Slashdot Mirror
Anonymous Leaks 1M Apple Device UDIDs
Orome1 writes "A file containing a million and one record sets containing Apple Unique Device Identifiers (UDIDs) and some other general information about the devices has been made available online by Anonymous hackers following an alleged breach of an FBI computer. 'During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java,' the hackers claim."
Update: 09/04 13:44 GMT by T : A piece at SlashCloud points out that if the leak is genuine, this raises some sticky questions about privacy and security; in particular: "[H]ow did the agency obtain said information, and to what purpose? Why did all that personal data reside on the laptop of one special agent?"
How I feel when anonymous blabbers another leak: My Reaction.
Going to explain why they gave all the UID of their devices to the FBI?
Friends and followers on the Slashdort web site:
I am almost at a loss for words. What I have discovered in the past days has shaken my world-view to its foundations.
As you know, I have been a consistent, sometimes even strident voice denouncing whatI believed to be Italian subterfuge and infiltration against the Internet and related things, from soup to nuts as they say.
Then oneday, a few days ago, I was perusing oldfamily photo albums when I discovered a picture and birth-certificate of a heretofore unknown great great grandfather of mine!
His name -- I still can hardly belive it: Giuseppe Pescatore Puzzolo.
This changes everything.
Please bear with me, it will take time for me to extract the rational and revolutionary core ofmy liberating message from the cloud of anti-Italian confusion from which it once seemed so inseparable.
In the meantime, boungiorno a tutti!.
One thing remains solid in this disorienting spiritual earthquake: my undying love for you, Laura. Ciao!
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
by Anonymous
Step 1) Release private details of fellow geeks from Sony.
Step 2) Release private details of fellow geeks devices from Apple
For kids who are so keen on releasing the details of others, they're strangely reluctant to release their own. Funny that.
UDID's aren't allowed to be used by apple anymore. Well maybe not disallowed but strongly discouraged, & depreciated in ios5, as far as I can tell.
I am now looking for my device IDs in that list...a drag. But how oblivious is the typical iPhone customer to just how naked they are? I salute the hackers for giving the fascist bureau of iDevices and their lackies a big black eye.
SLASHDOT: news for people who can't concentrate on work or have no life at all and got tired of yelling back at the TV.
So what can you do with an Apple UDID?
1984 is now but we pretend it's not the case!
http://kimosabe.net/test.html
> Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team
This guy must have business cards 2 feet wide.
Eh, if the FBI wants to know where I am at all times, they can follow me on Foursquare like everyone else.
It's obviously a product of Apple innovation. Apple know better than us what features are good and which one are bad. Those criticizing Apple have obviously low IQ or are too old to adapt to the innovative idevice future. Once more, Apple shows the way forward to the future. Apple be praised.
... the possibility that the FBI was doing its job.
The only possibilities here are that the FBI or Apple are in the wrong, there is NO possibility that criminals did something wrong.
Remember that simple rule... the FBI and Apple sometimes make mistakes, therefore they are ALWAYS responsible for things. /groan
EMail: 0110001101100010010000000110001101110010 0110000101111010011011100110000101110010 0010111001100011011011110110
Seriously, does anyone really think this is not commonplace? If the government is doing this behind the scenes just imagine what Facebook does with the data you willingly sign over to it. This is just the tip of the iceberg. Sure it's not suppose to happen, sure it's wrong, sure no one agreed to it and it needs to be corrected...but if something can be abused, it will be.
A 'singular oddity' is an event that cannot be explained and only happens when you are alone.
Was the leak only for USA ID numbers, or are we talking major criminal action in foreign countries here?
It's always tempting to think the USA is the world police, but Apple do not have immunity from foreign courts if they've been handing over data like that.
It's the new ActiveX. Full of holes and unfortunately deployed all over the place and used by people who ought to know better.
Begone, Java plague!
I mean, there is no way that it is legal for the FBI to store data about 12 million people?
It sounds like this is a dump of data from an application vendor to the FBI: Apps have (in the past) used UUID for identification, and the push-notification tokens also suggest application, not apple, as the source.
So which application is responsible?
Test your net with Netalyzr
Review the permissions of the app. It can read and write contact information and it can take pictures and video, access phone state and identity, determine your location and record audio. At any time. Anybody actually read 1984? But at least Android tells you about it.
If one finds a phone which is in the list, is there a way to find out which application is associated with the push notification token? If so, this would help identify the application vendor responsible for dumping this data onto the FBI.
Test your net with Netalyzr
"Why did all that personal data reside on the laptop of one special agent?"
Probably it didn't and doesn't.
Reside on the laptop of *just one* special agent, that is.
Whenever one of these special agents gets something particular from the boss, all the others want that, too.
Hereâ(TM)s how to check if your Apple device UDID has been compromised by the AntiSec leak http://goo.gl/GJC2qï
http://cirrusminor.info
I'll go for the home made bison and cheese stuffed ravioli, thank you.
As to the garlic soup, don't bother. ;-)
Relations between humans tend to be difficult enough even w/o garlic.
someone got bumped!
I mentioned do not mess with the Chinese... In the Apple versus Samsung lawsuit. I mentioned that this would only go one way.
The Chinese are starting to "Turn the Screw". you will see the shit hit the fan over the next 6 months and Apple will lose a user base. Anon are pretty funny with their stunts and it is not as if I am part of "Cult of the Dead Cow" Mo0o00o0o0o0
All cows eat grass!
Install CM or an app that lets you block permissions you do not like. You will need to root of course.
Calm down, everyone with an Apple device, there's more than one Dark Knight with a laptop. You don't see your UDID, you're on another laptop darkly. Each device has GPS, a mic, front-facing camera and wireless connection for your safety.
Face Book Inc. Come on. It's obvious!
if you are going to post to a tech site. There are plenty of beginner sites out there, this one is for people who know basic technical info like "You can put any OS you want on a MacBook".
Or just pick one of the many non-garbage 3rd party Facebook applications.
I suppose that anonymous getting access to FBI computers (and making it public) answers the old question of who watches the watchers.
The single greatest threat to privacy worldwide is users who don't read the stuff above "I agree" or "Authorize App".
Please consider this account deleted, I just can't be bothered with the spam anymore.
That a mainstream news outlet (like CNN) would discover that leak suddenly and act all surprised would be ridiculous, given that the general public ought to know, 11 years after 9/11, how privacy has been dismantled by intelligence agencies.
But slashdot? How is anyone surprised? Haven't we seen the news about the official spyware installed on all iPhone (yes and a lot of Android phones too)? Aren't we ranting all day long about the circulation of privacy data without overseeing?
There is one thing that ought to outrage us more than usual : the fact that this data was not securely stored. But the lack of privacy... well, where is the news?
The Wise adapts himself to the world. The Fool adapts the world to himself. Therefore, all progress depends on the Fool.
Just completed an entirely unscientific look at the data - I checked the UDID's of the iPads we have registered here (at a large financial company in the UK) and none are in the list. Given that this is 1m of 12m records, what ratio is 12m of the total population size for iphones and ipads?
i.e. if I checked 20 UDIDs, none of the came up, can we say that (allbeit with a low degree of confidence) the sample does not include UK registered devices? is it just USA registered devices? has anyone outside of the USA seen their iPad/iPhone on the list?
If it were you with that heroin, the answer would be you're an international terrorist.
Regulation is needed wherever a business process will cause the planet to be inhospitable, inflict on others freedoms/rights, is based on deceit, or conflicts with anothers ability to do business. We don't need -MORE- regulation, we need -EFFECTIVE- regulation. The Red team thinks that regulation itself is the issue. Us radical centrists think its the proliferation of regulation that is not well thought out to be the problem. The Blue team may add some well meaning patch-regulation, but has not really collimated its focus on the bigger pictures. Even Healthcare reform seems a patchwork. Start with the obvious, unequivocal objective of healthcare and move backwards to a solution. Red team wants to limit healthcare by vouchers.... Our scientists and doctors need to get together more (but I digress).
Carrier IQ (EOT)
"A piece at SlashCloud points out...."
Jeez. You mean "Us, standing over there." Why pretend it's an unrelated entity?
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
It looks base64 but not quite. But I did only try a portion of the file.
Help?
Slashdot's rate-of-post filter: Preventing you from posting too many great ideas at once.
Serves you right, walled garden sheep. My computers can only be identified with serials that you'll need root access to read, and they never leave the computer.
"When information is power, privacy is freedom" - Jah-Wren Ryel
The garlic soup (knoblauchcremesuppe or garlic cream soup) actually doesn't have as pungent of a flavor or smell as one would assume. The cooking of it and the cream/milk dramatically cut the power of the garlic. I had it first when in Vienna and besides if both of you have had it neither of you notices the smell. The garlic cream soup is less pungent than french onion soup so you can use that as a guide.
Time to offend someone
Maybe he was a Very Special Agent? =P
have a machine do it quicker!
Spam filters are not so bright but they are doing something SIMPLE compared with what the insurance companies WILL someday try to employ. The success rate can be quite low and still make it highly profitable to deploy.
Your profile can be impacted by things that make no sense; you might simply TALK about food or talk about failing to lose weight and even though you may be quoting somebody else the machine will adjust your rank. Also, just like the simplistic MIT student project, the info about your "friends" on facebook can be used to determine things with better than chance odds-- like if you are not openly gay the student project claimed to be able to guess that with high accuracy based on your friends. You have a lot of fat unhealthy friends??
Since insurance KNOWS YOUR HEALTH by your medical bills; your friends and family you spend time with may also have insurance plans with the same company and that can be used against you as well. (They can already use your family against you.) Outside the company there are privacy laws I'm sure they can circumvent using a credit-rating like health score or something that summarizes without technically disclosing private information. This is less important today because insurance companies are so good at legally screwing their customers out of the insurance coverage they paid for.... plug 1 hole and they'll find another.
Democracy Now! - uncensored, anti-establishment news
You know...to see if it contains the reported information?
Figured I'd ask before doing so myself...
If you're not outraged, you're not paying attention.
If them having your UDID is a big deal then who the hell is going to just submit to to a random web page?
Review the permissions of the app. It can read and write contact information and it can take pictures and video, access phone state and identity, determine your location and record audio. At any time. Anybody actually read 1984? But at least Android tells you about it.
And iOS 6 lets you block the permissions you don't want it to have... you can turn on/off photos, contacts, etc., independently.
E pluribus unum
I got an i3 Vostro 14" a couple years ago. It's my personal home machine, has held up well, and was one of the least expensive comparable machines with HDMI out at the time of its release. And it has a matte screen. Oh, it also came with a year of next-business-day on-site warranty service, which the consumer-series ones don't.
It's not quite as heavy-duty as a Latitude (and doesn't support a dock), but its more compact.
Any evidence should have gone to the lab, not onto a laptop.
Fuck the FBI and fuck the USA. lets shoot those FBI dogs in the head and bomb Washington DC!
Going to explain why they gave all the UID of their devices to the FBI?
It could be Apple that handed them over, but if so why only 12 million devices? There are now hundreds of millions of iOS devices in the wild so what makes that 12 million special?
Who and Why are huge questions here. None of my devices were listed, some quite old - so it's not just some old device list. What was happening there?
It could also easily be a list from someone like Facebook or Twitter, who would have been in a position with widely used apps to collect UDID & name/address info.
I wonder if this is related to Apple stopping apps from being able to make use of the UUID...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
A lot of apps use it
Starting around the beginning of the year (March I think) Apple stopped accepting applications that collected the UUID. Most apps now do not make use of it, at least anything updated frequently.
In iOS 6 the call to get the UUID is gone.
It would depend on the app if the UDID was of any use in spoofing a user. Mostly anything that would have an account would make the user log in, not rely on the UDID for authentication.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
..Messages ? Because it is technically possible and the current generation of leaders are stupid, malicious and lazy fsckers, All they care is that the bribes from the Destructivists of Lockheed et al and Wallstreet flow nicely. Government by Evil, for the Evil.
Do you really think they have proper data security ???
So is Apple going to explain why they gave all the UDID of their devices to the FBI?
I know everybody's racing to see conspiracy here -- and that may well end up being the case -- but there might be a simpler explanation for how the FBI got these: From sniffing open WiFi hotspots.
It's possible that the Bureau, perhaps in cahoots with other three-letter agencies, exploited an undisclosed bug that produced the UDID (the technical composition of which is well documented). If so, it wouldn't be any great feat of science to sniff common open-air networks at places like Starbucks, airports, hotels. That's how I'd do it.
Hang on to your tin foil hats... there are 74 records in the released file corresponding to an Apple device owned by one of "MYQuraniPad2", "MyQuranPAD" or "QuranPAD". "My Quran" is an IPad app for reading and studying the Koran ("Quran"). Is the FBI tracking people who install this app?
Maybe all the special agents have it.
They're all special.
If you find your UDID on the list, contact Apple about it. If enough people complain, they will be forced to take some type of action. We need to let companies know that we don't like them being in bed with Federal Agents. The next question is, how in the hell is this information on agent's laptop?
What do you make home-made bison out of? Baco-Bits, cat hair and soy?
they told the NSA to gtfo and rtfc (read the fine Constitution) , you can read all about it.
Except when the app in question is baked into the OS like Twitter and Facebook nowadays. Are you sure you're the one in control then?
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
Why would the FBI give a crap about the privacy of the American public ?