Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

9/5/2019
11:15 AM
100%
0%

419M Facebook User Phone Numbers Publicly Exposed

It's still unclear who owned the server storing hundreds of millions of records online without a password.

An unsecured server exposed 419 million phone numbers belonging to Facebook users, whose information was stored in several databases without password protection, TechCrunch reports.

The records spanned Facebook account holders in countries including the US (133 million), UK (18 million), and Vietnam (50 million). Each record held an individual's Facebook ID, which is a unique number connected to the account, and the person's phone number. Some also held the user's name, gender, and location. Affected databases were taken offline by the hosting provider.

User phone numbers have not been publicly available on Facebook since 2018, when the social media giant removed developers' access to them. It's believed whoever scraped the numbers did so before Facebook changed its policy allowing users to find friends using phone numbers. The identity of who scraped the information and why has yet to be confirmed, the report says.

Facebook has so far not seen any indication that user accounts have been compromised. Exposure of a phone number can leave victims susceptible to SIM swapping and spam calls.

Read more details here.

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Meet FPGA: The Tiny, Powerful, Hackable Bit of Silicon at the Heart of IoT."

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
9/5/2019 | 12:22:52 PM
On Phone Numbers
Hacked for decades - it is called a phone book and contains (GASP!)   NAMES ----- ADDRESSES ----- PHONE NUMBERS OH MY!!!!!!!!!! Some hacks are just silly. 
44% of Security Threats Start in the Cloud
Kelly Sheridan, Staff Editor, Dark Reading,  2/19/2020
Zero-Factor Authentication: Owning Our Data
Nick Selby, Chief Security Officer at Paxos Trust Company,  2/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5244
PUBLISHED: 2020-02-24
In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2.
CVE-2020-5245
PUBLISHED: 2020-02-24
Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-vali...
CVE-2020-9369
PUBLISHED: 2020-02-24
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.
CVE-2019-10796
PUBLISHED: 2020-02-24
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
CVE-2019-10798
PUBLISHED: 2020-02-24
rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.