Facebook loophole exposes private phone numbers, here’s how to close it

Security is one tough business, as it seems like every day brings a new flaw or vulnerability. Today’s finding is a big one, since it could impact nearly 1.5 billion Facebook users.

Reza Moaiandin, the technical director at the Salt Agency, discovered a flaw with Facebook that could allow hackers to figure out your phone number, even when it’s set to private. Here’s how it works, and how to protect yourself.

How it works

Facebook’s search box allows you to find potential friends on Facebook by simply typing their name, but many people don’t know that you can also enter phone numbers and receive results. If you think that setting your phone number to private will stop it from showing in search results, think again. Setting your phone number as private only stops it from appearing in your personal profile when non-friends are viewing it.

Facebook has an additional setting that allows anyone to search for you based on your phone number or your email address, and it’s set to Public by default. This means that anyone (friend or non-friend) entering your phone number in the Facebook search box will get information such as your name, location, and profile picture. That’s OK if the person actually knows your number, because they are most likely an acquaintance, a personal friend, or a family member.

The problem arises because a hacker can write a simple script with millions of phone numbers following a pattern for a certain area. They can then use Facebook’s API to conduct a search and get results within minutes. Imagine how devastating this would be for celebrities and politicians, especially since most people are using their mobile number exclusively these days.

To prove Moaiandin’s finding, we typed in a few phone numbers of non-friends in the Facebook search box, and bingo, the name of the person, location, and profile photo appeared for each number just like if we had typed their name. Of course, this method would be super slow since you would have to enter in each possible phone number, but it proves the flaw exists. If we wrote a script and used Facebook’s API, we could have millions of phone numbers along with who they belonged to within minutes.

What can Facebook do?

Moaiandin is advising Facebook to simply limit the amount of requests per user and detect patterns. This would be a good start, but encrypting data would be the best-case scenario.

He first contacted Facebook in April 2015 with his findings, but the first engineer didn’t understand the issue. After waiting a bit, Moaiandin notified the company again last month, and one engineer replied with, “Thanks for writing in. I investigated our codebase and it does appear to implement rate throttling. Note that the rate limits may be higher than the rate you’re sending to our servers, therefore you do not appear to be blocked. This is intentional. We do not consider it a security vulnerability, but we do have controls in place and mitigate abuse.” In other words, Facebook has some controls to prevent hackers from gathering mass phone-number lists, but they aren’t strict enough.

How to defend yourself in less than a minute

Good news! You don’t have to wait until Facebook wakes up and fixes this issue.

We contacted Reza Moaiandin and can confirm that if you follow the steps outlined below from either a desktop or a smartphone, your phone number will not be visible to hackers trying to use a script, or any random person who happens to enter it in the Facebook search field. We urge everyone to do this now, since it takes less than a minute to do.

From a desktop

Open Facebook in your browser, click on the upside down triangle at the top right, and select Settings.
Select Privacy from the left pane.
Find Who Can Look Me Up under Privacy Settings and Tools
Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
You will also notice an option for Who can look me up using the email address you provided? You can change this as well if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

From your smartphone

In the Facebook app, tap on the hamburger icon (three lines) at the top right and find Account Settings.
Tap on Privacy.
Find Who Can Look Me Up under How You Connect.
Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
You will also notice an option for Who can look me up using the email address you provided? You can change this if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.