Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is
But eventually the possibilities seem to be not that spectacular. What could you add as a potential security (in this case rather privacy) flaw of revealing mobile numbers?
Hacking : It was shown recently (source) that it is possible with enough information including the mobile number to convince a communications provider you've "lost" your SIM, issue a replacement in store (so you don't even need to receive their mail!) and then convince their bank to "trust" you via an SMS code they can text you and give you unauthorised access to their bank account. I suppose this would also work with any form of 2 factor authentication (like my domain registrar) or re-registering for What'sApp.
Information Disclosure : People typically link their mobile number to online services (Facebook, What'sApp, Hangouts, SnapChat). If all you have is a number, you can often reveal a lot of information about that person from that. I'm attempting to move flats at the moment and I add potential landlords' numbers to my phonebook then perform a contact sync in Facebook, What'sApp etc. to see if they are genuine before visiting them. I often get pictures of people I've nothing other than a number for. Another answer refers to the Last Seen information which has stalking potential (what time are they waking up etc. likely at work and not checking their messages etc.).
Harassment: A study once showed the average person views a SMS text message within 5 seconds of the message being delivered. Unsolicited PPI calls in the UK have shown that people who have nothing other than your number can be quite disruptive. It's very annoying to have to change your number (notifying all the legitimate contacts of the number change), people will often not mute their phone even when receiving an excessive amount of unsolicited calls for fear they will miss an important legitimate one. I wouldn't underestimate the power of a device which most people keep less than a meter away from them for almost their entire day (even when in bed!). Nuisance phonecalls would certainly be disruptive for me!
Hacking : Some services have started using mobile numbers as an alternative method to login (at least Facebook but I'm sure there are others), often to log in as someone else an adversary requires a username and password.. if you already have the username, you're 50% of the way there.
Information Disclosure : In the US a phone number can often reveal the area it was registered in (List of North American Numbering Plan area codes). So you could move onto voting records etc. to try to find where that person lives. This was particularly notable with the SnapChat leak where due to the reputation the service has for sexting people performed analysis on the numbers to work out what areas people were located in.
Hacking : In the UK a number may (assuming they haven't switched providers) reveal their mobile provider which may further help an adversary commit some form of ID theft / phishing against the communications provider (a Vodafone prefixed telephone number might give away that the user is a Vodafone customer and from there someone could try and impersonate the owner of the number). Failing that if you get through to Voicemail often a network standard voicemail will be present (or some well known operator specific instructions after a custom outgoing message "You can press 1 at any time to re-record your message" can also reveal the provider).
Hacking : It was previously possible in the UK to ring up a communications provider's voicemail service, enter in the mobile number of someone and try the network's default PIN to remotely access their voicemail. This was used by a lot of UK media companies against some incredibly high profile people (source).
Hacking : Phone networks are often vulnerable to caller ID spoofing and if an adversary has your number they might be able to call people with your number and social engineer someone (your work's receptionist at the large organisation you work for?) into revealing further information about you. I doubt my payroll department would recognise my voice over anyone else's but I'm sure they'd believe that it has to be me because of my mobile number matching what the HR database says!
My personal take on my mobile number is I'll give it to anyone who has a legitimate reason to reach me, but I restrict it to those that are already friends on Facebook and certainly wouldn't place it anywhere particularly public.
@Saibot is right, but there is at least another threat related to mobile phone numbers.
You mentioned Whatsapp accounts. A lot of people using Whatsapp don't disable the "Last seen" feature. If, in addition, they are also heavy users, to the point that they access Whatsapp just after waking up and just before getting to bed (yes, this kind of people exists), you could use the mobile phone number to understand sleeping patterns, work hours,... which could be important pieces of information for a burglar.
I think I'll call this quote, Stilez' Truism of Data Theft, if someone else didn't get there first about a hundred times over :) :
Data is not unimportant if it can be pivoted to gain access to something important.
That means your phone number isn't at all important - until I discover that it combines with other data or can be exploited, to get me something else that is.
Let's wander around the high-hanging fruit ( @Matthew1471 got the rest of it neatly!) in "black-hat" mindset:
I can ask my mate at the phone company, or a PI, for your account information, including IMEI number (or other phone identifiers) call records, direct debit/payment info, home and contact info, date of birth or PIN if applicable, email address, perhaps your login/password to the telco's "MyPhone" service that doesn't store it encrypted and which you reused on other valuable services (or gives me an idea what kind of p/ws you're likely to choose).
If I'm hostile (business opponent, secret vendetta, harasser) I could disrupt your calls or voicemail or arrange for it to go on a "stolen" list by faking a report in your name on a landline, perhaps at a known crucial time, change your forwarding or other settings, maybe even send you new APN settings or use phone# and IMEI etc to make your phone connect to a "fake" or "poisoned" mast near you for data and voice and grab your internet traffic (after all, the US police have technology of that kind so why can't anyone else? They've been fighting hard to stop details getting into courts, too).
If I know your phone # it gets easier to spoof you to others as well, or to send SMS that superficially look like they're from you.
If you share or link your phone account, or have a "family group account" of some kind, I now have your family and children's individual phone details too, and probably any data stored under these records for these people too.
From your calls and texts I have the phone numbers of your most contacted people (most likely the people you are closest to, such as immediate family), and your workplace and key work contacts.
I can send texts in your name or with your number to them or just research them as well, using you as a stepping stone (maybe it's not all about you, and I'm using your phone account as a way to get someone elses data or to trawl for anything useful?)
Your billings also give me times of calls, and periods of use/disuse, so I can start to learn your daily routine, places you might go, and any regular wake up/bed/"out of contact" routine that might suggest your home is empty or you're sleeping at certain times.
That's just for easy starters, and an accomplice in a telco isn't exactly unheard of or difficult if I want to get one badly enough. Lets find more fruit..... suppose that's a stepping stone. What might it be a stepping stone to?
I can probably learn, either from your phone-to-telco connections, phone records, or social engineering, a lot more about your life and activities, especially if I can also grab your data traffic by leveraging these.
I can look up your phone # (or any other data I got, such as date of birth, address, email, close contacts) and correlate it with other data not from your phone. Suppose your phone gives me your name, address, DOB and email, but I can search on a black market credit card database by any of those. Now I have your credit card number and expiry date to go with them.
I'm starting to be able to call your bank and card provider and in quite a few cases if their security is based on this kind of data, I might be able to authenticate by phone as you and make inquiries... or perhaps I have a mate who can get me your financial data, maybe your full credit rating and the detailed records which it contains about your financial matters, if I have this kind of data (it's probably going to be assumed that anyone knowing this much is likely to be asking legitimately).
Your handset number probably lets me find your main ISP connection that you use daily, either on the handset, or with the same provider, or at your home address or one of the numbers you call most often. Now I have your static IP (or at least, past dynamic IPs for your home) and in some cases that could mean a way to play with your router or connection, watch your traffic, grab your webcam feed or files using the access gained to your home network and PCs (easy prey now), poison your DNS, or inject malware into traffic too. Or maybe I just want to look up your IP online and find out for sure if you really are Jaded123 on that RPG or forum.
If I'm especially keen to target you, and have $100 spare, I can phone you up plausibly as a Telco representative, take you through the Telco security screen, and offer you a nice smartphone handset upgrade as a reward for being a customer for X months and anything else in your records (that I know all about and can discuss), and you'll probably never question it or wonder if it's genuinely sent by your telco, or discover the malware I put on it first.
All of these and many others are possible. Whether they are likely is different.
That's just what social engineering and ability to target the phone-to-mast connection can (in principle) get me, given just your phone number and a few contacts. We haven't even begun wondering what else someone can get, if they get your data traffic as a result. That could include your moment-by-moment location (from your GPS sent back unencrypted by some app you never thought about twice), calendar/notes/email app sync, and the rest. Current location within 5m leads to what - NFC skimming in a crowd of your payment app? "Accidental" meeting or avoidance? Who can tell.
So yeah.
Not to be scared or paranoid. But data leads to data. Often the initial data theft is a beach-head for an issue, not the actual issue.
A phone number looks innocuous. Usually it is. But - hopefully with luck very rarely - what it might lead to, might not always be innocuous. The first stopping point isn't always the final stopping point.....
Mobile phone numbers are like usernames, home addresses etc. They are intended to be publicly known, not intended to be kept secret.
Phone numbers can be used in social engineering attacks, and identity thefts. But it's not a security issue, it's about human mistakes. Even if you encrypt something with a perfect encryption, if you can't keep the password secret, there is nothing to do about it.
