Hackers expose phone information of 4.6M Snapchat users
A security firm had pointed to a vulnerability that could help attackers find the phone numbers of many users
IDG News Service - Phone numbers paired with user names of over 4.6 million alleged Snapchat users were posted online by hackers, a few days after a security research group claimed a vulnerability in the social sharing service that could allow attackers to match phone numbers to Snapchat accounts.
"This database contains username and phone number pairs of a vast majority of the Snapchat users," said a post on website SnapchatDB.info. The account has since been suspended, apparently by the hosting service. A cached version of the site can be viewed here.
The information was acquired through the recently patched Snapchat exploit and is being shared with the public to raise awareness on the issue, according to the post. "The company was too reluctant at patching the exploit until they knew it was too late and companies that we trust with our information should be more careful when dealing with it," it added.
The hackers said they had "censored" for now the last two digits of the phone numbers in order to minimize spam and abuse, but asked people to contact them for the uncensored database, which they may agree to release under certain circumstances.
Gibson Security had published proof-of-concept code last week that takes advantage of the "find_friends" feature in the Snapchat application programming interface (API) to iterate and match the phone numbers of users to their Snapchat accounts in a short period of time. Gibson first revealed the vulnerability and other issues in August.
"Theoretically, if someone were able to upload a huge set of phone numbers, like every number in an area code, or every possible number in the U.S., they could create a database of the results and match usernames to phone numbers that way," Snapchat wrote in response last week. "Over the past year we've implemented various safeguards to make it more difficult to do," it added. "We recently added additional counter-measures and continue to make improvements to combat spam and abuse."
After the release of the SnapchatDB database, Gibson said in a Twitter message that it knew nothing about SnapchatDB, but it was a matter of time until something like it happened. "Also the exploit works still with minor fixes," it added.
Snapchat could not be immediately reached for comment.
"People tend to use the same username around the web so you can use this information to find phone number information associated with Facebook and Twitter accounts, or simply to figure out the phone numbers of people you wish to get in touch with," according to the post on SnapchatDB.info.
- Why Projects Fail CIOs are expected to deliver more projects that transform business, and do so on time, on budget and with limited resources.
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- Audit Ready and Asset Optimized: The Solid Promise of an Intelligent Software Asset Management Solution In this paper Frost & Sullivan examines the benefits of enterprise-grade Software Asset Management solutions, and how these solutions serve as the convergence...
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users? All Privacy White Papers | Webcasts