AT&T Leaks Emails Addresses of 114,000 iPad Users

Hugh Pickens writes "Daily Tech reports that in what is one of the biggest leaks of email addresses in recent history, a group called Goatse Security has published the personal email addresses of 114,067 iPad 3G purchasers in what appears to be a legal fashion by querying a public interface that AT&T accidentally left exposed. Apparently AT&T left a script on its public website, which when handed an ICC-ID would respond back with the email address of the subscriber. This apparently was intended for an AJAX-style response inside AT&T's web apps. Gawker reports that it's possible that confidential information about every iPad 3G owner in the US has been exposed. 'This is going to hurt the telecommunications company's already poor image with iPhone and iPad customers, and complicate its very profitable relationship with Apple,' writes Ryan Tate, adding that the leak is likely to unnerve customers thinking of buying iPads that connect to AT&T's cellular network. 'Although the security vulnerability was confined to AT&T servers, Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads.' In a statement, AT&T says that the issue was escalated to the highest levels of the company and that it has essentially turned off the feature that provided the email addresses. 'We are continuing to investigate and will inform all customers whose email addresses and ICC IDS may have been obtained,' says AT&T. 'We take customer privacy very seriously and while we have fixed this problem, we apologize to our customers who were impacted.'"

Comments

Bad joke

[girlintraining]

Wait, the iPad suffered a leak? That's why you always buy pads with wings. (groan)

Re:Bad joke

[Peach Rings]

It's going to become news when this hits the courts:

in what appears to be a legal fashion by querying a public interface

Since when does the interface being public have anything to do with whether accessing it is legal? The law makes statements about authorized and unauthorized access, not technically possible and technically impossible access. In all hacking crimes the system is happily serving up content exactly as built by the designers, but it's still a crime. In many cases, the system is even working as intended (no buffer overflows and the like) but if unauthorized access is obtained, it's still a crime.

Does anyone else remember this case that was on slashdot some years ago? A computer security consultant was convicted in the UK for typing "/../../" after a URL and hitting enter. Obviously this destroyed his career.

This is the text of the law that convicted him.

a person is guilty of an offence if: he causes a computer to perform any function with intent to secure access to any program or data held in any computer and the access he intends to secure is unauthorised and he knows at the time when he causes the computer to perform the function that that is the case

Re:Bad joke

[afidel]

By not putting an access control mechanism on a data interface you are essentially granting everyone access. Whether the courts rule this way has nothing to do with the technical and practical realities of the situation.

Re:Bad joke

[aliquis]

Personuppgiftslagen / personal data law

Google translation (enhanced by hand ..)

Safety measures
31 The liable data manager must take appropriate technical and organizational measures to protect the personal data processed. These measures must achieve a level of security that is appropriate with regard to

a) the technical options available,
b) what it would cost to implement the actions;
c) the specific risks involved in the processing of personal data, and
d) how sensitive the treated personal information is.

When the liable data manager uses a personal data assistant, the liable data manager must ensure that the personal data assistant can implement the security measures required and ensure that the personal data assistant actually take those measures.

The regulatory authority may decide on security measures.

Re:Bad joke

[laughingcoyote]

Not only a poor analogy, but not applicable. A private home or car is considered to be a private, exclusive area unless you explicitly know otherwise. A website is the exact opposite-it's like a storefront, or a restaurant, which a reasonable person would presume to be open to the public unless explicitly marked or set up otherwise.

And if you leave the door to your store unlocked after closing time, and I wander in, yes, that's totally acceptable, and I'm not trespassing unless I stay after you explicitly tell me to leave. Until you do, I'm making a reasonable assumption that a normally public place (a website on the public Internet, or a store) is open to the public (no access control mechanism is in place, or the front door of the store is not locked). If you accidentally leave confidential business records laying on the front counter of the store, and I see them there, I'm also doing nothing wrong-you left them in a public area, I just saw what was there.

At some point, yes, you are responsible to take reasonable security precautions. If you leave things in an area that the public is allowed to access, you can hardly yowl and scream when it becomes publicly known. Now, if you keep it in an area that is not normally accessible to the public and clearly is secured, and someone deliberately cracks in, you are much more likely to have a legitimate grievance. But only then, and this is not such a case. It was laying right out in the open for anyone at all to look at, and someone did.

Goatse? Really?

[ewoods]

Ok, "goatse" in a story, followed by a link... Is anyone really going to click it without hesitation?

Re:Goatse? Really?

[Ethanol-fueled]

For those of you who don't get it, Goatse Security is a division of the great Gay Niggers Association of America.

I'm not fucking joking.

Additionally, this may be a Slashdot first: The GNAA first post is actually the article itself.

Re:Goatse Security

[SolidAltar]

The funniest part of this entire story is that news organizations are either completely clueless as to what Goatse is, or refuse to mention it.

But some people are going to google it anyway.

The person who leaked this is a true internet superhero.

Re:Doesn't Matter

[Wyatt Earp]

Since this was a flaw in AT&T's security, despite Gawker's attempt to make it Apple's fault, why the hell would or should it affect Apple's image?

From a source not being sued by Apple for theft

http://www.pcworld.com/businesscenter/article/198453/should_you_worry_about_the_ipad_3g_data_leak.html

Re:Goatse Security

[Titoxd]

Goatse Security: We will show you every gaping hole in your security!

You are more right than you know.

[tak amalak]

anyone with half a brain has a droid anyway.

Couldn't have said it better myself.

Re:Goatse Security

[cosm]

I willing to bet the writers / editors of the dailytech story knew exactly the wide open possibilities of this exploit's verbiage flexibility, FTA:

The title:

AT&T's Gaping Hole Exposes...

and

... before reporting this gaping hole to AT&T...

and this gem:

Apple CEO Steve Jobs surely won't rest until AT&T's gaping hole is filled

Goatse FTW.

Smartphone Developers: Take Note

[dancornell]

This is certainly a high-profile breach, but not apparently immediately catastrophic. However, it does provide a number of lessons for organizations and developers building smartphone applications (iPhone, iPad, Android, Blackberry, Windows Mobile, etc) All of the issues with the AT&T/Apple infrastructure for the iPad are known web application security issues. Smartphone developers need to learn from the past or they are going to repeat the mistakes of web application and AJAX/RIA application developers.

I put together some more in-depth comments here:
4 Lessons From the AT&T/Apple Data Breach for Smartphone App Developers

--Dan
@danielcornell

Re:Goatse Security

[Anonymous Coward]

Goatse Security: We will show you every gaping hole in your security!

"That guy who leaked 114,000 emails? What a big asshole!"

Re:Goatse? Really?

[morgan_greywolf]

Ummmm...apparently, actually true. It really is a division of the GNAA. Makes me wonder how accurate this story is.