. That was always my favorite feature haha.
- paxys 1y agoWhich is exactly why companies are aggressive about deprecating old products and services. "But why can't they just leave them running and not touch it?" Because every such service eventually becomes a security hole. The only secure code is no code.
- okanat 1y agoWhile your argument seems to make sense on the surface, it fails in deeper inspection. What security implications did Google Reader have? I do understand keeping older APIs and endpoints for authentication and authorization are indeed dangerous. However, if your architecture causes the mere clients of those authorization infra to be exploited, I think the problem isn't keeping the products running. You designed something inherently insecure.
- paxys 1y agoIf “what security implications does xyz have” was easy to answer then there would never be another hack or data breach. The simple answer is that we don’t know. And it is very expensive to find out.
- okanat 1y agoI'm indicating that "it isn't easy to answer" is the root of problem there. It means that the engineering teams were incompetent in designing a system with a "narrow waist" security infrastructure. Then the solution isn't deprecating xyz but fixing the security infrastructure. Otherwise the same issues will surface again and again in the newer products.
- DSMan195276 1y ago> You designed something inherently insecure. That describes most/all software older than a decade with no updates applied. How many libraries was Google Reader using that now have known vulns? I'm guessing it's more than zero. This is the same logic as "just don't write bugs", if it was that easy everybody would already be doing it.
- 1y ago
- xivzgrev 1y agoBug bounty program appears to be an efficient spend. For a few thousand dollars they mobilize unpaid people looking for extreme edge cases and then surface these issues. It would’ve cost way more to pay an employee to search for this.
- mmsc 1y agoDepends on the company. Also It can be a good way to say to management, "look, this old deprecated shit needs to be replaced because it's insecure; maintenance is a security issue"
- rkagerer 1y agoYeah, $5k seems awfully cheap considering the effort entailed and the potential impact of this big.
- TorKlingberg 1y agoThe main cost of running a bug bounty program is developer time spent triaging submissions from all the people who just run an automated scanner against your website and submit everything it outputs.
- reaperducer 1y agoIt must be a daunting chore to maintain all the legacy pages. The amount of now-years-old stuff that long-standing sites have to maintain, or choose to maintain, is shockingly high, and testing the combination of all that stuff is impossible. One company I worked for used interns and new hires for that. One of the early tasks assigned to the intern pool was to comb the web sites for outdated information, or things that no longer conformed to the current brand book. The list then went somewhere else so the pages could be updated or deleted. The major benefit of this was giving the new people an overview of what we do, why we do it, and a slice of the history of the products.
- bornfreddy 1y agoOn the other hand they had no idea if the information was valid or wildly outdated. But better something than nothing I guess. :-)
- dylan604 1y agoThis is where modern "learning" falls down. You load a page, read its contents, compare with what it is supposed to be, update if outdated, move on. I know I know, that sounds like, egad, work, but that's called a job. Your immediate dismissal of an actual task I've been assigned irks to the point of being given a snarky response.
- xnx 1y ago> Eventually you will land on a popup that uses the original Gmail look and feel, from 2004. Indeed, I recently ran into a Google page that served up the old (~2013) Catull logo.
- jeffbee 1y agoI tried to guess what it might be ... I went to check moon.google.com, one of the older apps/jokes that I can recall still running. It seems that they got someone to update moon.google.com with a more recent look and feel, and dozens of moons instead of just the one. And people say Google abandons products.
- xnx 1y agoI'll share the url somewhere if I come across it again.
- hayleox 1y agoI was recently editing the Wikipedia page for Google Bookmarks (2005-2021). I wanted to add a logo to the page, but I was having a lot of trouble finding a high-quality copy of the logo anywhere. Eventually I figured out that Google's old URL scheme for product logos was very guessable, and they had never taken it down: https://www.google.com/intl/en-US/images/logos/bookmarks_logo.gif https://www.google.com/intl/en-US/images/logos/bookmarks_log... They'll probably never stop serving those old URLs because who KNOWS where they might still be in use. One of surely a million examples of weird little legacy things Google is stuck with.
- xnx 1y agoThat's good! Cool URLs never die. I thought they would be able to do a more effective search of their codebase to find references to their old logo in their own code.
- hayleox 1y agoI'm sure they could, but to what end? It'd be a bunch of work to find them all, and they could never really be sure they didn't miss one. Meanwhile the cost of just serving that old logo forever is basically nothing.
- ctkhn 1y agoThere are major things at some large enterprises that are given the same level of support. Friend works on an internal link shortener app that is heavily used at their mega corporation and it gets maybe one ticket every other sprint just for upgrading node versions etc even though its monitoring is down.
- Brybry 1y ago> This time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex. +14•••••1779) I've never thought about this but it's extra scary. If you have the same phone number and email address with enough services and they all mask in a different order for reset hints...
- dkdcio 1y agowhat’s the risk? your email being made public? your phone number?
- rvnx 1y agoGet personal info, then call carrier for a SIM swap, access crypto from there. Bonus: no KYC, since it's the other person's identity + you can login from 4G internet, so a trusted IP range.
- shruggedatlas 1y agoWhat can be done to protect oneself from a SIM swap attack?
- sgjohnson 1y agoAbsolutely nothing whatsoever. If SIM Swap doesn’t work, you can always attack SS7. There’s also nothing you can do about that. So stop using your phone number as an authentication factor. It’s trivial to pwn for any actor determined-enough.
- deleted 1y ago[deleted]
- qingcharles 1y agoWhere can I get this though? I haven't been able to get into my main Google account for years because they enabled 2FA without warning and it had a phone number I no longer have. I have the username and password and I get all the emails because I also have the recovery email address. I just need to get the recovery code by SMS.
- jasonthorsness 1y agoTo anyone whose number hasn't already leaked to the B2B SaaS outbound databases: do everything you can to protect your privacy there is still hope for you, the rest of us are already lost
- deleted 1y ago[deleted]
- ge96 1y agoI think it's hard to top Equifax's breach/leak
- xp84 1y agoIndeed, I think if our government weren't absurdly corrupt and incompetent that breach should have triggered two things: 1. Announce a timeline to publish SSNs publicly for all people (forcing function for businesses who might drag their feet) 2. Before #1 comes to pass, issuance of actual credentials to replace SSNs for multiple purposes, credentials that A. can be validated in an online process B. you can get multiple credentials that all tie back to a secure identity for credit reporting purposes, and you can be notified when new credentials are generated C. and (*crucially*) can be invalidated for future use when compromised 3. Regulation of the consumer credit reporting industry to force them to only report future credit report lines where identity was validated according to the new process, not just from "1FA" based on a number the credit industry themselves already leaked for the whole country. #2 is not easy! It would be a massive project. But it's hard to argue that keeping the absurd "secret 9 digit number" joke going isn't even less viable than taking that project on would be.
- Phil_Latio 1y agoMaybe this specific exploit was already known for a long time to an illegitimate actor, because legit actors saw past rewards and simply gave up too early. $5000 (after complaining lol) really is a joke.
- deleted 1y ago[deleted]
- PeeMcGee 1y agoWow, if I needed any more proof Google is a ghost ship then this is it. The $5K bounty is an insult, and the fact that they low-balled it in the first place makes them look like absolute clowns. Good on you for calling out how little of a shit Google gives about actually protecting user data.
- deleted 1y ago[deleted]
- jcims 1y agoNobody is forced to participate in a bug bounty. If you don't like the rewards, don't do it. There's a limit to the financial viability of these programs.
- raxxorraxor 1y agoThis is why there need to be strong fines associated with such security issues. That would provide financial viability enough. Even if the issue wasn't abused, it looks like data already leaked.
- sjg1729 1y agoIf the bug bounty program doesn’t pay out much, there will be plenty of less reputable actors happy to pay more
- dns_snek 1y agoWho's talking about participation? We can be appalled by their business practices as their customers (actual or potential). These are the same companies that tell us that our privacy and security is their #1 concern, and use that justification to take away our rights "for our own good", but when there's a real threat they address it with with a business-casual equivalent of "fuck off".
- miyuru 1y agoTIL about another google product I knew nothing about. https://lookerstudio.google.com https://lookerstudio.google.com
- whalesalad 1y agoYou are blessed to have not been harassed by your GCP rep to attend a demo of this software.
- paxys 1y agoNot a homegrown product. Looker was a pretty popular tool for data analysis and visualization and was acquired by Google a while ago.
- datadrivenangel 1y agoLookerstudio was formerly google data studio, which was homegrown at google!
- deleted 1y ago[deleted]
- AtomicByte 1y agoThis is super creative and cool. Brutecat back at it again heh
- deleted 1y ago[deleted]
- paxys 1y agoNeat find, though it's funny to me that a phone number is something people (including everyone on this thread I bet) have been handing out like candy their entire adult lives - to friends, stores, banks, employers, government agencies, random websites – but still expect it to remain some critical secret that no one should ever find out. A phone number is about as private as your name, and you should consider it as such.
- deleted 1y ago[deleted]
- beezlewax 1y agoNo it isn't. You give it to people you trust mostly you don't expect them to make it available publicly on the Internet.
- paxys 1y agoYou really trust that not a single friend of yours has ever clicked the "share contacts" button after downloading Facebook/Instagram/Snapchat/LinkedIn/TikTok...? You trust that your auto dealer or bank has not shared your details with Experian (even though you signed a piece of paper explicitly authorizing that)? You trust that your mobile operator itself isn't sharing your contact data with advertisers (go back and read your carrier agreement)? You trust that your grocery store's membership system has fool-proof IT security? Look up "recent data breaches" on Google and see how many of those companies/hospitals/government agencies you had a relationship with. I can guarantee that despite your best efforts and "trust" your phone number is accessible in a few clicks to anyone who cares to look.
- xp84 1y agoI feel like both sides are right here: 1. Google shouldn't make it trivial to find out my phone number from my email. Given that even Google itself, despite having better technology available, still allows the dumpster that is SMS verification to be used as an auth "factor," they should not be enabling SIM-swapping so directly. Just knowing someone's number makes it trivial to social engineer a SIM-swap, and that can likely unlock every account most people have, and a lot of important accounts (like banks) even for security-minded people, since banks love SMS and hate everything else. 2. I shouldn't act like my phone number is a well-protected secret, or trust that anyone who calls or texts me has gotten it from a trusted source.
- atum47 1y agoI did something similar way back when I was trying to find the phone number for a person, using Facebook. When recovering a password Facebook would give you most of the digits of the phone number, so I wrote them down in a vcard file and imported it on my phone to just look at the pictures. It worked surprisingly good.
- VladVladikoff 1y agoThere is also a similar hole with Google profile photos and other Google apps. For example if you see a review by John Smith on Google maps, you add emails on Google Hangouts, guess a bunch of variations like johnsmith@gmail.com, smithjohn@gmail.com etc and see the profile photos to compare the match.
- dheera 1y agoThis is why I don't use a real phone number with any of these services. They don't need my phone number to operate either.
- shwouchk 1y agog has been demanding a valid phone for years, as have most other major providers. if you lose the number you sign up with, you can potentially get locked out of the account. whats your mo?
- mystifyingpoi 1y agoNot sure how it looks in USA, but in EU you can get a prepaid SIM card for $2 and use it forever for cases like this. You'll probably have to top it up with another $1-2 if used sparingly, but that's the price of such separation.
- deleted 1y ago[deleted]
- extraduder_ire 1y ago
- zerof1l 1y agoThis article highlights something interesting... it is quite common to get at least one /64 IPv6 block from a hosting provider or ISP. Yet most of the rate-limiting and IP blocking is done for a single IP. Sounds like when dealing with IPv6, an entire block of /64 should be rate-limited or blocked.
- punnerud 1y agoWhat if the user only get one address, how to separate the two? Seems like a need to share if a larger block (providor) is handing out based on blocks or single addresses…
- stackskipton 1y agoSay what? IPv6 was designed that first 64 bits are network, last 64 bit are host. Since /64 is smallest network in IPv6 and because of that most providers hand out /64 when you ask for IPv6 public address because A) Most Rate Limiting uses /64 and B) IPv6 has so many IPs, no one cares. Vultr has at least one /32 I was able to find (2001:19F0::/32) which if you cut that into /64 comes out ~4.2 Billion different networks or same amount of IPv4 address that exist. ARIN will hand anyone who asks a /48 IPv6 subnet which 65,536 unique networks and getting larger prefix is not hard.
- growse 1y ago> Since /64 is smallest network in IPv6 A /64 is not the smallest network in IPv6. Nothing stops you having a /112 or a /126 or whatever you like. It is the only network size on which SLAAC works however, so it's a good choice for lan sizes.
- stackskipton 1y agoI'm talking practical. I know you can reduce networks further BUT there is plenty of stuff that could break.
- 1y ago
- RankingMember 1y ago> 2025-05-15 - Panel awards $1,337 + swag. Rationale: Exploitation likelihood is low. (lol) Oh, so this is how vendors are going to start playing it to minimize bug bounty costs, huh? Good luck with that- the whole point of the award being a decent chunk of change is to make responsible disclosure more appealing to researchers who might otherwise go the other direction.
- deleted 1y ago[deleted]
- xp84 1y agoI run the BBP at work and we have gotten great reports from it that I'm really glad we didn't find out the "bad" way. But I kind of think that, instead of any person or group of people choosing between "submit to a BBP" or "sell a 0-day to evil state actors or dark web clients" a BBP is better seen as allowing you to employ stunningly smart and ethical researchers in India (where a $2k bounty goes pretty far) to find all your vulns ASAP so that you have way fewer vulns for the actual bad guys to find. A pretty good "High" vuln is so valuable to people like CIA, FSB, Mossad, etc, not to mention terrorists, money launderers, etc. that it would be hard to compete with those guys financially if we were dealing with strictly economically rational but amoral researchers. We've paid thousands to a couple of the same researchers, and it's money well spent.
- VladVladikoff 1y agoI’m mostly impressed that he can throw 40k requests per second at a server for a prolonged period and not somehow spike the resources enough to set off some alarms.
- kevindamm 1y agoit is possible that it did throw an alarm but the behavior ceased soon enough afterwards that it didn't escalate to alert-level paging, or that -- even if it did -- those resources were back to normal within a few minutes that it took to open laptop, password password OTP, link-following and graph-referencing annnd oh it's already coming back down before the status update is drafted. And 40kqps isn't really much at the scale of Focus (or most of Google's APIs) so I could easily see it going under the radar, especially each using different IP addrs and with IPv6 across /64. The gap worth noticing here isn't monitoring, though, it's the zero rate limiting on js_disabled flow using a token borrowed from an earlier js enabled flow.
- amelius 1y agomaybe he used a botnet for that? i.e. different IP address for every request or somewhere in between
- userbinator 1y agoFor comparison, Google apparently processes about 160k search queries per second.
- helsinki 1y agoThese bug bounties pay peanuts. Sad.
- RankingMember 1y agoThey're only hanging themselves by cutting the bounties like this.
- garrettgarcia 1y agoAnything under $100k for this is pathetic.
- yapyap 1y agoIt seems that these services forget what happens when white hats stop reporting this because of that :/ Corporate greed sucks for all
- EGreg 1y ago2025: https://qbix.com/blog/2025/06/06/%e2%80%9cno-way-to-prevent-this%e2%80%9d-says-only-industry-where-this-regularly-happens-posted-on-june-12-2023-by-qbix-2023-edition-in-the-hours-following-a-massive-data-leak-where-data-from-alm/ https://qbix.com/blog/2025/06/06/%e2%80%9cno-way-to-prevent-... 2023: https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens-2/ https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says... 2021: https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens-2/ https://qbix.com/blog/2023/06/12/no-way-to-prevent-this-says... Which is funnier?
- extraduder_ire 1y agoYou used the same link for 2023 and 2021. Should probably be https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says-only-industry-where-this-regularly-happens/ https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...
- cryptonector 1y ago> 2025-05-15 - Panel awards $1,337 + swag. Rationale: Exploitation likelihood is low. (lol) Yeah, no, the exploitation likelihood of this is very high. The number of users who might have their phone numbers revealed might be low, but I guarantee you that private investigators, detectives, criminals, etc. would all use this if they needed it and it was there.
- Duskgmxx 1y ago[flagged]
- userbinator 1y agoThere are problems which are difficult to solve even with immense computing power, which will confuse even powerful LLMs, but which humans can easily solve. That won't require JS, yet be a big obstacle to attackers. IMHO the biggest reason why such solutions aren't more widely deployed is because the incumbent wants to keep its effective browser monopoly. can be easily exploited by script kiddies using large proxy networks Such a scheme would need a large amount of LLMs or actual (intelligent) humans too. Google clearly wanted to make account recovery accessible even without JS Unfortunately, they made authentication require JS.
- Noelia- 1y agoI’ve used plenty of forgot password forms before and entered my phone number to recover accounts, but I never really thought about how much information they could actually leak. It reminds me of those recovery flows from back in the day, where even just the last couple of digits of a phone number could end up being a real vulnerability for attackers. It’s surprising how something that seems harmless, like a simple recovery page, can actually hide some pretty serious security risks.
- packtreefly 1y ago> It’s surprising how something that seems harmless, like a simple recovery page, can actually hide some pretty serious security risks. This is something you should include in any personal security checkup. Attempt account recovery using every allowed mechanism. The rules for recovery change over time in a way that classical login doesn't.
- vaseem 1y agoBtb. Thank you !
- curtisszmania 1y ago[dead]
- atemerev 1y agoIf you didn't change your phone number in the last two years or so, it is most probably in one of the data leaks that could be downloaded by anyone.
- ray023 1y agoVERY discouraging to anyone considering being a white hacker. "Likelihood low" and only 5k bounty for this is pathetic.
- codedokode 1y agoI am sure some governments including mine would gladly pay more than $5 000 for this.
- gcanyon 1y ago> Vendor confirms that the No-JS username recovery form has been fully deprecated It seems like there are probably people out there with JS disabled for whatever reason who still might need to recover their password?
- gcanyon 1y ago> This request allows us to check if a Google account exists with that phone number as well as the display name "John Smith". Shouldn't the rate limit be set here, related to the display name "John Smith"? You get 5 "John Smiths" for free in the first minute, then 5 more in the first hour, then 5 more in each day going forward. With the same million phone number combos you'd need roughly half a lifetime (10,000 days) to get the hit on average.