Getting a personal phone number by analyzing and sorting through social resources and accounts

[НСК-СБ]

Obtaining a personal phone number through analysis and enumeration of social resources and accounts

In our era of information, any technology that you use can be potentially used to attack. A telephone number is no exception.

In the case below, we will show how dangerous it is to use the binding of a single phone number to all accounts used online. We will show how this allows you to find out your personal number.

The situation described below may seem trivial against the background of vulnerabilities such as, for example, recently described for T-Mobile users . In this case, the attacker could gain full access to the personal data of any T-Mobile subscriber simply based on his phone number. This data included number status and registration date, IMSI code, email address, answers to secret questions and even data regarding the date of the last change of the password for access to the account.

All this information made it easy to initiate the process of replacing the SIM card, after which the attacker got virtually full access to the phone, could make calls, send and receive messages, etc.

No, an attack with such a significant gap will not be considered in the method described below. It will be easier and closer to real life.

Intelligence service

One of the young developers of the popular XDA Developers resource was chosen to demonstrate this vulnerability. On the forum of this resource authors often post a lot of information about themselves, which we will use. Looking ahead, we’ll say right away that the developer was not injured in the end and was notified of problems with his safety before writing this article.

The vulnerability was also tested on a resident of the United States, who was also subsequently notified before writing the article.

First, the attacker determines the location of the victim. This part is extremely simple - a lot of people write their countries and even cities in the profiles of social networks - including Facebook. In our case, the developer did not hide the fact that he was from South Korea and was even proud of it, and a resident of the USA actively painted the features of life in New York.

In addition, the attacker will need the victim's email address, which is also not a problem in most cases.

After some of these preparations, the cracker goes to the “Lost Password” page on Facebook and provides the email address or username of the victim. If this data matches the existing user of the social network, and the victim indicated the phone number as a means of password recovery, we will see the last two digits of this number:

Our victim identified PayPal as one of the sources of encouragement for his work on XDA. A New York-based victim also actively shared her eBay shopping experience on Facebook and also had a PayPal account. Visit this site and try to recover the password by entering the victim's email address:

We got four more numbers.

Having carefully studied the victim’s activity with XDA, we find that she is very active in developments using the latest 4G networks. Based on open sources, we conclude that the victim number starts at 010.

In the case of a US resident, knowledge of the city - the location of the victim also significantly reduced the number of possible codes if the first digit is known:

As a result of our work, it remains for us to pick up only three digits of the phone number - what does the first three digits mean. Usually the list of such combinations is not very large and in some cases even publicly available, especially in relation to the USA:

Finally, the attacker will have to manually send and verify the phone numbers from the received list on the Facebook login page until the victim’s full name is found or the desired email address is displayed, which confirms the correspondence of the number:

It should be noted that you can automate this part of the process using a Python script.

Thus, an attacker can find out the victim’s personal phone number.

You can also additionally check whether the received phone number belongs to the victim, using various other methods using open sources.

For example, if a certain parameter is not configured on Facebook, your full name and profile picture will be displayed to everyone who sends your email address or phone number on the "Lost Password" page. Similarly, the function “Forgot email address. mail? " from Google allows you to check whether the name matches the phone number:

conclusions

Thus,

1. The attacker uses Facebook to determine the location of the victim, as well as the last two digits of the phone number
2. Paypal is then used to determine the extra digits of the phone number. Paypal also validates Facebook data.
3. The location code and the first digit of the number determine the region code - or variants of this code.
4. The remaining missing numbers are determined by a simple exhaustive search, which can be reduced according to the rules for compiling numbers of a particular operator. These numbers are inserted into the Facebook form “Lost Password” before the victim’s name or known email address is displayed.

The above sites are selected only to demonstrate the ability to search and select a phone number. In fact, there are a lot of such sources of information, and far from all limit the possibilities of automated sorting of captcha - and therefore scripts allow you to iterate and find a match in a fairly short time.

Protection from the above attack scheme is to use different phone numbers when registering on different resources or to limit the ability to use phone numbers to recover a password, gain access to a resource, etc.

PS If someone found the material interesting enough to master the second part - about the risks of using virtual number services for receiving SMS when registering on Internet resources, then welcome here .
Obtaining a personal phone number through analysis and enumeration of social resources and accounts

 

[Частный детектив. Ильдар. Уфа.]

Who will tell you what popular domestic resources can be used for such intelligence?

 

[Павел Эндельман]

Who will tell you what popular domestic resources can be used for such intelligence?

I apologize for the answer, but in Russia the best service for breaking through phones is DPS posts, or PPS patrols. 500r + savvy