Forgot your password?
typodupeerror
Privacy Communications Crime Facebook

Facebook Lets You Harvest Account Phone Numbers 185

Posted by timothy
from the this-is-ann-from-account-services dept.
Frequent contributor Bennett Haselton writes with some strong cautions on a Facebook "feature" that lets you search for random phone numbers and find the accounts of users who have registered that number on their Facebook profile. This has privacy implications that are more serious than searching by email address. Especially in light of the expanding emphasis that Facebook is putting both on search qua search and on serving as a VoIP intermediary (not to mention the stream of robocalls that the FCC is unable to stop), this might make you think twice about where your phone number ends up. Read on for Bennett's description of the problem and some possible solutions.

A few weeks ago a friend of mine said she was getting harassing text messages from a particular phone number, which she didn't recognize and which didn't appear in any of her own records. On a whim, I suggested entering the number into the Facebook search box, whereupon we found the guy's profile (even though he had no friends in common with the account we were logged in under), realized who he was, and ratted the thirty-something out to his Mom.

Then I thought: Is it really a good idea, for this to be possible? I tried entering consecutive phone numbers (starting with a random valid number, and varying the last 2 digits from 00 to 99) into Facebook's search box, and 13 of them came up with valid matches. None of those matches had any friends in common with the account we were searching from; as far as I can tell, anybody could enter any phone number into Facebook's search box and find the account associated with it, if there is one.

I think this has non-trivial privacy implications. (I repeatedly contacted Facebook explaining why I think this is a problem, but they haven't responded.) I'm not talking about the ability to find the account associated with a particular phone number — I think relatively few people have a legitimate need to send text messages from a truly anonymous phone number, and if they do, it's their own fault if they're dumb enough to put that number on their Facebook profile. And it wouldn't be a practical way to unmask the phone number associated with a particular account, either — even if you knew the person's area code, and narrowed down the list of possible exchange numbers following the area code, you'd still have to try tens of thousands of possibilities.

Rather, the problem is that you could use this technique to build up a database of phone numbers and associated accounts without targeting any specific phone number or account. Not only would you know the names associated with each of the numbers, you could associate the phone number with anything else that was discoverable from the person's Facebook profile &mdash which usually includes their location, their interests, and the names of their other friends. (By default, all such information is visible on your Facebook profile — even to users who aren't your Facebook friends and have no friends in common with you — but your contact information is supposed to be hidden from other users unless you've confirmed them as friends.)

An attacker could do this with email addresses too, of course, if they had a long list of email addresses known to be valid, by searching to see which ones were associated with Facebook accounts. Or they could supplement it with a list of automatically generated email addresses like john001@hotmail.com, john002@hotmail.com, similar to what spammers use in a dictionary harvest attack, and hope that some of those would map to valid accounts as well. The difference is that because the space of possible email addresses is effectively infinite, and because many people use email addresses on Facebook that aren't on any publicly circulating databases, an email search would probably not hit more than a small portion of Facebook accounts that were searchable by email address. On the other hand, since the space of possible phone numbers is finite, with enough patience you could uncover every Facebook account that had an associated phone number. As my short experiment above showed (13 out of 100 random numbers mapping to accounts), you could start building up a list of valid hits pretty quickly.

Similarly, it's already trivially possible for an attacker to build up a long list of other users' Facebook accounts - start with one person's account, go through their friends list, then visit the profile of each of those users and index their friends list, etc., like a search engine recursively spidering the Web. However, you'd be left with a large list of Facebook accounts but no way to contact them — you wouldn't have their email addresses or phone numbers, and if you send a message to a non-friend on Facebook, it goes into a subfolder of their Inbox marked "Other", which most users never check. The phone number dictionary attack described above, is the only loophole I can think of that lets you harvest a large list of Facebook users and a means to contact them in a way that they will actually see.

What could somebody do with such a database? Well, even if you only had a small list of a few thousand people, you could try spamming or scamming the numbers via text message. SMS scams are nothing new, of course, but they would probably be more effective if supplemented with the details you could get from a person's Facebook profile. (For straight-up spam, you can target it based on the interests listed in a person's profile. For scams, remember that you can use names taken from a person's friends list: "Hi, this is Jessica Smith. I have to pay off a parking ticket online or my car will get towed; can I borrow your credit card number and then I'll pay you tomorrow?")

Or if you spidered so many accounts that you built up a database which included a significant portion of all Facebook users with phone numbers on their profile, you could even launch your own publicly searchable website, splattered with grey-market pop-up advertisements: "Look up any Facebook user's phone number! If they've got their number on their Facebook profile, we have it here!" (While this would certainly raise awareness of the problem, I think it's more likely that the data harvester would decide they could make more money trading the data on the black market.)

I haven't seen this issue raised anywhere else, but lest you accuse me of "giving the bad guys ideas", I do think it's sufficiently obvious that some people on the dark side have probably discovered it, or would have, even if I hadn't brought it up. And even if any of these outcomes is unlikely, it would only have to be done once, to put the users' data permanently in the hands of the attackers, with Facebook unable to put the cat back into the bag. (Although they could at least rectify the problem for new users going forward.)

Balanced against this, what is the upside of being able to search for someone's profile on Facebook using their phone number? In my Facebook-using days, I never did it, since it was always easier to find someone using their email address, or by searching for their name, or by finding them in the friends list of one of our mutual friends. But even in a case where all you had was the person's phone number, is it too much to text them and ask for their first and last name, or their email address, so you can add them on Facebook?

Although Facebook did not respond to my inquiries, it's true that the existing behavior doesn't technically look like a violation of their Privacy Policy ("To make it easier for your friends to find you, we allow anyone with your contact information (such as email address or telephone number) to find you through the Facebook search bar..."). And I verified with a new test account that by default, in your privacy settings, under "How You Connect", the setting "Who can look you up using the email address or phone number you provided?" is set to "Everyone." The problem is that this setting casually lumps the two together, and users — as well as Facebook itself — might not realize that the implications of being findable by your phone number, are different from being findable by your email address.

Facebook should probably just go ahead and block searches by phone number — or, at least, make you fill out a CAPTCHA every time you do a phone number search, to make it harder to harvest them in bulk. There's no way to know if scammers are trying this already, but at least we can prevent it going forward. That would require a small edit to Facebook's privacy policy, but luckily for them, they can now do that without even calling a vote.

- - - - - - - - - - - - - - - - - - - - - - - - - - Do you have a feature idea for Slashdot? Contact us at feedback@slashdot.org, and give us a heads-up!

This discussion has been archived. No new comments can be posted.

Facebook Lets You Harvest Account Phone Numbers

Comments Filter:
  • by gstoddart (321705) on Thursday January 17, 2013 @02:10PM (#42618491) Homepage

    They want your information so they can sell it. They want as much as they can possibly get.

    Do you think Facebook even try to protect your privacy? They write a feature which you might want, but which mostly benefits them.

    And they've shown time and time again, they're not very good at even trying.

    That fact that Zukerfucks sister got burned with privacy settings says they're deliberately obtuse.

    Sure, Facebook could do all sorts of things to protect your privacy, but that's now how they get paid.

  • by joocemann (1273720) on Thursday January 17, 2013 @02:22PM (#42618609)

    Forgot to mention.

    You're not as important as you think you are. Chances are good that your phone number is useless to people that don't already have it.

  • by Anonymous Coward on Thursday January 17, 2013 @02:25PM (#42618651)
    Why are you people still even on Failbook in the first place? Are you really such sheep that you just have to be there "because everyone else is"? If everyone else jumped off a cliff would you follow them to your death? Don't be a Lemming.

    o Facebook does NOT have your best interests at heart. You're just a "product" that it sells to advertisers.
    o "I have nothing to hide" is a bullshit reason to post your whole life on the Internet. You really think the government and corporations aren't mining that data to predict -- and ultimately control -- your life? Wise up.

    o "I want to stay connected to people". Here's a radical idea: How about you actually see people in person and interact and "connect" with them that way? This is what you people don't seem to get: The Internet does NOT "connect" anything except computers; your "friends" on Facebook are not your "friends" unless you actually SEE them and TALK TO THEM in person on at least a semi-regular basis. Failbook "friends" may as well be machine intelligence pretending to be people for all you know. Words on a page do not constitute a relationship!

    You and everyone you know who says it is wrong: Your privacy is worth something, and it is real. Don't give it away to some fucking corporation, don't give it away to ANY government for ANY reason. The Internet is not your "friends"; it is just HARDWARE. Meet with real, live people; spend time with them, TALK to them, KNOW them, not just words on a page.
  • by Cro Magnon (467622) on Thursday January 17, 2013 @02:37PM (#42618793) Homepage Journal

    The phone books of the past gave a name, address, and phone #. FB will give name, address, phone, blood type, school, job, gross pay, and your vacation plans.

  • by QuietLagoon (813062) on Thursday January 17, 2013 @03:11PM (#42619125)

    I'd think actually the number collection is so that the next time you go in, they can put your phone number in and ID you... "Do you have a discount card? Do you have it with you?? No, can I get your phone number? There you are!"

    Most small shops don't (yet) have the smarts/connections to sell customer data. But the potential IS there, yes.

    If they are big enough to have a customer card, then they have the smarts/connections to sell customer data. Indeed, the customer card service is probably run for them by a data collection company.

    .

  • by idontgno (624372) on Thursday January 17, 2013 @04:55PM (#42620171) Journal

    The sending address? The spoofed sending address which is either (A) one of the other spam victims, or (B) a joe-job designed to slander and inconvenience someone the spammer has conceived a grudge against?

    I guess hilarity will ensue when you receive a spam you sent yourself, according to the sending address you naively trust.

Never buy from a rich salesman. -- Goldenstern

Working...