FBI Denies It Held iPhone UDIDs Stolen By AntiSec

judgecorp writes "The FBI has denied the UDID codes released yesterday came from an agent's laptop, as claimed by the AntiSec hacker group. The FBI says it does not hold such data, and the attack never happened. However, the agent named by AntiSec is real, and some of the published UDID codes have been found to be genuine. So where did they come from?"

Comments

So where did they come from?

[fustakrakich]

The FBI... What, does anybody expect them to admit it?

Re:So where did they come from?

[siddesu]

Nyet. J. Edgar Hoover.

Re:So where did they come from?

[Sarten-X]

On the other hand, finding the names of agents is pretty easy, and dropping one makes for a much juicier story than "AntiSec managed to get a UDID-sniffing trojan into the app store".

In the absence of any further evidence, I must assume that everybody's lying. The real story is that the UDIDs were harvested wirelessly using petahertz radio scanners mounted on the invisible black helicopters flown by the lizard aliens who, due to their shared ancestry with birds, make excellent pilots, even in aircraft that are based on Martian stealth technology (which is why we're giving the Martians our nuclear-powered cars now).

Re:So where did they come from?

[crazyjj]

Wouldn't it be nice to think the FBI would ever release a press release with the header "Yes, We Screwed-Up and Yes, We're Illegally Spying on You." But inevitably, that's the kind of admission that only comes out decades after the fact. It's not like if you had asked J. Edgar Hoover "Hey are you spying on Martin Luther King with illegal wiretaps and recording devices?" back in the 60's he would have replied "Oh yeah, we're doing that."

Re:So where did they come from?

[Anonymous Coward]

The FBI... What, does anybody expect them to admit it?

No more than anybody expects you to believe them when they actually DIDN'T do anything.

Re:So where did they come from?

[falcon5768]

Only people foolish enough to think antisec actually cares about being truthful would think that. Lets face the facts here

12 million is a piss in the pond in terms of iOS UDID codes. Its less than half the iPhones sold LAST QUARTER. If the FBI was realistically trying to build a database of them, there is no way at this point they would ONLY have 12 Million.

12 million is more easily explained by being leaked from a developer, as up until half a year ago, developers were using the code to identify individual iPhones for various reasons like automatic sign-in to certain services like some of the multiplayer game services. Apple banned them from using it though half a year ago so at this point there was no reason to keep.

The data it's self was incomplete. Some had legit names and addresses while most were just a ID code. If this was from a official source then there would have been a lot more data on most of these. On the otherhand if it was stolen from a developer who let users opt out of giving their information but used the code for autologin purposes, then there would be clear reason why most of the data has no user info attached.

Antisec is still smarting from getting much of its higher ranking leadership arrested from a FBI plant

So really there is no reason AT ALL to believe antisec's claims that they stole the info. There is however a lot more reason to suspect they were trying to stir the pot in the tech community by stoking already present fears of FBI spying which they did a pretty good job at. It gets clueless script kiddies riled up and makes them look cool. Sure the FBI can be shady, but of the law enforcement agencies out there I would honestly have to say they are the least shady of the bunch and tend to release information without bending the truth too much, even when it has the possibility of embarrassing them. Not saying they ALWAYS do it, just saying they tend to be more forthcoming than other government agencies.

Re:So where did they come from?

[crazyjj]

In the absence of any further evidence, I must assume that everybody's lying.

Except that Anon has real evidence in this case, and specifics. The FBI is just issuing a blanket denial. And, for that matter, if this agent is real and doesn't do this, why aren't they hiding him and not making him available for interviews? Seems like he would be the most credible source to deny it.

Re:So where did they come from?

[Lumpy]

FBI can legally spy on you. It's the CIA that cant legally spy on you.

Re:So where did they come from?

[Yvanhoe]

Usually they blame a subcontractor.

Re:So where did they come from?

[crazyjj]

FBI can legally spy on you.

Not without a warrant. Care to guess whether or not they had one when they were putting recording devices in Martin Luther King's motel rooms and home?

If you answered "No," congratulations.

Re:So where did they come from?

[bluefoxlucid]

Yes because I totally did not have sexual relations with that donkey.

Re:So where did they come from?

[Anonymous Coward]

They've cried wolf a few too many times for us to just take them at their word. Do you believe every inmate who says they're innocent?

Re:So where did they come from?

[fustakrakich]

Only people foolish enough to think the FBI actually cares about being truthful would think that.

You're welcome. The first one is always free. More likely you're half right. Both sides are lying. But for anybody to believe that the FBI doesn't harvest this info, is an exercise in naivety.

Not saying they ALWAYS do it, just saying they tend to be more forthcoming than other government agencies.

Not sure what you base that on. Getting anything out of the FBI usually takes reams of FOI requests... I've rarely, if ever that I can remember, seen them come forth without them. They have every reason in the book to deny everything. SOP

Re:So where did they come from?

[Anonymous Coward]

The "AntiSec" guy has no evidence. He could have done what he says he did. Or he could be completely lying. There is no evidence whatsoever either way. Don't make stuff up.

Re:So where did they come from?

[crazyjj]

From their perspective, this is no doubt a beneficial side-effect of the massive expansion of the private national security industry since 9-11. I guess at least it's providing jobs.

Re:So where did they come from?

[NatasRevol]

Or they could have hacked some small developer who wasn't overly careful with his records and AntiSec ended up with a few real UDIDs.
Then blamed it on the FBI.

Or they could have hacked an FBI laptop, just the one that had Apple UDIDs on it.

I have no idea, but I have heard of Occam's Razor.

Re:So where did they come from?

[tmosley]

Wow, a time traveler has come to us from some time before 9/11/2001. Tell me, friend, what is it like to live in a free society? It has been so long I have forgotten.

Re:So where did they come from?

[Sarten-X]

I have a few agent business cards in my desk at home. I could claim any one of them gave me a receipt that proves Lee Harvey Oswald's innocence. I could show you a receipt dated November 22, 1963. The agent I name could deny it, of course, but then his denial could just as easily be dismissed as "protecting his job" or some other obvious ploy.

Anon has shown only that they:

1. have UDIDs, some of which are valid
2. have the name of an FBI agent

There is no evidence that the UDIDs actually came from the FBI. There is no evidence that Special Agent Stangl is related to the case in anything but name, and any statement from him must be considered questionable, just as any statement from Anonymous must also be questionable.

As the saying goes, extraordinary claims require extraordinary proof, and there is very little actual proof available... just names and numbers mentioned in close proximity.

Re:So where did they come from?

[Sez Zero]

The FBI... What, does anybody expect them to admit it?

FBI: Hello, Supervisor Special Agent Christopher K. Stangl, would you please step under this bus? We don't want to throw you.

Re:So where did they come from?

[somersault]

Why do they need to waste time getting a "credible source" to deny not very credible accusations? If I gave a list of accusations for 100 agents right now, should the FBI take those 100 agents off of whatever they're doing to give a press report?

Really, who cares?

Re:So where did they come from?

[Anonymous Coward]

It's the CIA that cant legally spy on you.

That hasn't been true since the DHS was created. The creation of the DHS primarily served to legally violate the charter of every three letter agency in the US. The FBI, NSA, and CIA, all domestically spy now.

Re:So where did they come from?

[RyuuzakiTetsuya]

in theory, they still need FISA warrants.

Re:So where did they come from?

[Anonymous Coward]

And, for that matter, if this agent is real and doesn't do this, why aren't they hiding him and not making him available for interviews?

Why is Antisec hiding the hacker and not making him available for interviews? (see that works both ways) /sarc

One csv file isn't much evidence. The hacker could have gotten that file from anywhere, then attributed it to the FBI in order to get some headlines. Did you read the Antisec info release? It is mostly a rant formatted like a warez release back in 1995. Did the hacker download any personal files from agent Stangl to prove that they actually compromised his computer?
In absence of additional information, I gotta agree with the parent and not believe either party.

Re:So where did they come from?

[Anonymous Coward]

There is no evidence that the UDIDs actually came from the FBI. There is no evidence that Special Agent Stangl is related to the case in anything but name, and any statement from him must be considered questionable, just as any statement from Anonymous must also be questionable.

As the saying goes, extraordinary claims require extraordinary proof, and there is very little actual proof available... just names and numbers mentioned in close proximity.

All absolutely valid points.

Unfortunately, you cannot confirm or deny any of it, and therefore with regards to statements made by our Government, the sane majority must default to the history books and say that they're lying.

All of them.

Now prove me wrong.

Re:So where did they come from?

[Anonymous Coward]

What's "extraordinary" proof supposed to be? Batman's word? :)

Claims need proof, period. In this case, the claim of 1m UDIDs has been proven. The claim they came from an FBI agent's laptop has not. So TFA is right to ask "how do we know where they came from?"

Re:So where did they come from?

[Anonymous Coward]

Anon has shown only that they:

1. have UDIDs, some of which are valid
2. have the name of an FBI agent

Actually, all they have shown is that one side of the FBI agent is black

Re:So where did they come from?

[Anonymous Coward]

I'm not sure you can apply Occam's Razor when you know as little as we know about this case. We have a bunch of UDIDs and that's about it. Speculating about the motives and circumstances they were obtained in would require that we know *something* about them. But we know nothing for sure.

Re:So where did they come from?

[Sarten-X]

The sane majority also must refer to history books when dealing with statements made by activist groups and say that they're trying to look more important than they really are, and therefore also lying.

Hence my original point: I must assume everyone's lying. There is as much proof of invisible black Martian spy planes as there is of anyone's claims here.

Re:So where did they come from?

[Anonymous Coward]

The FBI is lying!

They have so much more information than what they say they have. Antisec also grabbed a database of slashdot userid's, handles, and personal information at the same time. I've removed all the personal information, but here's an except of the first 5 slashdot userid's and handles:
CmdrTaco (1)
CowboyNeal (4)
siddesu (698447)
Sycraft-fu (314770)
Sez Zero (586611)
AwaxSlashdot (600672)
zill (1690130)
Yvanhoe (564877)
crazyjj (2598719)
falcon5768 (629591)

You are being watched! Or conned! Or both!

Re:So where did they come from?

[falcon5768]

For what purpose. Its been pointed out many times the UDID has no real value to the FBI so why would they be taking them?

Re:So where did they come from?

[fustakrakich]

Every little 'bit' helps...

Sorry

Re:So where did they come from?

[fadethepolice]

This is likely to be true of every action of every whistleblower from now until the end of time. The very act of getting protected data from an organization by definition results in this situation. The only resort is to look at context and evaluate the information on the knowledge you have of the participants. http://en.wikipedia.org/wiki/Carnivore_(software) http://en.wikipedia.org/wiki/NarusInsight The FBI has a proven track record of secretly monitoring Americans for close to 100 years. Anonymous has a decent reputation as occasionally competent hackers. Given these facts I would tend to give more weight to the evidence presented by anonymous than the denials by the FBI.

Re:So where did they come from?

[crakbone]

Only problem is that Anon has a better record of telling the truth.

Re:So where did they come from?

[cavreader]

Anon has presented no evidence of how or where they got the data and refuse to give any more information on the subject. They listed an agents name but how did they know to target this individual? The exploit they claimed they used (the Java Atomic Array flaw) is not exploitable on every machine that has Java installed and requires a specific configuration and usage patterns before the flaw could be exploited. And the FBI would be wary of issuing a blanket denial because they could not be sure there was not more incriminating proof waiting to be released. Since a particular agent was mentioned they could have discovered rather easily if the agents machine had the data and was vulnerable to the exploit. It's not like they would had to investigate their entire network infrastructure looking for evidence of the hack. But of course they are pure as the driven snow when it comes to issuing their accomplishments. Maybe they are pissed that the FBI (ie. the MAN) has caught and prosecuted a couple members of their little hacker collective and want to retaliate.

Re:So where did they come from?

[Anonymous Coward]

Do you believe every inmate who says they're innocent?

No, but that's because, ideally, someone else already did this, and was then presented with evidence that showed that they were not innocent. Without further evidence or signs of a mistrial, there is no need to revisit the question.

Would I believe an inmate who said he was innocent of a crime unrelated to the one for which he received his sentence? Perhaps.

Re:So where did they come from?

[zzsmirkzz]

Only problem is that Anon has a better record of telling the truth.

A nameless, faceless, identity that anyone can assume at any time, by definition, does not have a record .

Re:So where did they come from?

[fustakrakich]

The law is a quaint anachronism... Merely a philosophical theory from the distant past. It was never meant to be a universal standard to apply to everyone. It is simply a tool of domination and authority.

Re:So where did they come from?

[Zero__Kelvin]

"The "AntiSec" guy has no evidence. He could have done what he says he did. Or he could be completely lying. There is no evidence whatsoever either way. Don't make stuff up."

Maybe he's bucking for a job with the FBI.

Re:So where did they come from?

[Anonymous Coward]

on average random ACs have a better rate of telling the truth than the FBI. (this post included?)

Re:So where did they come from?

[blueg3]

...finding the names of agents is pretty easy...

Yeah, especially when the agent stated his name in a well-known FBI PR video targeting hackers.

Re:So where did they come from?

[Zero__Kelvin]

"A nameless, faceless, identity that anyone can assume at any time, by definition, does not have a record ."

Tell that to the UNABOM task force circa 1995. You see, I don't know your name. I haven't seen your face. Yet you already have a record of making clueless statements ;-)

Re:So where did they come from?

[Anonymous Coward]

"At this time there is no evidence" != Denial

Re:So where did they come from?

[Lumpy]

I suggest you read the PATRIOT act and what pesky freedoms were removed that law enforcement hated to deal with.

Re:So where did they come from?

[Lumpy]

They have a roll of FISA warrants next to the sink. Many of the guys here at the office mistakenly use them as paper towels.

Re:So where did they come from?

[CanHasDIY]

Its been pointed out many times...

by whom? What reason would we have to believe this hereforeto unnamed source?

UDID has no real value to the FBI so why would they be taking them

Anybody who tells you that your personal identifying information (or information that personally identifies your devices) has no value is a liar, probably trying to misdirect you. All data is valuable to someone, somewhere, sometime.

Re:So where did they come from?

[Anonymous Coward]

No logic allowed - please stop. The FBI denies everything, and ANON claims everything. There, classis immovable object versus unstoppable force. We're done here.

Re:So where did they come from?

[Anonymous Coward]

Internet Anonymity - gotta love it when clueless people call out other clueless people.

Re:So where did they come from?

[Anonymous Coward]

Ugh, it is awful. The Republican party is run by Karl Rove, it takes thirty minutes to board a plane, nobody believes in Global Warming, the American military is bored, and the New York skyline is so busy. I do hope you people in the future can address these problems.

Re:So where did they come from?

[Anonymous Coward]

>> Not without a warrant
Gee, thanks for that. I just spit up some coffee I was laughing so hard reading your witticism.

Re:So where did they come from?

[X.25]

Only people foolish enough to think antisec actually cares about being truthful would think that. Lets face the facts here

12 million is a piss in the pond in terms of iOS UDID codes. Its less than half the iPhones sold LAST QUARTER. If the FBI was realistically trying to build a database of them, there is no way at this point they would ONLY have 12 Million.

12 million is more easily explained by being leaked from a developer, as up until half a year ago, developers were using the code to identify individual iPhones for various reasons like automatic sign-in to certain services like some of the multiplayer game services. Apple banned them from using it though half a year ago so at this point there was no reason to keep.

The data it's self was incomplete. Some had legit names and addresses while most were just a ID code. If this was from a official source then there would have been a lot more data on most of these. On the otherhand if it was stolen from a developer who let users opt out of giving their information but used the code for autologin purposes, then there would be clear reason why most of the data has no user info attached.

Antisec is still smarting from getting much of its higher ranking leadership arrested from a FBI plant

So really there is no reason AT ALL to believe antisec's claims that they stole the info. There is however a lot more reason to suspect they were trying to stir the pot in the tech community by stoking already present fears of FBI spying which they did a pretty good job at. It gets clueless script kiddies riled up and makes them look cool. Sure the FBI can be shady, but of the law enforcement agencies out there I would honestly have to say they are the least shady of the bunch and tend to release information without bending the truth too much, even when it has the possibility of embarrassing them. Not saying they ALWAYS do it, just saying they tend to be more forthcoming than other government agencies.

Why do you think that using caps would make your stupid points any more valid?

Re:So where did they come from?

[Anonymous Coward]

It's not an extraordinary claim. Saying the FBI DIDN'T have this sort of stuff would be an extraordinary claim.

Re:So where did they come from?

[amicusNYCL]

If the FBI was realistically trying to build a database of them, there is no way at this point they would ONLY have 12 Million.

You're assuming they got everything the FBI has? They claimed to have stolen a CSV file that was sitting on some guy's desktop in his machine, that doesn't exactly sound like the sum total of knowledge possessed by the FBI. Excel wouldn't be able to open a CSV file with that many records in it, so the data probably is destined for a database import script somewhere. This is more data for the database, not the entire database.

12 million is more easily explained by being leaked from a developer

Sure, like a single developer sending their data to the FBI for inclusion in the larger database. That would definitely explain why an FBI agent would have a CSV file containing "only" 12 million UDIDs sitting on his desktop.

The data it's self was incomplete. Some had legit names and addresses while most were just a ID code. If this was from a official source then there would have been a lot more data on most of these.

I don't know what you mean by "official source", but why wouldn't they compare this data with what they already have to see if they can add new records or update existing ones? If the ID is all they have then that's all they have, if there's more information associated with it then they'll add that to their records. Like you said, some have legit names and addresses.

Sure the FBI can be shady, but of the law enforcement agencies out there I would honestly have to say they are the least shady of the bunch and tend to release information without bending the truth too much, even when it has the possibility of embarrassing them. Not saying they ALWAYS do it, just saying they tend to be more forthcoming than other government agencies.

Yeah, that's just a ringing endorsement for why we should trust the FBI instead of people who have previously attacked the government claiming to now be attacking the FBI.

There's really no reason to believe either of them, frankly. Either side lying would suit their ends. I see less of a threat of AntiSec lying because it would damage their reputation more than if the FBI was caught in a lie. People expect the FBI to lie about things like this, if AntiSec wants to be taken seriously then they can't have a reputation for lying about where they get their data.

Re:So where did they come from?

[Anonymous Coward]

So you're argument is that the FBI is everyone, everywhere, all the time and therefore does need this data? I didn't realize I was FBI.

Re:So where did they come from?

[sjames]

Yes. Let's see, who do we trust here, an anonymous group of people who have never lied to me before or a TLA that has a long history of 'disinformation' and is a champion of the gag order.

Unless/until more information comes to light, the preponderance favors believing Anon.

Re:So where did they come from?

[Mike Buddha]

So they released a more detailed lie, and that makes it true? Sounds legit.

Re:So where did they come from?

[sjames]

No record is a better position than a TLA with a long history of lying to everyone including the President and Congress on numerous occasions.

Re:So where did they come from?

[thetoadwarrior]

Of course not or people will start believing those rumours about backdoors built into windows, OS X, etc for the government and might demand that changes.

Re:So where did they come from?

[Mike Buddha]

Life in America is so much worse now than it was pre 9/11. Oh wait, no it isn't.

Re:So where did they come from?

[zzsmirkzz]

Yes, tied to my single UID (zzsmirkzz). That is a record of a single person's actions/speech which can be used to predict that single person's future actions/speech.

However, when dealing with Anonymous their actions/speech can not be tied to any single person, organization or group. Due to the fact that anyone can use the identity (or lack thereof) at any time and for any reason, past actions/speech tied to the identity (Anonymous) cannot be reliably (or logically) used to predict future actions/speech of the identity. So the statement "Anon has a better record of telling the truth" has no real meaning because Anonymous can encompass everyone, no one, and all of the points in-between (depending on the context). The person who used the identity yesterday and happened to be truthful tells you nothing about truthfulness of the person who is using the identity today.

Re:So where did they come from?

[Zero__Kelvin]

"That is a record of a single person's actions/speech which can be used to predict that single person's future actions/speech."

No. It is not. It is a Slashdot account, which can be easily hacked into. Assuming for the moment that only legitimate users have the account password there is still no tying it to any single subset of people as far as we as Slashdot users are concerned.

"The person who used the identity yesterday and happened to be truthful tells you nothing about truthfulness of the person who is using the identity today."

The same can be said about you if you present ID and I verify your identity. Your point is beyond clueless.

Re:So where did they come from?

[zzsmirkzz]

Argued that way, I can accept that as a reasonable conclusion. However, I realize that Anonymous could include that very same TLA, although it is unlikely, or someone who is even more of a pathological liar. While the odds may be in your favor (it's arguable) it is not a slam-dunk.

Re:So where did they come from?

[KhabaLox]

Well, we got 3 out of 5 taken care of so far.

Re:So where did they come from?

[drinkypoo]

Life in America is so much worse now than it was pre 9/11. Oh wait, no it isn't.

It's not dramatically worse, but it is worse. Unless, you know, you really like having your nuts squeezed before you get on an airplane, for example.

Re:So where did they come from?

[PhxBlue]

A nameless, faceless, identity that anyone can assume at any time, by definition, does not have a record .

Which makes it all the more sad that their record is still better than the FBI's.

Re:So where did they come from?

[helix2301]

The concern of most people is if the FBI did not collect this data. Then where did the cache of UDID’s come from? How were they collected? Who else had access to them? What other information does the anonymous source have?

Re:So where did they come from?

[sjames]

Agreed, it's a guess, but it is an educated guess.

Re:So where did they come from?

[zzsmirkzz]

Yeah, I'm clueless in the sense that I have no clue what point you are trying to make. This happens to reflect more on you than it does on me. My arguments are at least logical and make sense. Yours seem to be alluding to knowing things in absolute terms which is ridiculous considering the context of the original conversation. Based on your logic, we know nothing because it cannot be proven that we are not just a brain in jar with our sensory inputs being manipulated and fed to us, matrix-style. Sure, that is a useful philosophical concept/argument but it is completely useless in all other facets of life and understanding.

Re:So where did they come from?

[Zero__Kelvin]

Go read David Hume's "A Treatise On Human Nature", get somebody to explain it to you, and then get back to me.

"My arguments are at least logical and make sense."

No. Your argument (singular) is pointless and means nothing.

Re:So where did they come from?

[BasilBrush]

They have no need to comment. So no, if they had done it, they wouldn't have had to admit it. Equally because they had the option not to comment, the fact that they have denied it has more weight. Why choose to lie rather than not comment?

Re:So where did they come from?

[BasilBrush]

Except that Anon has real evidence in this case, and specifics.

They have a partial list of UDIDs with some correct data and some incorrect data in it. That's evidence they have a list. It's not evidence where it came from.

Remember when Heartland documents were aquired by an anon person, and they couldn't resist adding one forged document to the collection. I'm afraid you can't assume that you're hgetting the truth and the whole truth from an anonymous person.

And, for that matter, if this agent is real and doesn't do this, why aren't they hiding him and not making him available for interviews?

That would be a silly precedent to set.

Re:So where did they come from?

[BasilBrush]

Heartland leaked documents. Most real, the most damming one faked. Maybe the name anon, maybe a different one. I'm afraid one can't attribute a good track record to random anon claims.

Re:So where did they come from?

[BasilBrush]

Then where did the cache of UDIDâ(TM)s come from? How were they collected?

UDIDs used to be a de-facto standard way of third party developer's apps having a unique index of users. Many developers could have collected this. More recently it's been banned - such apps will be rejected by the app store. Thus it's probably an old list, and chances are, not from the FBI.

Re:So where did they come from?

[Em Adespoton]

The sane majority also must refer to history books when dealing with statements made by activist groups and say that they're trying to look more important than they really are, and therefore also lying.

Hence my original point: I must assume everyone's lying. There is as much proof of invisible black Martian spy planes as there is of anyone's claims here.

Truly, you have a dizzying intellect.

Good thing I've built up an immunity....

Re:So where did they come from?

[grcumb]

In the absence of any further evidence, I must assume that everybody's lying. The real story is that the UDIDs were harvested wirelessly using petahertz radio scanners mounted on the invisible black helicopters flown by the lizard aliens who, due to their shared ancestry with birds, make excellent pilots, even in aircraft that are based on Martian stealth technology (which is why we're giving the Martians our nuclear-powered cars now).

Occam, I told you that razor was sharp. Now you've gone and taken your whole foot off with it.

And just look at my carpet! Do you know how hard arterial blood is to clean up...?

Re:So where did they come from?

[Xebikr]

A nameless, faceless, identity that anyone can assume at any time, by definition, does not have a record

And yet it still manages to have a better one than the FBI.

Re:So where did they come from?

[SomePoorSchmuck]

Only people foolish enough to think antisec actually cares about being truthful would think that. Lets face the facts here

12 million is a piss in the pond in terms of iOS UDID codes. Its less than half the iPhones sold LAST QUARTER. If the FBI was realistically trying to build a database of them, there is no way at this point they would ONLY have 12 Million.

12 million is more easily explained by being leaked from a developer, as up until half a year ago, developers were using the code to identify individual iPhones for various reasons like automatic sign-in to certain services like some of the multiplayer game services. Apple banned them from using it though half a year ago so at this point there was no reason to keep.

The data it's self was incomplete. Some had legit names and addresses while most were just a ID code. If this was from a official source then there would have been a lot more data on most of these. On the otherhand if it was stolen from a developer who let users opt out of giving their information but used the code for autologin purposes, then there would be clear reason why most of the data has no user info attached.

Antisec is still smarting from getting much of its higher ranking leadership arrested from a FBI plant

So really there is no reason AT ALL to believe antisec's claims that they stole the info. There is however a lot more reason to suspect they were trying to stir the pot in the tech community by stoking already present fears of FBI spying which they did a pretty good job at. It gets clueless script kiddies riled up and makes them look cool. Sure the FBI can be shady, but of the law enforcement agencies out there I would honestly have to say they are the least shady of the bunch and tend to release information without bending the truth too much, even when it has the possibility of embarrassing them. Not saying they ALWAYS do it, just saying they tend to be more forthcoming than other government agencies.

Why do you think that using caps would make your stupid points any more valid?

You need to get over it. It's not like this is a 1993 IRC flamewar with people "SHOUTING". The very very occasional use of caps in that post is quite obviously an attempt by the author to compensate for the lack of inflection and affect in pure text and render the text more conversational. The caps indicate words which in spoken discussion would be given extra emphasis. "Not saying they ALWAYS do it", for example, is the way normal people talk in the normal world which you seem intent on scoring Internet Warrior points by scoffing at. I wonder, when you're in administrative planning sessions at your job, do you commonly listen to people speak and then ask them, "Why do you think that varying your tone and accenting different words in your sentence would make your stupid points any more valid?". Good luck assimilating the other 7 billion people on the planet into your world of preferential monotone.

Re:So where did they come from?

[Anonymous Coward]

A whole bunch of us have time traveled from before 9/11/2001.

And we, the bunches, do remember what it was like before that time, just like we remember what we've been told it was like before that time. And what we've been told it was like 4+ years ago.

A "free society" didn't happen in the past and sure ain't happening now. Hard to know what it would really be like in a such a place.

Re:So where did they come from?

[Anonymous Coward]

I don't know, maybe the FBI could investigate.

Re:So where did they come from?

[Mike Buddha]

Life in America is so much worse now than it was pre 9/11. Oh wait, no it isn't.

It's not dramatically worse, but it is worse. Unless, you know, you really like having your nuts squeezed before you get on an airplane, for example.

You used to have to pay for that.

Re:So where did they come from?

[Anonymous Coward]

I guess you haven't heard about the Patriot Act.The bill of rights has been null and void since Congress replaced the Bill of Rights with the Patriot Act.

Re:So where did they come from?

[Anonymous Coward]

Rational, intelligent, reasoned...is this Slashdot? Are you lost??

Re:So where did they come from?

[BasilBrush]

Except that Anon has real evidence in this case, and specifics.

Told you so. The list came from a third party app developer, not the FBI.
http://redtape.nbcnews.com/_news/2012/09/10/13781440-exclusive-the-real-source-of-apple-device-ids-leaked-by-anonymous-last-week

Collection != leak

[AwaxSlashdot]

There are 3 issues here:
* who collected them ? (most probably an app)
* who "lost" them ? (AntiSec claim they found it on a FBI agent laptop they compromised)
* how the data went from #1 to #2 ?

And the 3rd one is the most interesting.

Re:Collection != leak

[Anonymous Coward]

yeah, maybe the agent is investigating somebody who is stealing udids and if they say "oh yes this was part of our investigation into udid theft" the tinfoil freaks will still wouldn't believe it anyways and the crooks will close up shop and hide out. so basically anti-sec just disrupted an investigation into an internet crime (and i mean real crime for once not piracy) way to go script kiddie assholes.

Re:Collection != leak

[zill]

I see several people mentioning it was a Trojan app, but then where did the addresses and zipcodes come from?

Do people actually store addresses and zipcodes on their phones?

Re:Collection != leak

[Anonymous Coward]

> Do people actually store addresses and zipcodes on their phones?

No grandpa, no one would ever have addresses and zip codes in a phone! That wouldn't make a lick of sense!

Re:Collection != leak

[Sarten-X]

Yeah, that's the weird part. My phone has phone numbers, and that's it. Of course, I don't use my phone for much other than phone calls, so I'm pretty secure. I don't even download many apps, just some games now and then. Oh, and there was this one app a friend recommended to me, where I just download it and fill out a survey for a chance to win a $50 Wal-mart gift card! For each person I refer, I'll get another chance to win! Of course they wanted my mailing address for that, but that's okay. I'm expecting a gift card any day now!

Re:Collection != leak

[canajin56]

I'd imagine that some people have their home address in their phone for GPS purposes. Or, the trojan could have been monitoring movements via GPS, and whoever was running it could have been reversing that into probable addresses. Or it could be cross referenced. If they use their wifi at home, the trojan could get an IP address. Many online stores will connect your IP address to your zip code and/or your address, and sell that data point to geomapping services. Even stores that do not sell online, but have a "find a store near me" will sell the same data. It's not always very accurate as people tend to put fake zip codes in when it doesn't matter. But still. It's important to remember that many (or most?) of these rows do not have address or zipcode information. AntiSec redacted those columns before releasing it so we actually don't even know they were present at all, and if they were, what percentage of rows had these data.

Possibilities...

[Severus Snape]

1. AntiSec is lying.
2. FBI is lying.
3. AntiSec is telling the truth and the FBI's methods of obtaining the UDID codes means they can't admit to it.

Re:Possibilities...

[Anonymous Coward]

Point 3 is redundant after point 2.

Re:Possibilities...

[jfdavis668]

Another option, AntiSec hacked someone pretending to be an FBI agent. I have run across people like this, who are trying to con you or just getting their jollies.

Re:Possibilities...

[Impy the Impiuos Imp]

"Dwight, pull over. Dwight, stop throwing weapons out of the car. Dwight..."

Re:Possibilities...

[cornicefire]

Another option is that some third agency, as yet unnamed, officially owns the UDID values, and they were just sharing them with this guy. The agencies always play this game. They'll say "No one at ABC did this" knowing full well it was someone at the XYZ agency who was assigned to ABC. In the mean time, XYZ will deny authorizing anyone to do it, knowing full well that the authorization was done by someone at ABC.

Re:Possibilities...

[zill]

Wait, so you're saying there's a con man out there who pretends to be an FBI agent and he somehow has the personal information of a million iPhone owners?

Re:Possibilities...

[jfdavis668]

If it is real data, no. I have tools that create test data which can make millions of very realistic records. Has Apple verified it?

Re:Possibilities...

[jfdavis668]

I agree, Another possibility.

Re:Possibilities...

[guises]

It seems possible to me that the FBI had the UDIDs but didn't know it. With warrantless searches now the norm and the unscrupulous attitude that that implies, agents don't have or expect the oversight that they used to. So it could easily be that an agent collected those, thinking it was no big thing.

Re:Possibilities...

[vlm]

Another option, AntiSec hacked someone pretending to be an FBI agent. I have run across people like this, who are trying to con you or just getting their jollies.

Infinitely more likely is they hacked a civilian employee or contractor of the FBI who merely happened to have the named agent log into the laptop once, or maybe the named agent worked closely with the civilian. That way the FBI can truthfully deny, yes, indeed, the FBI has no UDIDs...

They also VERY SPECIFICALLY stated that no "FBI laptop was compromised". This is very important. The MIB might have copied the file onto his personal laptop, or it was technically a FBI leased laptop instead of being a FBI owned laptop, or in some sharing arrangement the laptop was technically owned by the treasury dept as some kind of expense sharing arrangement, or the FBI gets this data (from apple?) by having apple mail a apple owned laptop full of data to the FBI, or its part of a cooperative cross departmental arrangement where the NSA provides the hardware, the FBI provides the men on the ground to lean on apple to release the data, and the DSA provides physical security/office space, so technically in the narrowest possible definition yes that is not a "FBI" laptop.

Re:Possibilities...

[zill]

It's been publicly verified. Since the data is public, any iOS user can see if their device is on the list or not.

This whole discussion is moot if it's just junk data. Whether FBI, Anonymous, or some other party collected the data, its very creation means that laws were broken.

Re:Possibilities...

[slackware 3.6]

If you generate a million phone numbers some one is going to find their number in the list.

Re:Possibilities...

[IMathGood]

1. AntiSec is lying. 2. FBI is lying. 3. AntiSec is telling the truth and the FBI's methods of obtaining the UDID codes means they can't admit to it.

aren't 2 and 3 the same thing?

Re:Possibilities...

[a_n_d_e_r_s]

You pulling the NSA card out of your hat ?

Re:Possibilities...

[gman003]

4. They're both lying
5. AntiSec isn't deliberately lying, but were misinformed (eg. the list was actually used by $sinisterGovernmentAgency, but they were masquerading as FBI for some sinister reason)
6. The FBI isn't deliberately lying, but those speaking were misinformed (eg. it was part of some project spearheaded by some upstart who didn't get authorization)

Re:Possibilities...

[zill]

The phone numbers wasn't released for privacy reasons. What was released (if you bother to click the link) was the UDID, APNS Token, and device name. I really don't see how a randomly generated list can match both the UDID and corresponding device name.

Re:Possibilities...

[Nocturnal Deviant]

It's not like FBI agents are all IT nerds like us, I am SURE he has a personal laptop. usb drive? for email or something? just because it is against the rules doesn't mean people don't do it(case in point I have seen far too much and too scary porn in the workplace...its always awkward calling them down and telling them to stop.)

Re:Possibilities...

[gl4ss]

If you generate a million phone numbers some one is going to find their number in the list.

generating udids is a lot harder than generating phone numbers. generating them randomly and having them match to right device type/name for people is even harder.

Re:Possibilities...

[Culture20]

You pulling the NSA card out of your hat ?

I believe that card is actually pulled from another three letter word.

Re:Possibilities...

[Anonymous Coward]

4. AntiSec baited the FBI into lying. It's the cover-up that gets you, not the crime.

Re:Possibilities...

[Anonymous Coward]

Another option, AntiSec hacked someone pretending to be an FBI agent. I have run across people like this, who are trying to con you or just getting their jollies.

Or it's an undercover FBI agent and they've traced the intrusion right to the hackers doorsteps. The only valid apple id's are those of the agents themselves!

Misleading headline.

[Anonymous Coward]

From TFA: "At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data"

Saying there's no evidence isn't the same as saying it didn't happen.

Re:Misleading headline.

[benjamindees]

That just means they destroyed all evidence of having collected the data in the first place. You see, the US now practices "quantum" intelligence gathering. If they collect data, but don't look at it, it's the same as never having collected it to begin with. Likewise, if they collect data, and lose the data, and then delete the evidence that they collected the data, and deny that they lost the data, everything turns out fine. It's all very complicated physics that you wouldn't understand, documented in detail in the Back To The Future movies. The lost data should begin erasing itself any minute now. Any. Minute. Now.

Re:Misleading headline.

[__aaltlg1547]

Proving a laptop has not been hacked is impossible. If the FBI determines data that were on his laptop have been compromised they'll send him back to data security 404 and give him a new laptop.

Re:Misleading headline.

[crazyjj]

Yeah, anytime you're dealing with a government press release or statement you have to CAREFULLY parse the language. These things are carefully crafted to imply things they don't actually say. "I personally have no knowledge of such an event happening" is NOT the same as saying "This event didn't happen." There are a million ways to imply things without saying them, and a dumb and gullible press will usually swallow them hook-line-and-sinker 99% of the time.

Re:Misleading headline.

[JBMcB]

No, but if you're claiming you hacked into an FBI laptop and stole data that the FBI claims doesn't exist, you'd better have *some* sort of proof.

Maybe a script kiddie hacked into an AT&T server and got the UDIDs, but claiming that they hacked into the FBI would make them sound cooler.

Re:Misleading headline.

[Anonymous Coward]

I can neither confirm nor deny that this vessle or any US Navy vessel contains nuclear weapons.

Although I've done neutron radiation surveys with an AN/PDR-70 in the missle compartment and I can tell you that.. well I can't tell you.

Re:Misleading headline.

[blueg3]

No shit. They don't have magic spy software on their own laptops that can provide absolute proof. How's someone at the FBI going to determine, without a doubt, that none of the laptops the FBI uses was hacked? How are they going to determine that absolutely zero agents requested or managed to get their hands on the information being discussed? They can't.

So, while they're using weasel words, it's also the correct way to respond: They can't be absolutely sure of their statement, but they have no evidence that would lead them to believe otherwise.

Re:Misleading headline.

[game kid]

As I've said before about that Comcast-NBC thing, "PR guys love to reveal without revealing and lie without lying." I think this FBI stuff, like that thing three years before, is obviously another "inaccurate" but true report.

I also think I'm even more glad that I don't own an iPhone.

Which is more likely

[thePowerOfGrayskull]

Which is more likely - the fbi just happened to lose a laptop with millions of UDIDs that it had no reason to have and anonymous just happened to find that particular laptop? Or that someone in anonymous wanted to make waves and so made a bold (but unverifiable) claim?

Pardon me, I need to go shave.

Re:Which is more likely

[siddesu]

In a perfect world, the second would be more likely. However, if you stack it againt the hundreds of cases every year where officials or executive lose equipment with mega or gigabytes of personal information, I'd say that IRL the first is at least as likely as the second.

Re:Which is more likely

[trout007]

http://www.dailytech.com/article.aspx?newsid=24281

Re:Which is more likely

[Gaygirlie]

Laptops are being lost all the god damn time and Anon is a very, very large group of people -- I'd say the chances are actually darn good. Also, I'd say the chances are darn good for FBI to lie whenever something like this happens, just for the sake of looking good in the eyes of the general public and for painting anyone who disagrees in bad light.

As for unverifiability: apparently some of those UDIDs have already been verified.

Re:Which is more likely

[EasyTarget]

Anonymous targeted the FBI guy, he is moderately senior and very active + well known in white-hat circles; what goes around, comes around. .. or in your haste to fud did you skip the article, and all the articles yesterday, where it is made clear he was hacked and did not 'lose' his laptop.

Re:Which is more likely

[Cronock]

There were quite a few apps that were caught collecting UDIDs, if I remember correctly. It's not actually all that far-fetched to believe that somebody, in order to gain some "street cred" actually obtained it in this manner, then released it saying it had come from the FBI to undeservingly inflate their reputation.

Re:Which is more likely

[wbr1]

The FBI did not lose the laptop. According to Anonymous, it was broken into using a Java exploit.

Re:Which is more likely

[flaming error]

"Chances are darn good"?

I don't know the numbers, but I believe the formula would look something like this:

(odds fbi collects apple udids) * (odds udids kept on agent's laptop) * (odds of fbi agent losing laptop) * (odds member of anonymous finds it)

I think that product will be a pretty small number.

Re:Which is more likely

[EasyTarget]

Actually it looks like this:

(1) * (1) * (odds anon target well known fbi man and hack into his laptop over the evil internet)

Re:Which is more likely

[circletimessquare]

I don't trust Anonymous more or less than the FBI, but the motivation to pull this story out of their ass seems smaller than an FBI stooge's motivation to deny and cover their ass.

FBI brass might even be pitted against FBI agent: brass said don't get the UDIDs and the agent went and obtained them anyway. The FBI is a large bureaucracy with complicated relationships between semi-independent operatives, and it's possible there is low coordination between FBI spokesman and FBI worker. Anonymous may have more operational integrity, at least on this isolated issue.

Is your barber named Occam?

Re:Which is more likely

[Anonymous Coward]

That's funny. Funny you think companies aren't hilariously ignorant to the fact they are carrying millions of peoples sensitive information.

Why, I remember when someone in the UK "lost" (forgot to pick up the damn) laptop with millions of peoples financial information on it. 2 discs worth I think it was.
NO encryption in the slightest.

You'd think these damn SECURITY agencies would use encryption.

Re:Which is more likely

[Anonymous Coward]

Laptops are being lost all the god damn time

Well, duh. Did anyone say otherwise? The operative part of that was "a laptop with millions of UDIDs that it had no reason to have". Beyond the question of why the FBI would need them at all, there's no reason something like that would be on a laptop, let alone an SSA's. Something that dry and supplmental isn't something any investigator is going to need to carry around with them - that's for analysts, not field agents, let alone senior ones who spend most of their time supervising and directing their juniors. And any DoJ/FBI computer, especially a laptop - for the obvious, common-sense reason you gave - is going to have encryption forced on it, usually smartcard-based. There's a million holes in the idea that a senior special agent was walking around with a list of millions of Apple UDIDs on his laptop, lost said laptop, and neckbeards were able to get into it, finding nothing to release or publish except said list. Especially since Anon is usually all over dumping anything they can when they have a chance to humiliate an agency, like dumping their email, personal documents, internal memos.

Re:Which is more likely

[JBMcB]

Also, I'd say the chances are darn good for FBI to lie whenever something like this happens, just for the sake of looking good in the eyes of the general public and for painting anyone who disagrees in bad light.

I find it very difficult to believe that this, the most *transparent* administration in recent history, would allow such lies to be promulgated.

Re:Which is more likely

[Terrasque]

The odds of them hacking an FBI laptop is pretty damn good considering:

1. FBI is probably investigating AntiSec
2. AntiSec knows that FBI are probably investigating them
3. New security hole for Java released, not patched
4. Lots of government'y stuff use Java

AntiSec could just make a page using that security hole and "accidentally" let it slip to the FBI, and pronto, one (or many) hacked FBI box(es) served right up.

So, the chance of them gaining access to a few FBI boxes are rather high, all considering. And the chance of them finding *something* interesting on one of them is also rather high IMHO (birthday paradox theory).

Re:Which is more likely

[L4t3r4lu5]

As for unverifiability: apparently some of those UDIDs have already been verified.

False conclusion. The fact that some UDIDs are valid does not verify they were taken from an FBI laptop.

Some genuine UDIDs which were already known could have been included in a group of numbers which match the form of the others (I'll make you a script to generate them in a couple of minutes, if you like), but are in fact fakes, meaning only Apple could tell the two apart. As a lot of Anon's "work" is "for the lulz", I wouldn't put it past them to do something like that. Scruples are one thing they're lacking.

Re:Which is more likely

[freeze128]

Whoa there Nellie! The data was released by AntiSec, not Anonymous.

Anonymous has been in the news so much, I'm sure you just got a little confused.

Re:Which is more likely

[Anonymous Coward]

FBI has encrypted all their portable devices, especially laptops, for many years using whole drive encryption. If this laptop was found, it was not hacked into.

Crackers would have to gain access to a running laptop when the data was already decrypted. THAT is very possible if the device were used improperly. I'd think that the FBI would mandate a VPN without split tunnels for all the data devices they deploy. That way all data traffic would have to penetrate FBI enterprise firewalls and proxies first.

Blackberries do these things and can be centrally controlled.

I think it is much more likely that either an app was used or that a corporate DB was cracked containing this data. Heck, it may have been stored in a spreadsheet on a system or server at AT&T mobility.

Cat's out of bag.

[Ostracus]

"The FBI has denied the UDID codes released yesterday came from an agent's laptop, as claimed by the AntiSec hacker group. The FBI says it does not hold such data, and the attack never happened. However, the agent named by AntiSec is real, and some of the published UDID codes have been found to be genuine. So where did they come from?"

Maybe from a soon to be blown case were the FBI is investigating an anonymous hacker group?

Re:Cat's out of bag.

[crazyjj]

Maybe from a soon to be blown case were the FBI is investigating an anonymous hacker group?

Or evidence that they're building a giant fishing net (with ALL of us in it) for future fishing trips. When there are 12 million entries in a database on a single laptop, all just from iPhones and iPads alone, I tend to think this is much larger than just some individual investigation. Shit, that's over 10% of Apple's *ENTIRE* active U.S. iPad and iPhone userbase, on that one laptop alone. That's not from any one investigation, or even several.

Aliens.

[craznar]

We all know that alien computers talk seamlessly to Apple devices.

So the aliens have been collecting them for years.

What took the aliens so long to publish them - was talking to a Dell Windows laptop.

Issue?

[symes]

This is not something I know a great deal about, but surely the UDID is pretty easy to get hold of. Surely most suppliers will keep a record for warranty/insurance reasons. AFAIK, many apps can access this information. ITunes relies on it. These data could just be from the FBI looking for patterns of insurance fraud, or similar. And I wouldn't be surprised if a load or organizations hold this sort of data for a range of gadgets. I bought a fridge a while back and had to send the serial number off to some third party to have my warranty set up. I am happy to be corrected though, and told this is a huge privacy thing.

Re:Issue?

[Sarten-X]

This is a huge privacy thing, just like any American's Social Security number. You know, that number where the last four digits are used frequently for identification to third parties, the first three are based on where you were born, and the middle two are based on when you were born...

Being a privacy issue doesn't necessarily mean it's kept particularly secure.

Re:Issue?

[O('_')O_Bush]

Any app developers out there? If it is anything like Android, any app with sufficient privileges can send the phone's unique identifier to a server to be stored. Whether it be the hash looking thing for the phone itself, or the phone number for that account.

Re:Issue?

[Bogtha]

Surely most suppliers will keep a record for warranty/insurance reasons.

The UDID is separate to the serial number; there's no reason to use the UDID for this purpose.

Re:Issue?

[platypusfriend]

Access to the UDID is deprecated. iOS developers now have to generate and maintain their own UUID, which can of course be wiped by the phone owner. The reason for this, at least partly, is so phones aren't permanently tied to service X or Y when the device changes ownership. --- http://developer.apple.com/library/ios/#DOCUMENTATION/UIKit/Reference/UIDevice_Class/DeprecationAppendix/AppendixADeprecatedAPI.html

Re:Issue?

[Anonymous Coward]

I found one of my devices listed in the initial 1MM+1 dump. It came from Glitter Draw app.

This sort of fits...

[Revotron]

...with the general attitude I saw from Slashdot regarding the original story. It almost sounds like a complete fake just because what the hell would the FBI possibly do with a deprecated SHA1 hash of a few device-unique identifiers? Verify that their super-secret gub'mint database of everyone's iPhone MAC addresses and MEIDs has no row errors?

It's worth reiterating from the other story that Apple doesn't even accept apps that reference the UDID any more, and it was never used as a security or authentication feature in the first place. It's like saying "lol, you got pwned, I just got the MD5 hash of your entire hard drive, LULZ LULZ LULZ WE ARE ANON"

If the FBI really wanted some useful information, they could swipe your ESN/MEID and track you down to a cellular level. Hell, they probably already have. Smile at the camera!

Re:This sort of fits...

[wbr1]

If the DB contained names and other person identifiers (which were supposedly stripped before release), then if an FBI agent snatched a phone briefly, it could be used to quickly verify the phones owner.
In addition, even though its use as a device identifier is depreciated, apps still use it, and could be used to spoof authentication to certain apps central servers, thereby allowing the holder (if the UDID was used as the single form of ID), to mine data from the app, or log in as you from a jailbroken iDevice.

Re:This sort of fits...

[Anonymous Coward]

then if an FBI agent snatched a phone briefly, it could be used to quickly verify the phones owner.

This is a big problem lately. Why just the other day, some guy in a black suit and sunglasses came up to me, snatched my phone, scanned it with a little scanjigger and I was just like "Aw man now they're going to know that that was my phone!".

Re:This sort of fits...

[Revotron]

other person identifiers (which were supposedly stripped before release)

Hopefully you can understand why I have my doubts in this scenario. It's like Joseph Smith and the gold tablets. "Only I'm allowed to see them, so I'll stare into this top hat and read everything to you."

Also, apps (and app updates) from the last year or so that use the UDID in any way have been rejected by Apple on that basis alone. Any app that uses the UDID as its sole authentication mechanism would hopefully not contain any sensitive personal information, and fortunately anyone that dumb probably couldn't code their way out of a wet paper bag.

I could be completely wrong and the FBI might just like to track some magic hashes for shits and giggles, but I think it's far more likely that Anon slipped some random fart app through to collect a bunch of UDIDs and used the conveniently-timed Java vulnerability to conjure up a believable breach scenario.

Re:This sort of fits...

[Anonymous Coward]

what the hell would the FBI possibly do with a deprecated SHA1 hash of a few device-unique identifiers?

Provision the TotallyNotAnFBISnooper.app app for the phone?

Re:This sort of fits...

[Anonymous Coward]

The government has a new datacenter in Utah with the explicit purpose of doing just that: A massively data-mineable database containing a wide array of info on all users of the entire Internet. It is entirely possible.

Re:This sort of fits...

[Anonymous Coward]

Services have already been retooled and compromised services should be sued for criminal negligence. Apple explicitly said from the get go to never use the UDID as a static account token. You can never assume a device IS a user, only that a user is useing the device right now.

Second, if an FBI agent snatched a phone wouldnt a look at the photo library or facebook or email app would be faster for confirming its owner.

In my oppinion your ip address is more sensative then a UDID.

I agree that this is no more then an ego trip with a poorly written fake backstory meant to make men in suits write press releases. It has no real security or monitoring value.

So where does that assumption get you?

[Anonymous Coward]

The FBI are lying about it not being theirs and ANON are lying it about it being theirs.

Is this some sort of Schroedinger's laptop?

Re:So where does that assumption get you?

[jythie]

I do not know how.. I do not know when... I do not even know why.. but I will find and excuse to use the phrase 'Schroedinger's Laptop' someday.

Re:So where does that assumption get you?

[dr2chase]

Quantum dual boot?

Re:So where does that assumption get you?

[Anonymous Coward]

A laptop that boots and doesn't boot at the same time ?

Re:So where does that assumption get you?

[Sarten-X]

A small sample of a radioactive isotope in front of a Geiger counter attached to a GPIO pin, whose value is used by the bootloader to pick which OS to load. If the isotope has decayed (and emitted a particle toward the sensor) recently enough that the pin is high, boot Debian. If the sample has been stable long enough that leakage has grounded the pin, boot Fedora.

This is AWESOME! Another triumph of mad computer science!

Re:So where does that assumption get you?

[funwithBSD]

It only boots if you don't observe it.

Re:So where does that assumption get you?

[93 Escort Wagon]

Is this some sort of Schroedinger's laptop?

I had one of those about 12 years ago - a Dell Inspiron 3800. At any given moment you wouldn't know whether it was going to work or not until you tried to turn it on.

Re:So where does that assumption get you?

[DarwinSurvivor]

Or does it?

Re:So where does that assumption get you?

[Anonymous Coward]

So...Windows?

Re:So where does that assumption get you?

[Zero__Kelvin]

"A laptop that boots and doesn't boot at the same time ?"

No good. Bill Gates already invented that.

Re:So where does that assumption get you?

[zlives]

a dual boot laptop that boots into an os... but which os?

Re:So where does that assumption get you?

[zlives]

for the ms vs linux crowd

a dual boot laptop with a crashed or non crashed os state
which os? /troll

Re:So where does that assumption get you?

[KhabaLox]

The laptop could contain either a functional OS or a non-functional OS, but you won't know which one until you boot it.

Re:So where does that assumption get you?

[mcgrew]

I will find and excuse to use the phrase 'Schroedinger's Laptop' someday.

I have an easier one for you -- Schroedinger's fridge!

Re:So where does that assumption get you?

[Anonymous Coward]

Is this some sort of Schroedinger's laptop?

I had one of those about 12 years ago - a Dell Inspiron 3800. At any given moment you wouldn't know whether it was going to work or not until you tried to turn it on.

And that's different from every other kind of laptop... how?

In fact, never mind laptops - any computer or electrical device - its fairly hard to know that isn't going to work, until you try getting it to work....

Unless devices come with a 'fucked' indicator that I've just been missing for all these years?

Re:So where does that assumption get you?

[Anonymous Coward]

Flash upgrade the bios on any laptop. They are so damn difficult to get fixed if anything goes wrong. So for thirty seconds while it might reboot, I get to watch a brick and laptop at the same time.

Re:So where does that assumption get you?

[geminidomino]

Unless devices come with a 'fucked' indicator that I've just been missing for all these years?

Laptops, at least, do.

Look for "Designed for use with Windows Vista"

Re:So where does that assumption get you?

[Em Adespoton]

I wonder what Schrodinger would have thought about LOLCats?

The meme's only dead if we don't mention it....

Plausible deniability

[GeekWithAKnife]

If the data is obtained illegally, without due process that's all the FBI really needs to do. "It wasn't me". Of course, as history might educate us, later on they might u-turn and pull one of those "Well actually..." So if the data is real, it came from somewhere, someone was holding it, who was it? I thank the FBI for its response as it will only spur further investigation. Let's get down to the bottom of this.

Re:Plausible deniability

[Anonymous Coward]

Are you sure it wasn't a honey bear trap? Take a look at how the data is distributed, check the queries to the apple data site? To locate a device that they don't have record of, to look at results of, etc.

I hate to be the one to say this...

[tekrat]

But I trust the hacker group more than I trust the FBI.

It's more likely the FBI is lying to cover up something. I mean, we're talking about the *government* -- not exactly our best and brightest, but definitely good at the "cover your ass" game.

Re:I hate to be the one to say this...

[PRMan]

Exactly. Anonymous and Antisec have seemingly been completely honest in the past, when it comes to claiming responsibility for hacks. The FBI is known to lie and cover up. Given past experience, Antisec is more likely to be telling the truth.

Re:I hate to be the one to say this...

[Anonymous Coward]

They've been completely honest in claiming responsibility for hacks, even the ones it turns out never happened like the most recent round of PSN "hacks" where they claimed millions of compromised accounts and nothing was ever seen or heard of it past Sony's "Nope" response.

Re:I hate to be the one to say this...

[Anonymous Coward]

Trusting "PRMan" is like buying movies from "PirateDude". Sorry buddy.

Re:I hate to be the one to say this...

[cryptizard]

Maybe they had the UDIDs as part of an investigation into actual hackers/criminals (i.e. evidence), which would prevent them from commenting on it now. Just another possibility that seems more likely to me than the FBI somehow harvesting relatively useless phone IDs.

Re:I hate to be the one to say this...

[Anonymous Coward]

The FBI puts a gun to every American citizen's head, and steals their money in order to fund the FBI's paychecks. There is no way in hell I would trust those people. AntiSec are far more trustworthy.

Re:I hate to be the one to say this...

[Anonymous Coward]

But I trust the hacker group more than I trust the FBI.

Why, hackers are often liars and boasters, why would you just believe someone you don't know?

Phew!

[hackula]

Sigh... What a relief!

At least two possibilities

[MikeRT]

1. They're just lying. This is the FBI, after all. The group whose IG basically called their field agents a bunch of incorrigible criminals when it came to obeying the law on when and how to use National Security Letters from 2006 onward.

2. This was done by a few agents and their management and the FBI leadership and public relations genuinely had no idea that some of their people were soliciting and/or receiving (solicited or not) such information. If this be the case, I wouldn't be surprised if the FBI throws this agent under the bus and runs it over him several times for a federal offense or two related to dragneting. It's not that they'd be genuinely upset by him getting this data, so much as the FBI does not suffer employees who make it look bad for any reason (I have relatives who used to be federal law enforcement, and they used to refer to the FBI as publicity whores).

cause it's not like they would lie, is it?

[chris.alex.thomas]

I mean, if the FBI says it didnt happen, then it didn't happen, right guys??

"Misinformation"

[lkcl]

uhnnn.... is this the same FBI that was to be involved with the *deliberate* disinformation "strategy" - if it can be called that - to put out complete whopper lies and try to back-track where they came from in order to catch "terrorists" and other criminals?

Odds are

[Anonymous Coward]

Odds are the FBI is trying to get Antisec to release the remaining information so they can be tracked and identified.

1. The information is not a direct security threat to the FBI so they have no concern in protecting it.

2. The fact the hacker group gave themselves a unique name "AntiSec" will make it a lot easier to pattern match and track them down. In fact I would bet the FBI already has a majority of the leg work done and they are just waiting to spring the trap.

3. The FBI has a proven history of not being trustworthy.

Let's see whay AntiSec does and how careful they are at doing it.

Re:Odds are

[EasyTarget]

"unique name "AntiSec" will make it a lot easier to pattern match and track them down"

For instance, if (as I just did) you type it into google; you get taken straight to the homepage of their leader, complete with pictures of his monorail.

Someone really needs to kick the FBI's asses over this, I mean, why are they taking so long to arrest them all when it's so easy.

The agent is a hacker

[Cigarra]

Maybe the FBI agent (the laptop owner) moonlights as a hacker.

Re:they came from my balls

[Anonymous Coward]

Your mom. Oh wait, no, she gave me a shitty dicknip.

This could get interesting...

[Atomus]

Now that the FBI basically rejected AniSec's claims and Adrian Chen put on a pink tutu with a shoe on top of his head (Source: Link), AntiSec can now respond to the FBI's denied claims. I just threw some popcorn in the microwave.....

Here is the Deal

[M0j0_j0j0]

You help us ban our competition; we will give you full access to our data deal??

Re:Here is the Deal

[benjamindees]

We'll also help you with that pesky "citizens recording things they shouldn't" problem.

FBI Sux

[Anonymous Coward]

Anyone who believes anything the FBI says is a complete idiot. Their main job is to lie to the public. Welcome to 1984.

Fourth possibility

[puddingebola]

Fourth possibilty: Hacker group is telling the truth, FBI doesn't know of existence of laptop, FBI didn't know information was on laptop, maybe agent that illegally obtained information had on laptop, FBI can deny in complete ignorance. Fifth possibility: IDs obtained by aliens in Hangar 18 and placed on laptop. Occam's razor is a lie.

Sounds familiar..

[BVis]

"There are no tanks in Baghdad!"

TRIFECTA

[Anonymous Coward]

Perhaps the perp is a triple agent CIA posing as FBI and Anon obfuscate the CIA role in survelance and data gathering against US citizens, the laptop and agent name as a red herring, what is the actual operational design, it is for this disinformational debreifing to disguise ; )

Iphone/ipad ap

[Anonymous Coward]

Scan to PDF - http://itunes.apple.com/us/app/scan-to-pdf-scan-multi-page/id549095412?ls=1&mt=8

This app turns your iPhone or iPad into a Handy Scanner, Fax, File Storage or an Air Printer in your pocket. It lets you scan high quality multi-page documents, print it to any AirPrint capable printer in your wifi network, email it or save it to a document folder on your device, post it to Google Docs or fax it to any fax number, directly from your iPhone, iPad or iPod Touch.

A highly useful app designed for individual or businesses use.

I'm more inclined to believe AntiSec

[realsilly]

...based on the information they put out.

And the disinformation tactics of Govt. agencies. I think the FBI is try to call the AntiSec bluff, to get them to release more info. And once more info is released, then the FBI will use this info to try to track back to source, arrest and use the info as evidence against AntiSec individuals.

But this is my hunch.

Misleading Summary

[Anonymous Coward]

The FBI did not say the attack never happened, nor did it deny that it had the UDID records. It just said that there was no evidence to support either claim.

"The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data."

IOW, Antisec didn't publish details of the hack, and nobody has any proof that we had the records in the first place.

Remember, it's not you know that's important, it's what you can prove.

Ya no shit

[Sycraft-fu]

I'm not saying we should just blindly believe the government, but it is even stupider to blindly believe random wanna-be hackers.

The FBI actually does have some reason to tell the truth. Law enforcement often has a pretty strict policy for public statements of "Tell the truth, else say 'no comment'" This isn't for altruistic reasons so much as to make sure they don't leak anything relating to a case they don't want to. The idea is that stuff either is or is not approved to be released and if it isn't you just don't talk about it. The reason is that if you lie, the lies could accidentally lead people to the truth.

Sort of the reverse of why you don't talk to the police in interrogations. If you sit there and lie, rather than mislead them it can actually end up leading them to the truth. However if you just shut up and don't say anything, they get no information.

So while I'm not saying I'm going to believe the FBI 100% here, antisec needs to provide more proof. They have plenty of reason to make shit up

Re:Ya no shit

[HiThere]

I wish I could believe that. Unfortunately, the government generally, and law enforcement officials more specificly, have a WORSE track record for telling the truth than does J. Random Hacker.

If I go strictly by probabilities, I'd believe Antisec. But I happen to feel that it's OK to remain undecided.

P.S.: Saying "Antisec needs to provide more proof" is not reasonable. If they have tapped something, an incomplete result is to be expected. (I.e., if they intercepted communications in process rather than hacking the computer.) Saying that you won't believe then would be a bit better, but without expressing what additional evidence would convince you, not much better.

For that matter, I'm not sure what either side could do to convince me that they were telling the truth, but I don't count a simple assertion as worth even considering. Especially not from the govt., which has a horrible track record of lying even when the truth would be to its advantage.

I'd proof this better, but the combination of slashcode with firefox makes proofreading a painful process.

Cellphone numbers, Addresses, Zip codes etc.

[Anonymous Coward]

Antisec released a sample of the UDID's which they said they have un unredacted version including names, addresses, zip codes, phone numbers etc. From the original article:

"NCFTA_iOS_devices_intel.csv' turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc."

I'm inclined to believe that a spreadsheet of mobile phones would at the very least include the telephone numbers, if not the user name and other details. As to whether it came from the FBI? Proof would be more data from Antisec, however FBI have a reason to lie (FFS, if they have the iOS user list, of course they'd lie about it! It would be a wholesale violation of privacy.).

The Application, and an open request...

[nweaver]

It really depends on the application in question: The Push tokens are application specific, and Apple knows or can trivially find out which application vendor is the source of this information.

If its a game, then the Anons are full of it, there is no reason for the FBI to have gotten that data.

If its something like, well, who knows, then the Anons are probably telling the truth.

If some slashdot reader's UUID is on the list, please contact me. It may be possible to use the phone backup file to determine which application was responsible for this data breach.

File name instructive

[Anonymous Coward]

"NCFTA_iOS_devices_intel.csv'

National Cyber-Forensics and Training Alliance(1) is that FBI-sponsored industry cybersecurity PR, lobbying, and info-sharing consortium that was going to replace CERT et al, make sure the Bureau's position on cybersecurity was advanced, and pass out a lot of white hats to all the "Walker, Cyber Ranger"s out there. Stangl (sic) apparently may have some role there. As others have pointed out, the data could have come directly from Apple.

So maybe the Fibbies are *technically* truthful here. It's called plausible deniability. That's why you have captive shadow orgs like NCFTA, ostensibly not taxpayer funded. Congress won't oblige your agency's agenda or funding? Just set up a non-profit org. They can do things you can't. Welcome to "continuity of government", though this process is now largely a quaint and unneccessary anachronism in a post PATRIOT, post DMCA, post NDAA, executive order, UN Treaty, Homeland Security world. That kind of deceptive charm may be it's only lingering utility, in fact. Sugar-coating and Cosmetics are big business, after all.

(1) http://yro.slashdot.org/index2.pl?fhfilter=NCFTA

Re:File name instructive

[Anonymous Coward]

Okay, the filename is interesting (http://www.ncfta.net/). So what characteristics mark the 12 million iOS devices in the list out of over 410 million activated devices? That is about 3% of activated devices.

Our devices are in the 1,000,001 list.

Re:File name instructive

[gl4ss]

well, what people who have their devices on the list should do would be to post their app history. that might give a clue.

Sean Sullivan

[jones_supa]

Also the F-Secure researcher Sean Sullivan was suspicious about the information really coming from FBI.

Piffle

[onyxruby]

This all a bunch of nonsense! This was probably just a list from a given vendor. Track this down by doing the following:

Look for the ID's and find the most recent date one that you can. That gives you the date range that this is relevant for.
Look at the ID's and match them to locations? Are they all from the US? That might give credence to FBI angle (which I think is bullocks).
Look at the ID's and start matching users.
Look for commonality between said users, this far too large of a list of users to simply be a list of OWS protestors (sorry, if OWS was ever that large on just apple users alone OWS would have succeeded instead of being a punch line). Your doing this just to exclude conspiracy theories like a national we spy on people with shiny toys conspiracy theory.

Once you've concluded that there isn't anything in common between most of these people you can't start the real work:
Start matching the common thing or applications between those users. You will probably discover something really benign like they they all have AT&T accounts that belong to the western part of the US or they all have the Twitter application or something really boring.

///sorry to ruin your conspiracy theories, have but have fun reverse engineering this

From the same organization that brought you F&

[scorp1us]

Now comes Crass and Curious, and effort to collect device UUIDs.

Does anyone believe any department under Eric Holder?

FBI hasn't denied it

[Anonymous Coward]

Except for one thing, the FBI spokesman didn't deny it. What he denied was "THERE WAS ANY EVIDENCE". I know it's a subtle distinction, but it's one he is completely aware of, he's a spokesman, he's paid to say things that sound like statements that are true but mislead.

Now many of you are assuming the opinion tweat on the coming statement is somehow a statement itself, it *isn't*. This was the tweat that said "BOTTOM LINE TOTALLY FALSE". A prestatement expressing an opinion on a coming official statement is just that. An opinion. If evidence comes out saying they did have it, then they'd simply say "well that wasn't the official statement"!

So, to be clear, the official statement DOES NOT SAY THEY DON'T HAVE THAT INFO OR SOUGHT TO COLLECT IT. It does not even say the laptop was not hacked. It says there is no current evidence of these things.

It is very likely they would have this data if they ever investigated a rogue app that collected it. The obvious way forward is to press the FBI for a proper denial and see what unravels. Likewise you could see what apps they have in common and see if the FBI have been investigating that app.

How about proving that it's an FBI laptop?

[Anonymous Coward]

It seems to me that what's at issue is Anti-Sec's assertion that it's an FBI laptop. Presumably, something about the laptop gave them reason to believe that it's last owner was operating under the auspices of the FBI. That conclusion would have to come from other contents of the laptop, or, possibly, GSA inventory control tags (though that doesn't prove that someone else hadn't got their hands on it before AnitSec).

Why not simply release whatever proof there is that it was an FBI laptop? If the FBI claims it wasn't theirs, then there should be no problems in publishing the contents of the hard disk...

Julian Assange. Bradley Manning.

[Anonymous Coward]

There's your reason.

Hey!

[casca69]

Didn't that guy used to work for Sadam Hussein?

"invisible black helicopters" - WHOT?

[Anonymous Coward]

If they are invisible how do you know they are black? YOUR WORKING FOR THEM AREN'T YOU!?!?

oh, really?

[Anonymous Coward]

I don't trust AntiSec but I'll be damn sure I trust them more than a public comment made by the FBI (why are they commenting at all if they aren't guilty)?

1st Question

[Anonymous Coward]

"When did the FBI stop gathering data on smartphone accounts, users and locations?"

Just try to answer that question without sounding guilty AND being truthful.

EXACTLY ! ! !

[sgt_doom]

http://www.whale.to/b/gelbspan_b.html
http://en.wikipedia.org/wiki/COINTELPRO
Present director, Robert Mueller III, was appointed to chief of DOJ's criminal division to interdict the BCCI investigation by then-president, George H.W. Bush, and later appointed to FBI director by George W. Bush, four days prior to 9/11/01. Director Mueller is the grandnewphew of Richard Bissell, while Mueller's wife is the granddaughter of Gen. Cabell --- two of the three top CIA types President Kennedy fired before he was assassinated. (The third, Allen Dulles, would be appointed to manage the Warren Commission to "investigate" the Kennedy assassination.)

Bet My Servers It's A Fake

[Revotron]

...after all, I'm not expecting much from an organization (AntiSec) whose only penetration method is hitting a webserver with old obsolete phpMyAdmin vulnerabilities. Found this in my webserver logs today:

62.76.44.162 - - [05/Sep/2012:12:45:38 -0500] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 162 "-" "ZmEu"
62.76.44.162 - - [05/Sep/2012:12:45:38 -0500] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 162 "-" "ZmEu"
62.76.44.162 - - [05/Sep/2012:12:45:38 -0500] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 162 "-" "ZmEu"
62.76.44.162 - - [05/Sep/2012:12:45:39 -0500] "GET /pma/scripts/setup.php HTTP/1.1" 404 162 "-" "ZmEu"
62.76.44.162 - - [05/Sep/2012:12:45:39 -0500] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 162 "-" "ZmEu"
62.76.44.162 - - [05/Sep/2012:12:45:39 -0500] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 162 "-" "ZmEu"

Well gosh golly gee willikers, thems sure are some mighty clever hackers right there!