The person selling access to the service claims it has data on 500 million Facebook users. A user of a low-level cybercriminal forum is selling access to a database of phone numbers belonging to Facebook users, and conveniently letting customers look up those numbers by using an automated Telegram bot. Although the data is several years old, it still presents a cybersecurity and privacy risk to those whose phone numbers may be exposed—one person advertising the service says it contains data on 500 million users. Facebook told Motherboard the data relates to a vulnerability the company fixed in August 2019. “It is very worrying to see a database of that size being sold in cybercrime communities, it harms our privacy severely and will certainly be used for smishing and other fraudulent activities by bad actors,” Alon Gal, co-founder and CTO of cybersecurity firm Hudson Rock, and who first alerted Motherboard about the bot, said. Do you work at Facebook, or know about another data breach? We’d love to hear from you. Using a non-work phone or computer, you can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox @jabber.ccc.de, or email joseph.cox @vice.com.
Upon launch, the Telegram bot says “The bot helps to find out the cellular phone numbers of Facebook users,” according to Motherboard’s tests. The bot lets users enter either a phone number to receive the corresponding user’s Facebook ID, or visa versa. The initial results from the bot are redacted, but users can buy credits to reveal the full phone number. One credit is $20, with prices stretching up to $5,000 for 10,000 credits. The bot claims to contain information on Facebook users from the U.S., Canada, the U.K., Australia, and 15 other countries. Motherboard tested the bot and confirmed it contained the real phone number of a Facebook user who tries to keep this number private. In 2019, researchers found it was possible to scrape Facebook users’ phone numbers en masse.
via motherboard: Bot Lets Hackers Easily Look Up Facebook Users’ Phone Numbers