Re:Сhecking for leaked data without storing any
by jayhoon on Monday November 14, 2022 @09:23PM
(#33604475)
Calling random or consecutive phone numbers is essentially a spraying attack. That can be done without having a database of numbers. While they are annoying, they cannot be used to attack a person or a group of people without additional information. That's what I mean in saying that the numbers alone cannot be weaponized.
Australian mobile phone system has a capacity of 100M numbers, which means that with a probability of 1/4 a random phone number is a real one (Australia's population is nearly 26M).
On the contrary - they can and routinely are.
Speculative case:
The space of valid phone numbers is small, the total number of subscribers is peanuts for automation, and bulk calling is cheap. As a result, it's affordable in some cases to just literally call every single number (prefiltered through one of the marketer databases of numbers belonging to real people) and try the scam - people who aren't in your target group will only get confused for a second, and write it off as usual robocall, while those in your target group will either fall for it, or otherwise identify themselves by recognizing the context.
Or at least that's what I believe is happening, based on calls I occasionally get, trying to "give" or sell me some crap from a product/service category I never cared about, available in a city on the other side of the country.
BTW. This is what's constantly happening in the e-mail space. I get tons of messages that attempt to phish people by hoping a percentage of recipients will happen to be customers of a specific company, or awaiting a package from a specific delivery company on a specific day. I personally had a close call with a phish about OneDrive data deletion that hit my company inbox on the very next day after the company migrated my data across corporate systems - by pure chance, the message looked almost perfectly legitimate, for me, on that day.
Common case:
The usual plausible deniability defense of legal scammers (telemarketers) is, "this number was randomly generated by our system", which is both technically plausible and obviously bullshit. However, being on a receiving end, I have neither time nor means to prove they got it from a database.