website SEOWebsite Traffic
ByZak Doffman,
Contributor.
Why you should delete your number.
A raft of headlines will worry Gmail users, as a researcher showed that a user’s private phone number could be “brute-forced” from their Google account using just their Gmail address. So, do you need to delete the phone number on your account?
Per 404Media, the researcher known as brutecat “was able to figure out the phone number linked to any Google account, information that is usually not public and is often sensitive, according to the researcher, Google, and 404 Media’s own tests.”
Google has confirmed the attack and deployed an update: “This issue has been fixed. We’ve always stressed the importance of working with the security research community through our vulnerability rewards program and we want to thank the researcher for flagging this issue. Researcher submissions like this are one of the many ways we’re able to quickly find and fix issues for the safety of our users.”
There are major privacy implications in “brute-forcing the phone number of any Google user,” as brutecat describes it, not least because it’s the unique identifier in secure messaging and account recovery, two areas where socially engineered attacks are rife. Fortunately, this was a proof of concept and has not been exploited — that we know.
Your phone number is held in two places in your Google account — account recovery and two-factor authentication (2FA), where it’s used to text codes when you sign in or access sensitive settings within the account. As I recommended last week, you should only use your number as an account recovery option but delete it for 2FA.
Google calls this two-step verification (2SV), and you can find details on changing your settings here. You should only use 2FA linked to physical hardware, which means passkeys, authenticator apps or for the truly security hardened, physical keys. Google’s other recent update is to push users to upgrade the security of their accounts, and that means no SMS 2FA, which means deleting your number in those 2SV settings.
One of the implications of this brute-force phone number leak is SIM swapping, where an attacker armed with your number can trick a phone company into issuing a new SIM and so utilize your account. This is a serious risk, given most 2FA is still SMS-based. You do not want an attacker to have your Gmail address and your SIM card.
The even bigger risk is a fake call claiming to be from a technical support desk. Google has been hit hard by such attacks and has patched as it goes. It emphasizes it will never call users with a security or account issue, but still those attacks come.
And so, in addition to deleting your phone number as a 2FA option, you should never engage with any technical or customer support desk from a major brand that calls or texts on the premise of an account or payment or password issue.