Skip to main content
  1. Home
  2. Social Media
  3. News

Facebook loophole exposes private phone numbers, here’s how to close it

By

facebook phone number hackers flaw search shutterstock 202780831
Shutterstock / Bloomua
Security is one tough business, as it seems like every day brings a new flaw or vulnerability. Today’s finding is a big one, since it could impact nearly 1.5 billion Facebook users.

Reza Moaiandin, the technical director at the Salt Agency, discovered a flaw with Facebook that could allow hackers to figure out your phone number, even when it’s set to private. Here’s how it works, and how to protect yourself.

Recommended Videos

How it works

Facebook’s search box allows you to find potential friends on Facebook by simply typing their name, but many people don’t know that you can also enter phone numbers and receive results. If you think that setting your phone number to private will stop it from showing in search results, think again. Setting your phone number as private only stops it from appearing in your personal profile when non-friends are viewing it.

If we wrote a script and used Facebook’s API, we could have millions of phone numbers within minutes.

Facebook has an additional setting that allows anyone to search for you based on your phone number or your email address, and it’s set to Public by default. This means that anyone (friend or non-friend) entering your phone number in the Facebook search box will get information such as your name, location, and profile picture. That’s OK if the person actually knows your number, because they are most likely an acquaintance, a personal friend, or a family member.

The problem arises because a hacker can write a simple script with millions of phone numbers following a pattern for a certain area. They can then use Facebook’s API to conduct a search and get results within minutes. Imagine how devastating this would be for celebrities and politicians, especially since most people are using their mobile number exclusively these days.

To prove Moaiandin’s finding, we typed in a few phone numbers of non-friends in the Facebook search box, and bingo, the name of the person, location, and profile photo appeared for each number just like if we had typed their name. Of course, this method would be super slow since you would have to enter in each possible phone number, but it proves the flaw exists. If we wrote a script and used Facebook’s API, we could have millions of phone numbers along with who they belonged to within minutes.

What can Facebook do?

Moaiandin is advising Facebook to simply limit the amount of requests per user and detect patterns. This would be a good start, but encrypting data would be the best-case scenario.

He first contacted Facebook in April 2015 with his findings, but the first engineer didn’t understand the issue. After waiting a bit, Moaiandin notified the company again last month, and one engineer replied with, “Thanks for writing in. I investigated our codebase and it does appear to implement rate throttling. Note that the rate limits may be higher than the rate you’re sending to our servers, therefore you do not appear to be blocked. This is intentional. We do not consider it a security vulnerability, but we do have controls in place and mitigate abuse.” In other words, Facebook has some controls to prevent hackers from gathering mass phone-number lists, but they aren’t strict enough.

How to defend yourself in less than a minute

Good news! You don’t have to wait until Facebook wakes up and fixes this issue.

We contacted Reza Moaiandin and can confirm that if you follow the steps outlined below from either a desktop or a smartphone, your phone number will not be visible to hackers trying to use a script, or any random person who happens to enter it in the Facebook search field. We urge everyone to do this now, since it takes less than a minute to do.

From a desktop

  1. Open Facebook in your browser, click on the upside down triangle at the top right, and select Settings.
  2. Select Privacy from the left pane.
  3. Find Who Can Look Me Up under Privacy Settings and Tools
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this as well if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

From your smartphone

  1. In the Facebook app, tap on the hamburger icon (three lines) at the top right and find Account Settings.
  2. Tap on Privacy.
  3. Find Who Can Look Me Up under How You Connect.
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

We will update this post when Facebook acknowledges the flaw and subsequently fixes it.

Editors' Recommendations

Topics
Robert Nazarian
Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
Your iPhone has a secret feature that helps the environment — here’s how it works
iPhone 14 Pro showing Battery & Health

As Earth Day approaches, you may be wondering how you can help reduce your overall carbon footprint. You could use less disposable household items, get eco-friendly items instead, or drive an EV instead of a gas vehicle — there are plenty of ways to do your part.

But if you have an iPhone with iOS 16.1 or higher, you’re already contributing with a new feature Apple added called Clean Energy Charging. Here’s everything you need to know about how this eco-friendly charging option works.
What is Clean Energy Charging?

Read more
How to get your share of Facebook’s $750M settlement
A silhouetted person holds a smartphone displaying the Facebook logo. They are standing in front of a sign showing the Meta logo.

Meta (formerly Facebook) might owe people who used the social media site between 2007 and 2022 some money due to privacy infringement, according to Mashable.

The social media giant has reached a settlement in a class-action lawsuit where it admits no fault in the claims against the company, but has agreed to pay out $725 million in damages. The money is available to all who submit a claim by the appropriate deadline of August 25, 2023. If you are (or were) a Facebook user, here's how to know if you're eligible and get your share of the settlement.
How to know if you're eligible
There are various stipulations you should take into consideration, including that the $725 million award will be truncated after Meta pays its legal and administrative fees. There are also eligibility, filing, and opt-out dates you want to note.

Read more
Control Center on the iPhone is a mess — here’s how Apple can fix it
Someone holding an iPhone 14. The display is turned on and showing the Control Center.

The clock keeps ticking down to Apple’s Worldwide Developers Conference (WWDC) on June 5. This is where we expect Apple to unveil its headliner mixed reality headset, as well as the usual slew of software updates for iPhone, iPad, Apple Watch, and Mac.

Though it was originally rumored that iOS 17 would primarily focus on bug fixes and improvements, a later report said it could bring some “highly requested features from users.” And this week, there was another report that suggests iOS 17 will be bringing some big changes to the Control Center.

Read more