Viber’s Change Phone Number feature lets you impersonate people
I recently tested Viber’s new Change Phone Number feature which lets you change your phone number without losing your message history and contact list.
Because I didn’t really have a new phone number I decided to replace my number with the number of an existing mobile subscriber (let’s call him John). John didn’t have Viber at the time.
So I opened up Viber, I replaced my number with his number. Viber sent a confirmation code to John’s phone, I typed it in and Viber confirmed that I am now signed in with John’s phone number.
However, because I wanted to keep using Viber with my phone number, I did another switch: this time I replaced John’s number with my number.
Soon after that I started receiving messages from John’s friends that are on Viber. They were messaging me thinking I was John. They said they received notifications about John joining Viber and changing his phone number.
I was really confused at first. How was that even possible? Then I did some research and here’s what I think happened.
When I changed my number to John’s number, John’s friends received a notification that John has joined Viber. Then, as I changed John’s number back to my number, his friends received a notification saying John has changed his phone number. Some of those friends decided to update John’s phone number (which is actually my phone number). And because Viber synchronizes the contact list with the phone’s contact list, I now appeared as John in Viber for those certain friends of John’s.
So how can this be exploited? Well, it makes it possible for someone to impersonate people on Viber. Here is a step-by-step explanation of how it could happen. All it takes is having access to the victim’s phone.
1. Stephan has no Viber account. I want to impersonate Stephan on Viber.
2. I open Viber on my phone, I go to Change phone number and enter Stephan’s phone number.
3.Viber sends a confirmation code to Stephan’s phone. I now must find out what the code is. I can do this if I have access to Stephan’s phone. Or I could simply ask him to tell me the code in that weird SMS he just received. When I have the code I type it in and Viber identifies me by Stephan’s phone number.
4. I go to Change Phone Number and replace Stephan’s number with my number. Viber sends a confirmation code to my phone and now identifies me by my phone number.
5. While I make those changes, Stephan’s friends that are on Viber get notifications that Stephan has joined Viber and has changed his phone number. Some of Stephan’s friends see the notification and memorize his new number (which is actually my number) in their phones. Now they think that I (or rather my phone number) is Stephan.
6. Convinced Stephan has joined Viber, they start messaging him. But they are actually messaging the account that is associated with my phone number, so I get the messages.
I’d love to hear your thoughts on the subject, so drop a comment bellow.