Update: someone pointed out that PayPal actually reveals the last four digits of the phone numbers, so this technique may work for large countries as well if the target has its phone linked to its PayPal account.
Last month, I discovered it is relatively simple to reveal private phone numbers on Facebook, uncovering some phone numbers of Belgian celebs and politicians. Even though this trick only seems to work in small countries such as Belgium (+/- 11.2 million people), a significant number of people is affected by this simple, yet effective privacy leak.
When I notified the fine folks of the Facebook Security team with my concerns, I got an answer I didn’t quite expect:
When the “who can look me up by phone” setting is set to public, your phone number is public.
There are a few issues with this:
- The setting is set to public by default
- It’s confusing: even though your phone number on your profile is set to ‘only me’, the ‘who can look me up’-setting overrules this. While people think their phone number is private, it’s not:
‘Who can look me up’ also implies the person ‘looking you up’ already has your phone number. It implies that someone if looking for your specific Facebook profile based on your phone number, and not the other way around.
- There is simply no only me setting
Despite sharing my concerns with the security team, they decided not to fix the issue. Even though I do not agree I respect their decision. I did decide the write about it nonetheless — I think people have the right to know.
- Many people don’t even know Facebook has their phone number. While Facebook can not just extract your phone number from your phone, it will repeatedly ask you to confirm and save your number upon launching Facebook for mobile. After a colleague deleted his phone number following my findings, Facebook immediately asked him to re-enter it:
How it works
My technique uses the graph search. Most people knows that you can enter a phone number in the Graph Search to get the corresponding user:
STEP 1: The last two numbers (1 minute)
I had to find a way to test thousands of phone numbers at once. The less phone numbers I’d have to test, the quicker I could get to the full number. To eliminate the last two numbers, I used Facebook’s password reset functionality:
STEP 2: The provider number (5–35 minutes)
Here’s a typical Belgian phone number, where X equals any number from 0–9, and PP equals the provider number. I already filled in the last two digits we got in the previous step.
04PPXXXX50
(Less than 400,000 possible numbers)
Provider numbers are linked to the mobile phone provider:
Some provider numbers are more widely used than others. People working for the government most likely have a 047 number, as Proximus is the state-sponsored provider.
At this point, I wrote a program that would make a contact list with every possible number starting with, let’s say, 0479:
Then imported this list in the ‘find friends’ functionality and checked the suggested friends
No luck for 0478, either. I had to switch accounts at this time because Facebook only allows 20,000 contacts to be imported in a short timespan. I logged into another test account, tried with 0477 got “third time lucky”:
So at this moment we can add the provider number:
0477XXXX50
STEP 3: Narrowing down (10–15 minutes)
The last part only consists of some simple math: we have 10,000 possible numbers left, so if we test half of those numbers we can narrow down our pool to a handful of numbers, for example:
0477 0000 50 — 0477 5000 50
The target was present in this range, so this means that the fifthnumber is either 0, 1, 2, 3 or 4. 5000 [0000–5000] possible numbers left.
Let’s divide the 5000 numbers that are left by two again.
Testing for 0477 0000 50 – 0477 2500 50:
STEP 4: The final countdown (1 minute)
With only 40 possible phone numbers left, it is pretty easy to test all the numbers that are still in the pool. Just enter them in the search bar until you hit the profile you were looking for.
I informed the minister about this privacy leak. In a statement he said he didn’t know Facebook was leaking is phone number, but he personally doesn’t really mind as long as there’s no abuse.
