Other nomination
Bruteforcing/Abusing search functions with no-rate checks to collect data
A Facebook privacy setting left phone numbers searchable by default, and the mobile endpoint m.facebook.com/search applied no rate limit. The author generated number ranges in a spreadsheet and ran a macro that harvested name-to-number pairs for four days without being blocked, then published the mail thread in which Facebook dismissed the report.
Record
- Researcher
- suriya
- Published by
- Suriya's Blog
- Date
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of suriya, first published at the original source. Preserved copies are kept so the citation survives its host.