Why the Facebook contact uploader vulnerability and subsequent hackbreachleak matters. Phone numbers are the ideal attack surface to force multiply other vulnerabilities. Facebook exposed non-public information and needs to answer for it.
https://twitter.com/ashk4n/status/1379854582960910337
As I learned from today’s Spaces call:
—FB’s contact sync was vulnerable to a malicious attacker who could enumerate phone numbers to harvest FB IDs. This revealed non-public information
—attacker then scraped accounts by FB ID
—API limits woefully inadequate/trivial to cheat
—FB’s contact sync was vulnerable to a malicious attacker who could enumerate phone numbers to harvest FB IDs. This revealed non-public information
—attacker then scraped accounts by FB ID
—API limits woefully inadequate/trivial to cheat
—botnets would enable easy circumvention of throttling of lookups per user per session
—Facebook silently changing user prefs made it confounding to know how your phone number was used; default settings put risks on users
—expect probe of who knew what when as FB deflects & spins
—Facebook silently changing user prefs made it confounding to know how your phone number was used; default settings put risks on users
—expect probe of who knew what when as FB deflects & spins
I didn’t catch the whole Spaces session so I look forward to learning about the other big points I missed.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
