This means that even if you set your phone number's visibility to "Me only" on your profile page, anyone who knows your phone number will still be able to find you on Facebook unless you change the second setting to "Friends" or "Friends of friends." There is no option to prevent everyone from locating your profile using your phone number.

Since most people don't change the default value of this setting it is possible for an attacker to generate a list of sequential phone numbers within a chosen range -- for example from a specific operator -- and use Facebook's search box to discover who they belong to, Prakash said. Connecting a random phone number to a name is every advertiser's dream and these sort of lists would fetch a large price on the black market, he said.

Prakash claims that he shared this attack scenario with Facebook's security team in August and after an initial response on Aug. 31 all of his emails went unanswered until Oct. 2, when a Facebook representative responded and said that the rate at which users can be found on the website via any means, including phone numbers, is restricted.

However, the mobile version of Facebook's website -- m.facebook.com -- doesn't appear to have any search rate limitation, Prakash said.

The researcher generated numbers with U.S. and India country prefixes and created a simple proof-of-concept (PoC) macros script that searched for them on Facebook and saved the ones that were found to be associated with Facebook profiles, together with the names of their owners.