Skip to main content

Facebook loophole exposes private phone numbers, here’s how to close it

facebook phone number hackers flaw search shutterstock 202780831
Shutterstock / Bloomua
Security is one tough business, as it seems like every day brings a new flaw or vulnerability. Today’s finding is a big one, since it could impact nearly 1.5 billion Facebook users.

Reza Moaiandin, the technical director at the Salt Agency, discovered a flaw with Facebook that could allow hackers to figure out your phone number, even when it’s set to private. Here’s how it works, and how to protect yourself.

How it works

Facebook’s search box allows you to find potential friends on Facebook by simply typing their name, but many people don’t know that you can also enter phone numbers and receive results. If you think that setting your phone number to private will stop it from showing in search results, think again. Setting your phone number as private only stops it from appearing in your personal profile when non-friends are viewing it.

If we wrote a script and used Facebook’s API, we could have millions of phone numbers within minutes.

Facebook has an additional setting that allows anyone to search for you based on your phone number or your email address, and it’s set to Public by default. This means that anyone (friend or non-friend) entering your phone number in the Facebook search box will get information such as your name, location, and profile picture. That’s OK if the person actually knows your number, because they are most likely an acquaintance, a personal friend, or a family member.

The problem arises because a hacker can write a simple script with millions of phone numbers following a pattern for a certain area. They can then use Facebook’s API to conduct a search and get results within minutes. Imagine how devastating this would be for celebrities and politicians, especially since most people are using their mobile number exclusively these days.

To prove Moaiandin’s finding, we typed in a few phone numbers of non-friends in the Facebook search box, and bingo, the name of the person, location, and profile photo appeared for each number just like if we had typed their name. Of course, this method would be super slow since you would have to enter in each possible phone number, but it proves the flaw exists. If we wrote a script and used Facebook’s API, we could have millions of phone numbers along with who they belonged to within minutes.

What can Facebook do?

Moaiandin is advising Facebook to simply limit the amount of requests per user and detect patterns. This would be a good start, but encrypting data would be the best-case scenario.

He first contacted Facebook in April 2015 with his findings, but the first engineer didn’t understand the issue. After waiting a bit, Moaiandin notified the company again last month, and one engineer replied with, “Thanks for writing in. I investigated our codebase and it does appear to implement rate throttling. Note that the rate limits may be higher than the rate you’re sending to our servers, therefore you do not appear to be blocked. This is intentional. We do not consider it a security vulnerability, but we do have controls in place and mitigate abuse.” In other words, Facebook has some controls to prevent hackers from gathering mass phone-number lists, but they aren’t strict enough.

How to defend yourself in less than a minute

Good news! You don’t have to wait until Facebook wakes up and fixes this issue.

We contacted Reza Moaiandin and can confirm that if you follow the steps outlined below from either a desktop or a smartphone, your phone number will not be visible to hackers trying to use a script, or any random person who happens to enter it in the Facebook search field. We urge everyone to do this now, since it takes less than a minute to do.

From a desktop

  1. Open Facebook in your browser, click on the upside down triangle at the top right, and select Settings.
  2. Select Privacy from the left pane.
  3. Find Who Can Look Me Up under Privacy Settings and Tools
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this as well if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

From your smartphone

  1. In the Facebook app, tap on the hamburger icon (three lines) at the top right and find Account Settings.
  2. Tap on Privacy.
  3. Find Who Can Look Me Up under How You Connect.
  4. Select Who can look me up using the phone number you provided? and change it to Friends of Friends or just Friends. Just Friends would be the ultimate protection.
  5. You will also notice an option for Who can look me up using the email address you provided? You can change this if you would like, but it’s a lot more difficult for a hacker to create a script of email patterns based on their complexities.

We will update this post when Facebook acknowledges the flaw and subsequently fixes it.

Editors' Recommendations

Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
How much is the iPhone 14? Here’s exactly what it costs
The iPhone 14 Pro and iPhone 14.

Apple's newest iteration of the iPhone has been available for purchase for a while, but some people are just now looking into picking it up. The iPhone 14 is the most advanced smartphone Apple has ever made and, thanks to the Dynamic Island of the iPhone 14 Pro and Pro Max, it stands out as unique when compared to the rest of Apple's smartphone lineup.

Because there are four discrete devices in the iPhone 14 line, and within each phone there are multiple hardware options, understanding how much each iPhone costs can be a little bit of a challenge. It's a good thing that Apple is offering so many different options for people to purchase the phone that best suits their needs, but as a result, there's a little bit of confusion about the different versions.

Read more
Twitter’s SMS two-factor authentication is having issues. Here’s how to switch methods
A person's hands holding a smartphone as they browse Twitter on it.

It might be a good idea to review and change your two-factor authentication options for Twitter. Elon Musk's Twitter has another issue for its users to worry about.

Twitter has reportedly been having issues with its SMS two-factor authentication feature (2FA). According to Wired, beginning as early as this past weekend, some Twitter users have reported difficulties logging in to their Twitter accounts due to the app's SMS 2FA feature not working properly. Essentially, the feature relies on the app sending users an authentication code via text message, which they can then enter as a second step in the login process.

Read more
How much storage do you need on your new iPhone 14? Here’s how to decide
The five Apple iPhone 14 colors.

The new iPhone 14 and iPhone 14 Pro are finally available, and Apple is again offering a selection of storage tiers. The big question is just how much storage do you need on your iPhone 14? Similar to last year, the iPhone 14 series lets you choose as little as 128GB and as much as 1TB. This means that if you want to get a new iPhone, you'll need to pick between 128GB, 256GB, 512GB, or 1TB options. Bigger isn't always better, nor is it always excessive. Only you know how you use your phone, but here's a quick guide to help you pick which iPhone size is the best option for you.

Model
iPhone 14
iPhone 14 Plus
iPhone 14 Pro
iPhone 14 Pro Max

Read more