Print 38 comment(s) - last by Quadrillity.. on Jun 11 at 4:13 PM

Our suggestion to iPad 3G owners: strengthen your passwords and purchase a good spam filter (sound advice in general, though...).  (Source: The Official Schipul Blog)

White House Chief of Staff Rahm Emanuel was one of the over 100,000 iPad 3G customers affected by AT&T's breach  (Source: Reuters)
Apple can't be happy with AT&T's epic security fail

In what is one of the biggest leaks of email addresses in recent history, a group called Goatse Security has published the personal email addresses of 114,067 iPad 3G purchasers according to Gawker.  The email addresses were obtained in what appears to be a legal fashion by querying a public interface that AT&T accidentally left exposed.

The names of victims immediately draw attention to the story.  Among them are New York Times Co. CEO Janet Robinson, Diane Sawyer of ABC News, film mogul Harvey Weinstein, New York City Mayor Michael Bloomberg, and even White House Chief of Staff Rahm Emanuel.  A number of CEOs, CFOs, and CTOs also had their email addresses exposed by the leak.

Additionally, a number of the email addresses exposed were from high-ranking military officials or DARPA researchers.  Among these was William Eldredge, who "commands the largest operational B-1 [strategic bomber] group in the U.S. Air Force."

Every one of these individuals and thousands of other everyday people had their email addresses and corresponding ICC-IDs (integrated circuit card identifiers) leaked.  The ICC-ID is a number used to uniquely identify SIM cards for a particular subscriber's device.

How did Goatse get this treasure trove of data?  Apparently AT&T left a script on their public website, which when handed an ICC-ID would respond back with the email address of the subscriber.  This apparently was intended for an AJAX-style response inside AT&T's web apps.  

The complete lack of protections allowed the group to freely guess ICC-IDs based on known IDs from iPad pictures posted online, and in turn harvest the resulting email addresses.  The only "trick", if you could call it that, which they had to do was to spoof the site into thinking they were using a iPad browser by adding an iPad-style "User agent" header in their Web request.

A simple PHP script later, Goatse Security had a hoards of email addresses to sift through.  And here's the kicker -- before reporting this gaping hole to AT&T, they shared the exploit with various interested parties.  So there's no telling who else used it, how many more IDs were leaked, or what other damage could have resulted.

With the ICC-ID and unique email in hand, malicious parties could easily launch mass attacks to try to gain further access.  For example, it's likely that at least one of those email addresses with the password "darthvader" would return account access.

This huge breach is likely worrisome to those who are thinking of buying an iPad 3G – most people would prefer their personal email address 
not get shared with the masses.  The only consolation here, is that if your password is sufficiently strong and your email address does not hint at your identity, the leak might not be that big a deal (other than subjecting you to a bit of extra spam).

Apple, which has already hinted at its displeasure with AT&T on certain issues, certainly can't be thrilled about this development either.  It releases a hit new product, and now thanks to the service provider over a hundred thousand of its customers have had their personal information compromised.  Apple CEO Steve Jobs surely won't rest until AT&T's gaping hole is filled, but by now the damage is probably already done.  One thing's for sure.  There's going to be 
a lot of fallout from this incredible breach.

Updated: 6:35 p.m. June 9, 2010-

We just received the following official statement from an AT&T spokesperson:

AT&T was informed by a business customer on Monday of the potential exposure of their iPad ICC IDS. The only information that can be derived from the ICC IDS is the e-mail address attached to that device. This issue was escalated to the highest levels of the company and was corrected by Tuesday; and we have essentially turned off the feature that provided the e-mail addresses.  The person or group who discovered this gap did not contact AT&T.  We are continuing to investigate and will inform all customers whose e-mail addresses and ICC IDS may have been obtained.  At this point, there is no evidence that any other customer information was shared.    We take customer privacy very seriously and while we have fixed this problem, we apologize to our customers who were impacted.

Comments     Threshold

This article is over a month old, voting and posting comments is disabled

Double Standards
By Tony Swash on 6/10/2010 10:49:26 AM , Rating: 0
The anti-Apple stuff at Daily Tech, playing up everything that could possible link Apple to something negative, is getting tired. Especially when the following doesn't even warrant a story.

Google has released an independent audit of the rogue code, which it has claimed was included in the StreetView software by mistake.

But Privacy International (PI) is convinced the audit proves "criminal intent"

"The independent audit of the Google system shows that the system used for the wi-fi collection intentionally separated out unencrypted content (payload data) of communications and systematically wrote this data to hard drives. This is equivalent to placing a hard tap and a digital recorder onto a phone wire without consent or authorisation," said PI in a statement.

"The idea that this was a work of a lone engineer doesn't add up. This is complex code and it must have been given a budget and been overseen. Google has asserted that all its projects are rigorously checked," said Mr Davies from Privacy International (PI).

This would put Google at odds with the interception laws of the 30 countries that the system was used in, it added.

The revelation that Google had collected such data led the German Information Commissioner to demand it handed over a hard-disk so it could examine exactly what it had collected.

It has not yet received the data and has extended the original deadline for it to be handed over.

I guess Google really believes in openness - for everyone else on the planet except themselves. And Daily Tech thinks that's just fine and dandy.

RE: Double Standards
By theapparition on 6/10/2010 11:07:50 AM , Rating: 3
The anti-Apple stuff at Daily Tech, playing up everything that could possible link Apple to something negative, is getting tired.

Last I checked, no one was holding a gun to your head. don't like it, move along.

And the google story was covered many times here on DT, so get a life.

RE: Double Standards
By Smilin on 6/10/2010 12:57:15 PM , Rating: 4
Tony you're an Apple shill. Your daily pro-Apple blathering is what is really getting tiresome here.

The whole "anti" stuff in this article was directed at AT&T so settle down, kick your feet up, and have a nice glass of Jobs Kool-aid m'kay?

RE: Double Standards
By ClownPuncher on 6/10/2010 2:14:41 PM , Rating: 3
Damn, Tony Swashtika.

"Folks that want porn can buy an Android phone." -- Steve Jobs

Most Popular Articles5 Cases for iPhone 7 and 7 iPhone Plus
September 18, 2016, 10:08 AM
Automaker Porsche may expand range of Panamera Coupe design.
September 18, 2016, 11:00 AM
Walmart may get "Robot Shopping Carts?"
September 17, 2016, 6:01 AM
No More Turtlenecks - Try Snakables
September 19, 2016, 7:44 AM
ADHD Diagnosis and Treatment in Children: Problem or Paranoia?
September 19, 2016, 5:30 AM

Copyright 2016 DailyTech LLC. - RSS Feed | Advertise | About Us | Ethics | FAQ | Terms, Conditions & Privacy Information | Kristopher Kubicki