Slashdot Mirror
AT&T Leaks Emails Addresses of 114,000 iPad Users
Hugh Pickens writes "Daily Tech reports that in what is one of the biggest leaks of email addresses in recent history, a group called Goatse Security has published the personal email addresses of 114,067 iPad 3G purchasers in what appears to be a legal fashion by querying a public interface that AT&T accidentally left exposed. Apparently AT&T left a script on its public website, which when handed an ICC-ID would respond back with the email address of the subscriber. This apparently was intended for an AJAX-style response inside AT&T's web apps. Gawker reports that it's possible that confidential information about every iPad 3G owner in the US has been exposed. 'This is going to hurt the telecommunications company's already poor image with iPhone and iPad customers, and complicate its very profitable relationship with Apple,' writes Ryan Tate, adding that the leak is likely to unnerve customers thinking of buying iPads that connect to AT&T's cellular network. 'Although the security vulnerability was confined to AT&T servers, Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads.' In a statement, AT&T says that the issue was escalated to the highest levels of the company and that it has essentially turned off the feature that provided the email addresses. 'We are continuing to investigate and will inform all customers whose email addresses and ICC IDS may have been obtained,' says AT&T. 'We take customer privacy very seriously and while we have fixed this problem, we apologize to our customers who were impacted.'"
Wait, the iPad suffered a leak? That's why you always buy pads with wings. (groan)
#fuckbeta #iamslashdot #dicemustdie
Ok, "goatse" in a story, followed by a link... Is anyone really going to click it without hesitation?
Who is in charge of that? Ben Dover?
What's even better is that the first 3 words of the headline are "AT&T's Gaping Hole".
Accidents happen.
Does anyone think this will cost AT&T anything? Not when you've let the NSA use your phone system for illegal wiretaps.
That was the quid and things like this are the quo.
You are welcome on my lawn.
For those of you who don't get it, Goatse Security is a division of the great Gay Niggers Association of America.
I'm not fucking joking.
Additionally, this may be a Slashdot first: The GNAA first post is actually the article itself.
I'm not a consumer, and least of all a gadget one. I'm a business guy and I like business toys. And when I buy a business toy, I consider the brand and the source, and almost always pay more to get the better source -- especially when the product/service is otherwise identical.
But when have you seen a consumer choose to buy an iPad from a source that's $10 more expensive than another they've found? Anyone here have friends who choose to pay more? Anyone have friends who chose an iPad from not AT&T because they actually thought about the AT&T factor? I'd bet otherwise.
What's even better is that the first 3 words of the headline are "AT&T's Gaping Hole".
Well, I was rather amused by the fact that "Goatse" "Leaked" something from said "Gaping Hole," I suppose that if you spend all your time playing with your "gaping hole," then something is eventually going to leak.
Is it sad that I am more likely to recognize you and your posts by your sig than your name or UID?
Besides revealing the e-mail addresses of a number of prominent PUBLIC figures (emphasis on the word PUBLIC) it's just another spam list. Whoopee...
I sometimes wonder why Apple hasn't moved away from it's exclusive relationship with AT&T. I do wonder how Apple would spin if it were opened to other carriers and they all experienced the drop call issue?
If brevity is the soul of wit, then how does one explain Twitter?
Apple CEO Steve Jobs surely won't rest until AT&T's gaping hole is filled,
nuff said
ACTUAL SIZE!!!
The funniest part of this entire story is that news organizations are either completely clueless as to what Goatse is, or refuse to mention it.
But some people are going to google it anyway.
The person who leaked this is a true internet superhero.
In the age of Facebook, I wouldn't be surprised that many people just flat out don't care.
why would it affect Apple at all? This was an AT&T issue.
The last thing that comes to my mind when I think goatse is security. That guy can't secure shit.
And trust me, I've thought about alot of things while viewing / thinking of goatse..And security was definitely the last because I read an article about it on some site.
Since this was a flaw in AT&T's security, despite Gawker's attempt to make it Apple's fault, why the hell would or should it affect Apple's image?
From a source not being sued by Apple for theft
http://www.pcworld.com/businesscenter/article/198453/should_you_worry_about_the_ipad_3g_data_leak.html
Goatse Security: We will show you every gaping hole in your security!
Contractual obligations. Here's some info.
Basically, Apple signed a five-year deal in 2007 because they badly needed a carrier who was willing to sink many millions into the release.
Here's the thing that sucks for early adopters: If you bought in '07, you had to sign a two-year deal with AT&T. Par for the course for a phone the way we've got it structured in the US. But after your two years are up, you'd still be stuck with AT&T for another three years due to the 5-year deal they have with Apple. Either that, or jailbreak your phone, etc.
Practically, though, the extra three years are no big deal for the early adopters... surely most of them would move onto a new phone after two years, since they are early adopters.
"Trolls they were, but filled with the evil will of their master: a fell race..." -- J.R.R. Tolkien on Olog-hai
Thank you Slashdot for not running the sensationalist headline found on that other "tech" blog. Kudo's to you for calling it what it is - an AT&T security breach.
Civilization, the death of dreams.
Couldn't have said it better myself.
Don't lead me into temptation... I can find it myself.
The title:
AT&T's Gaping Hole Exposes...
and
... before reporting this gaping hole to AT&T...
and this gem:
Apple CEO Steve Jobs surely won't rest until AT&T's gaping hole is filled
Goatse FTW.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
I'm surprised nobody else has commented how offensive it is that the group that found the leak published the email addresses. By all means publish the fact of the breach, get pie on AT&T's face, but why punish the users? That's just mean.
No, that was me complaining about how I was modded troll.
But it turns out that my troll mods may have been deserved: I spelled it out like Gay Niggers Association of America instead of Gay Nigger Association of America, which is correct.
My bad, guys. Keep up the good work. I'd join your public affairs department if I weren't so damn busy these days...
This is certainly a high-profile breach, but not apparently immediately catastrophic. However, it does provide a number of lessons for organizations and developers building smartphone applications (iPhone, iPad, Android, Blackberry, Windows Mobile, etc) All of the issues with the AT&T/Apple infrastructure for the iPad are known web application security issues. Smartphone developers need to learn from the past or they are going to repeat the mistakes of web application and AJAX/RIA application developers.
I put together some more in-depth comments here:
4 Lessons From the AT&T/Apple Data Breach for Smartphone App Developers
--Dan
@danielcornell
"That guy who leaked 114,000 emails? What a big asshole!"
Apple doesn't have to open their wallet, they simply have to end their exclusive agreement with AT&T when it expires next year, that will cost AT&T a couple billion a year which is more than any lawsuit could possibly extract from them.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Did you even read the article?
Tequila: It's not just for breakfast anymore!
http://www.citrix.com/English/ps2/products/product.asp?contentID=1689163
"Citrix makes it easy to use enterprise applications, including Windows applications, on your iPhone, Blackberry, Android and Windows mobile devices on-demand."
every day http://en.wikipedia.org/wiki/Special:Random
From the summary: 'Although the security vulnerability was confined to AT&T servers, Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads.'
If I give you my car keys, and you give them to someone else, and that person steals it, you can't claim it's not your fault. You were responsible for those keys.
Dilbert RSS feed
Ummmm...apparently, actually true. It really is a division of the GNAA. Makes me wonder how accurate this story is.
My blog
why would it affect Apple at all? This was an AT&T issue.
I admit, I don't own an iPad so I might be slightly mistaken as to how this works but from the summery it mentions that Apple is the one that 'users, who must provide the company with their email addresses to activate their iPads' which indicates Apple is the wanting the email, not AT&T. Now if Apple wants the emails, why would if have a 3rd party (AT&T) hold on to this data and not just upload it all to their servers every few hours and delete the AT&T server of this information? Now, if Apple is the one who wants the emails then I'd view it to be more Apples fault for not being in more control over the information it is requesting from its customers.
Attention... all grammer nazi"s! Is they're anything; wrong with: my post,
Was the summary tl;dr for you? And for everyone who modded you up?
Although the security vulnerability was confined to AT&T servers, Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads. [emphasis added]
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
'We are continuing to investigate and will inform all customers whose email addresses and ICC IDS may have been obtained,' says AT&T. 'We take customer privacy very seriously and while we have fixed this problem, we apologize to our customers who were impacted.'"
A classic textbook non-response from a corporation's P.R. machine. A guide, for those unfamiliar with the terminology:
* "We continue to..." / "We are continuing..." - Translation: We're not doing a thing
* "investigate" - Translation: To lawyer-up and get paperwork straight for a lawsuit
* "may have" - Translation: "did"
* "been obtained" - Translation: given out by us through incompetence
* "We take XYZ very seriously" - Translation: It only comes up in meetings when emergencies happen
* "we have fixed this problem" - Translation: We fired the employees who told us this problem would happen
* "we apologize" - Translation: We admit no legal wrongdoing
* "customers who were impacted" - people who paid us for the pleasure of a good corporate rogering
Why anyone even reads press releases by companies anymore, one can only guess. You'll hear those catch phrases in every one.
Perhaps we shouldn't spread the story too widely until we have the hole truth. /ducks
What has the world come to?
/b/
'nuff said.
Man who leaps off cliff jumps to conclusion.
Look in your spam box. Your email address has been leaked to V1agra merchants and worse, a million times over, whether you're an iPad user or not. Let's not act like these were some sort of unsoiled email addresses that have now been deflowered. There are no such things on the internet. Yeah, I don't want these jerks knowing what kind of gear I own, but in the big picture, I'd say that these people need a good spam blocker this week, and they needed it last week too.