Mastersthesis,
Evaluating the Privacy of Contact Discovery
University of Würzburg, Master Thesis, (July 2020)
Abstract
Currently deployed contact discovery of mobile messengers is based on the transmission
of phone numbers to the service provider. This information is private and anonymized by
hashing them. In this work, we show, that this anonymization is pseudo-anonymous and
can easily be broken by an attacker.
For that, we develop two hash reversal techniques: one using brute-force approach and
another one using look-up databases. We provide generic architectures for each of the ap-
proaches. Additionally, we provide and compare two instantiations for each. Furthermore,
we evaluate and compare them to the third approach based on rainbow tables.
The evaluation shows near instant lookup-times of under 0.1 ms using in-memory lookup
databases, this approach is however costly in terms of memory – it would require over
10 TB RAM, which would be difficult to obtain. Our brute-force approach shows an
astonishing performance, being able to reverse any mobile number in under 100 seconds
using consumer-level hardware. The rainbow tables produce lookup-times of 4.5 minutes
with a success rate of over 99.99%.
The results of our evaluation demonstrate, that hash reversals of mobile phone numbers
are practical and near instant. Thus, an attacker can easily reverse hash digests of mobile
phone numbers and de-anonymize personally identifiable information – like phone numbers
transmitted to the service provider of mobile messenger apps.
