Due to their powerful processing capability and diverse equipped applications, smart mobile devices have become the rage to store and manage personal information in people's daily work and lives. This dominant prevalence to a large extent benefits from those various kinds of applications running on the mobile platform. Among them, a staple category of applications have devoted themselves to provide daily social communication service for regular users, which called social messaging applications. It offers users wonderful user experience and various ways of communication via multi-media, such as text, audios, pictures and videos. Comparing to the SMS and MMS, social messaging applications are more widely accepted for their fantastic social experience and economical manner. In order to aggregate user basis and increase their stickiness, social messaging applications incorporate a new functionality component called Address Book Matching which recommends registered user accounts from the address book in one's phone and facilitates the transplantation of users' social circle from offline to online. However, this novel feature brings not only convenience but also potential privacy leakage issues. This paper proposes a novel platform-independent method to collect users' personal information in large scale, including their phone numbers and the corresponding application accounts, by means of abusing Address Book Matching. Besides, based on the user information we obtained, two approaches of further analysis are presented, i. e. single application analysis and cross application integration. In order to pursue more authentic user information, we propose the conformity and authentic analysis of user personal information gathered from different social messaging applications. Finally, on the basis of our collection and analysis approaches, we also build up a prototype system to leverage above mentioned vulnerability. The experiment results demonstrate the effectiveness of our method of taking advantage of Address Book Matching to collect user personal information from social messaging applications in large scale.
