17 ms·
AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types
- pshof 14y ago508 email addresses (.com, .net, .org, .edu) used as iOS device names in this file, and several hundred phone numbers.
- muppetman 14y agoI can't believe with nearly 100 comments I appear to be the only one to call the whole story of how these were acquired into doubt. I'm not saying that the FBI story isn't true, but so many comments here just assume it to be 100% factual - there's no evidence that it was taken from the FBI vs found on a USB Stick in the garbage. It's a big story, yes, but I think maybe a deep breath is in order before we all accuse the FBI of leaking/losing/stealthily acquiring something! (I'm not a US Citizen, btw)
- irollboozers 14y agoYou're right, we should extend the courtesy of innocent until proven guilty. :) Though, it must be curious why AntiSec have had 12 million UDID's, but only now are releasing them. Also, no one else from AntiSec is corroborating it?
- zobzu 14y agoi think it's mainly because we'll never know, and it's not really the point that bothers most. What bothers most is that this data exists at all, and what it's used for.
- encoderer 14y agoI guess we better start tracking everything the FBI does. You know, so we can prove their innocence. Besides, what's the big deal... if they have nothing to hide then they have nothing to worry about!
- tripzilch 14y agoNitpick: While I agree with the idea (of accountability), the fact of the matter is that the FBI--being what they are and doing what they do--actually does have things to hide, often with good reason, even.
- naich 14y agohttp://news.ycombinator.com/item?id=4473755 http://news.ycombinator.com/item?id=4473755 says his device is on the list.
- deleted 14y ago[deleted]
- irollboozers 14y agoI like the card AntiSec is playing: well we have learnt it seems quite clear nobody pays attention if you just come and say 'hey, FBI is using your device details and info and who the fuck knows what the hell are they experimenting with that', well sorry, but nobody will care. Arms race for attention, while the government races towards quieter actions and laws...
- kfrwzwq 14y agoThe question of evidence is a very significant one. Namely, why has AntiSec not provided any to substantiate their claim that the data was sourced from the agent's laptop? Surely if they had access to it they could have provided some additional files as supporting evidence?
- mgz 14y agoJust made a page where you can check if your UDID is leaked: http://pastehtml.com/udid http://pastehtml.com/udid
- tzs 14y agoIs there some good reason for all those steps to actually get the file after downloading? I don't see the point of encrypting it, or of having a tarball with just one file. They also suggest checking the file integrity of the download, and then also checking the integrity of the final extracted file--this seems completely pointless as the final extracted file is derived deterministically from the download so you've already checked it when you checked the download checksum. Am I missing something?
- jedmeyers 14y agoTheoretically, it is possible to create another file, which after encryption will give you the same checksum. I doubt that someone will be able to do it in a reasonable amount of time though.
- gizzlon 14y agoEncrypting it, at least, makes sense: They can take their time distributing the file without anyone peeking at it before they're suppose to. Then, when they release the decryption key, the file is already copied all over the place and really hard to shut down. Guess all the verifying means they are afraid someone will distribute "altered" versions. Checking it twice is maybe a little drastic? Don't know how hard it is to generate a file that compresses to the same as their file (collision). But it's at least theoretically possible.
- pi18n 14y agoMD5 is not the best cryptographic hash... it's weird that they would be so paranoid as to include two hashes but not use something harder to collide with.
- MichaelGG 14y agoWhile I agree there's better options, MD5 has no known preimage attacks. So it's stretching it a bit to imply that someone could easily cause a collision on an existing archive.
- disclosure 14y agoUDID checklist: http://dazzlepod.com/apple/ http://dazzlepod.com/apple/ Partial UDID search accepted, i.e. search "d565" instead of your full UDID "d56504ca3b268177f76fef0c2c446ba183afd12b"
- FredericJ 14y agoIf you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) http://news.ycombinator.com/item?id=4473833 http://news.ycombinator.com/item?id=4473833
- happyhessian 14y agoThere's a pretty nice power law in the names, which would support a real random sample. http://tinypic.com/r/11gmwjl/6 http://tinypic.com/r/11gmwjl/6 That PDATX.net business is really weird, though.
- 89a 14y ago> 'Yip\'s iphone(in the memory of steve jobs)'
- sideshownz 14y agoWe've recently discovered that even though the Apple docs suggest the APNS tokens may be unique to each app and may change over time they are NOT unique to an app and they also do not change (at least not over the last 18 months). So if you have two apps on the same device they both share the same UDID and the same APNS token. Whilst on the surface this may seem like a huge security issue it is not as bad as it seems, because in order to send push notifications to a device you must have the correct APNS .p12 certificate generated by Apple for the app AND the app must be installed on that device. I would see the UDID's as more of a security breach given the fact that many developers are still using the now depreciated udid to interface with web services. On a similar note, If you are developing an app and need to have a unique identifier you should be using Secure UDID or something similar https://github.com/crashlytics/secureudid https://github.com/crashlytics/secureudid and if you're sending data to you're own webservice, don't just use SSL, use encryption such SHA to prevent mitm sniffing of your data - Both iOS and Android both allow installation of root CA certs which is amazing for developing and sniffing API's but dangerous if your writing webservices and ONLY relying on SSL and no other encryption.
- davidp 14y ago> you should be using Secure UDID or something similar As an app developer, does this give me some benefit over just generating and saving a random UUID on first launch?
- drharris 14y agoIf you save the random number, what happens when they wipe the device and reinstall your app? No way to get that original number back. Secure UDID is deterministic, so you'd get the same ID, and can resume the original session.
- danudey 14y agoOne way around this is to store that number in iCloud. Then you can always get it back no matter the device.
- mlvljr 14y ago"Support to Pussy Riot" == keep doing public sex? Schmucks :)
- ommunist 14y agoI think this leak plays for FBI in PR sense, not against it. All support slogans in the _anonymous message are exact description of the US foreign policy, so this message support distribution of wreck and havoc of people's lives in the third and second world. All this is rather strange.
- Fice 14y agoWhy all the buzz? I thought that the people who buy Apple products or use centralized social networks knowingly sacrifice their privacy and already expect things like this to happen.
- technoslut 14y agoDo we really need to go into tired cliches of what kind of people own which device? We don't even know how this information was acquired.
- abdelmaalik 14y agothe only thing to quench the appetite for additional wealth is the dirt of the grave
- throwawaypopo 14y agoHi, first time here. I'm from Malaysia with a Jailbroken Ipad 2 as well. To my surprise, my device shows up on the http://pastehtml.com/udid http://pastehtml.com/udid link. So now what does this all means? (and) I've never been to US.
- mkhalil 14y agoThey're coming for you. Run!!
- error54 14y agoDL links for the lazy: http://freakshare.com/files/6gw0653b/Rxdzz.txt.html http://freakshare.com/files/6gw0653b/Rxdzz.txt.html http://u32.extabit.com/go/28du69vxbo4ix/?upld=1 http://u32.extabit.com/go/28du69vxbo4ix/?upld=1 http://d01.megashares.com/dl/22GofmH/Rxdzz.txt http://d01.megashares.com/dl/22GofmH/Rxdzz.txt http://minus.com/l3Q9eDctVSXW3 http://minus.com/l3Q9eDctVSXW3 https://minus.com/mFEx56uOa https://minus.com/mFEx56uOa http://uploadany.com/?d=50452CCA1 http://uploadany.com/?d=50452CCA1 http://www.ziddu.com/download/20266246/Rxdzz.txt.html http://www.ziddu.com/download/20266246/Rxdzz.txt.html http://www.sendmyway.com/2bmtivv6vhub/Rxdzz.txt.html http://www.sendmyway.com/2bmtivv6vhub/Rxdzz.txt.html
- error54 14y agoAlso, what's the point of releasing password protected files to public? I mean, they give you the password thus kind of making the whole password thing a moot point.
- tlb 14y agoIt proves that the author of the rant is the leaker of the data, not just some guy linking to data someone else posted. It also causes all the data to be released atomically even if it took a while to upload to all the places.
- error54 14y agoAh that makes sense. Thanks tlb.
- mintplant 14y ago> It proves that the author of the rant is the leaker of the data, not just some guy linking to data someone else posted. I don't see what would stop you from stating the password to a file you didn't upload.
- akennberg 14y agoThat's why for these types of archives the password actually contains the credentials.
- saulrh 14y agoMoney quote for the people that don't want to wade through ten pages of rant: During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc.
- taybenlor 14y agoIs there any evidence that this data comes from the source they claim? And is there some way to validate these are real UDIDs?
- mehrshad 14y agoSure - me. Both my iOS devices are on this list - confirmed both by name and UDID match. However, I renamed my iPad around last November after I started using it more in public, yet its original name (easy to find if you search for my HN nick) is the name listed. EDIT: Oh, and fwiw, law-abiding natural born US citizen here. But who am I kidding - LEAs don't give a toss about that.
- eli 14y ago...assuming this has any connection to LEA
- lylejohnson 14y agoHow does that prove that an FBI laptop was the source of this information (per the grandparent post's question)?
- AimHere 14y ago
- deleted 14y ago[deleted]
- ripperdoc 14y agoWow, this is bad, and an excellent example of how the security machine (in this case FBI) can always be turned on itself. The methods required for FBI to "protect" citizens can be misused (or hacked) to do the opposite. A gun can always be turned around, etc.
- DigitalSea 14y agoThis is troubling on so many levels. Why did an FBI agent have a document of user and device info on his desktop and the real question is why are the FBI tracking this information in the first place? Surely this is illegal. By the way, I think AntiSec needs to hire someone to write their releases for them. I struggled at times to make sense of the almost gibberish in their rant-filled sentences and at times some of the things they were saying read like the paranoid ramblings of a crystal meth addict. It wasn't until the end where everything they were saying was put into perspective and I understood what they were talking about.
- Tichy 14y agoI thought it was quite well written, also noticed the "Life as a Service" part. Maybe it only works on me because I thought about those things before, but it wouldn't be an effective propaganda piece.
- andrewfelix 14y agoI was confused by the writing style as well. It seems to be almost intentional. I wonder if it's a way of avoiding any style or nuances that could be attributed to a single person. Almost like a cut and paste ransom note.
- JonnieCache 14y agoI wouldn't be surprised in the slightest. A lot of work has been done on adversarial stylometry recently, for precisely this reason. ccc presentation: http://www.youtube.com/watch?v=-b0Ta9h62_E http://www.youtube.com/watch?v=-b0Ta9h62_E EDIT: also as grumpysimon says, it's a proud tradition going back decades.
- GrumpySimon 14y agoIt's elite (or 1337 if you will). It's supposed to sound cool. All the underground computer groups have talked like that since the early warez/cracking/phreaking scene.
- 14y ago
- deleted 14y ago[deleted]
- antimatter15 14y agoOne interesting thing I've found is that apparently 190 of those 1000001 people have named their devices "The Titanic", for that iTunes "The Titanic is syncing" pun. I'm curious if there's anything else interesting that might be found in this data.
- firebones 14y agoI seem to see a disproportionate number of pro photographer accounts (grep for dot coms as device names) which might point to some commonality--some photo app? A quick search showed more female email addresses, but not sure if this is related to the source or if it is related to the likelihood of women using their email addresses as device names.
- mathias 14y agoActually, it’s more like 166: $ grep -c -i "titanic\'" iphonelist.txt 166 It’s only 190 if you include names like “Titanic’s iPad”, but those aren’t funny.
- danudey 14y agoThere are a few phones named 'Venice', presumably for the 'Venice is syncing' pun. My iPhone is named Venice for a different reason, but it's not in the list.
- graiz 14y agoThe fact that there is a column for APNS (Apple Push Notifications) suggests that this is a database dump from an iPhone app that supports push notifications. APNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database. The "NCFTA" seems to deal with identity theft. (Ironic)
- oasisbob 14y agoAPNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database This isn't true, APNS device tokens are shared among apps on a device. The only time a device will have more than one device token is if it's being used for development. This isn't to say that Apple couldn't correlate the device tokens by looking for shared apps with active APNS entitlements.
- biafra 14y agoI don't think so. The device token is even generated over the version of the app. Meaning: you get a new device token if the app version changes.
- saurik 14y agoNo: the APNS token is only changed if you get a new device (as it is tied to your device's certificate) or restore your phone (and not restore a backup: if you restore a backup it restores the token). http://stackoverflow.com/questions/2338267/is-the-apn-device-token-unique-to-each-individual-app http://stackoverflow.com/questions/2338267/is-the-apn-device...
- akldfgj 14y agoPutting a file of user data on a laptop is a fireable offense at at any reputable organization. Sad that the FBI is less careful about user data protection than consumer Internet companies.
- epo 14y agoThe laptop was compromised while running. We do not know whether the disc was encrypted or not.
- jbigelow76 14y agoPutting a file of user data on a laptop is a fireable offense at at any reputable organization. Correction, it's only a fireable offense if the employee of said reputable organization let's the file become compromised somehow, there's huge PR blow back, and the organization needs somebody's head on a platter in show of how serious they take the issue. Otherwise, m'eh.
- Hominem 14y agoKinda odd isn't it. My organization issued me a laptop to store all the confidental financial data I work with.
- Ntrails 14y agoOne imagines it was bitlockered, and you were required to inform them the instant of a loss and hence possible data breach - where upon the company would have to pass the data on to any clients whose data might have been compromised (and the public body governing data security)
- dantiberian 14y agoWhat does ofc stand for?
- suriyawong 14y agoOfc = of course
- andrewfelix 14y agoAs an Australian I am intrigued by the following: just a comment: we are still waiting for published news about the $ 2 billions worth loans Assad has taken from Russia, mentioned on the syrian mails and also about the transfer of money to austrian banks etc.... and also cocks... So, don't be lazy journos and look for them. Any one have any additional info on that? EDIT: Derp...thanks for the correction. I read too fast. Still intrigued if anyone knows anything more.
- rfugger 14y agoAustrian banks.
- epaga 14y ago"Austrian, eh? <puts on australian accent> Let's put some shrimp on the barbie!"
- sjwright 14y agoPaul Hogan hammed up his Australian accent. One of the best examples of a real Australian accent I've heard on American television is Dr. Chase [Jesse Spencer] from House, who is a real Australian and did not ham it up for an American audience. (Oddly though, the man who played his father in one episode had possibly the most embarrassingly bad fake Australian accent ever. Surprised Spencer didn't kick his arse during filming.)
- epo 14y agoYou do not get real foreign accents on prime time American television, the viewers would be bemused and look for subtitles. You get what Americans think are foreign accents, i.e. lightly accented. The one exception is that Brits playing bad guys are allowed to use camp, pantomime villain accents. Alan Rickman has made his fame and fortune from this, a shame as he is rather a good actor. Hugh Grant sounds nothing like he does/did before that series started.
- jacklandenw 14y agoHaxxors, what can we lay people with no computationalizing skills do?
- muyuu 14y agoRefuse to give personal information and carry minimal personal information in devices and websites outside of one's control. If they don't have it, it cannot leak.
- sam_watson 14y agoGet informed, and inform. Then, one can hope, the government might actually be forced to engage in meaningful discussion about whether their ridiculously expensive and obviously damaging espionage programs make sense.
- gyardley 14y agoIt's far more likely that this data was willingly shared by an application developer who was the victim of a crime the FBI is investigating. Not everything is a government conspiracy.
- jacklandenw 14y ago"Get informed, and inform." Straight up manifesto material. Gratzi! "...engage in meaningful discussion.." It's hard to engage in meaningful dialogue with people who are so entrenched in their own views (BIG$$,BIGOIL,BIGGOVV-types) but we shall continue!
- pwniekins 14y agoGet pissed off.
- Monotoko 14y agoOne question... where are these people usually, where do they talk? IRC? Random server in the outback? Encrypted channels?
- rkaplan 14y agoQuestion: is it possible for a malicious hacker to use this information for anything? E.g. sending rogue push notifications to a user, or tracking down a user's additional personal information by knowing his/her device UDID or APNs token? I sincerely hope both the U.S. government and Apple address this. I'd also be interested in hearing why Apple chose to have hardware coded unique ids for each device.
- uxp 14y agoIf a webservice tries to send a push notification to a device that has not registered for push notifications for the entitlement requesting the notification to be sent, the notification gets discarded. Remember, all notifications are to be pushed to Apple using a certificate generated on a per-app basis, who in turn pushes the message to devices.
- notlisted 14y agoI'm still somewhat unclear on the dangers involved with this leak (other than the likelihood of being tracked), but this link seems relevant: http://www.cultofmac.com/160248/what-the-hell-is-a-udid-and-why-is-apple-worried-about-them-feature/ http://www.cultofmac.com/160248/what-the-hell-is-a-udid-and-...
- notlisted 14y agoHmmm, it seems that despite removal of the personal info, there may be ways to link it back to partial profiles via OpenFeint... http://corte.si/posts/security/openfeint-udid-deanonymization/index.html http://corte.si/posts/security/openfeint-udid-deanonymizatio... also: http://corte.si/posts/security/udid-must-die/index.html http://corte.si/posts/security/udid-must-die/index.html
- arn 14y agoYep... well, based on this, I was able to fill in a UDID from the file and pull back an openfeint result. It didn't pull any sensitive information, but it worked. so seems to be real udids.
- gyardley 14y agoRefresh my memory - aren't the device tokens for the Apple Push Notification Service application-specific? That suggests this data comes from a single application, not Apple. The patchy personal information columns also suggests that this is a single (somewhat grabby) application's data store - presumably Apple would have more comprehensive records. My wild speculation, assuming what we're told is true - the application developer shared this information with the NCFTA, who in turn shared it with the FBI. (After all, that's what the NCFTA does.) The application developer may have shared this information because they wanted the FBI to investigate a 'cybercrime' of some sort against them - who knows what, in-app purchase fraud? That could explain why the data ended up on this FBI agent's desktop. EDIT: I refreshed my own memory - APNS tokens are device-specific, not device+app specific. I still think this is a single application's data dump, if the statement about sparse personal info is true.
- rogerchucker 14y agoI doubt that they are a single app's data. Look at the repeat of certain Device names (try "Abo Mossa") and check their UDIDs - those UDIDs show an incremental pattern in their first 3 digits. This tells me: (a) those devices were bought in bulk and (b) those devices were never sold to one person - since the Device names were unchanged [assumption is that a regular customer cannot own so many devices]. I just don't see how one app (not pre-installed) could be on all the devices bought in bulk by one person and dump all its data to FBI.
- saurik 14y agoThe UDID is a SHA1 of a few fields (including a couple MAC addresses): we actually know the exact algorithm; if you are seeing patterns in them it is either a trick your brain is playing on you or a trick the user is playing on you (some people modify their UDID occasionally to keep themselves from being tracked by apps).
- chimeracoder 14y agoHow do you modify the UDID? Does it depend on the model?
- mdonahoe 14y agoHas anyone here found their own UDID in the list?
- program 14y agoI've tried all the UDIDs of the Provisioning Portal of my Company and I didn't find any.
- devilcius 14y agohttp://news.ycombinator.com/item?id=4473402 http://news.ycombinator.com/item?id=4473402
- fusiongyro 14y agoI checked and didn't find my own iPhone, iPad or my wife's iPhone in the list.
- deleted 14y ago[deleted]
- arasmussen 14y agoApple could probably figure out if this data came from an app developer because I'd bet there's only exactly one app which every single one of those 1,000,001 devices downloaded. Even if they threw in a few fake rows to mess up the data, they could find the app that has the highest percentage of downloads from that entire data set.
- jonaldomo 14y agoAnother more likely possibility would be to identify people who are on the list and compare all their installed apps and search for a common denominator.
- reddnotebook 14y agoPeople delete apps though, you'd need their entire history to cross reference that. Not to mention false positives - how many people have the Twitter or Facebook app installed, for example?
- jre 14y agoYou might still be able to find an app that has a much higher installation rate for users on the leaked list that for users who aren't. Of course, that wouldn't be a proof but merely a first step to narrow the possibilities.
- buro9 14y agoAnd if the data came from Apple? I can't think of any apps that take a full address. Perhaps there are some, I just don't know them. Apple could have been compelled to release this data to the FBI. Unfortunately, we're unlikely to ever know this and Apple are equally unlikely to want to shed light on it. If the claim is true, that the source data included full postal address, then I find it hard to identify a better source for all of that than Apple themselves. And that the data was brought together from various systems, and that we're glimpsing data that was shared between Apple and the FBI. Not to say that there's anything illegal about that, more that the laws that allow that are a bit screwed but that's another issue altogether.
- papaver 14y agointerestingly enough, top ten ios devices names: 42797 'iPhone' 5191 'iPod touch' 3136 '“Administrator”的 iPad' 2202 '“Administrator”的 iPhone' 1534 'Owner’s iPad' 1453 ' iPhone' 1309 'Administrator’s iPad' 1196 'Administrator’s iPhone' 1141 'PdaTX.Net' 1058 'John’s iPad'
- rogerchucker 14y agoIf you look at the UDID's for the '“Administrator”的 iPad's or '“Administrator”的 iPhone's, there seems to be an incremental pattern in their first 2-3 digits. Does that mean these devices were purchased/ordered in bulk and hence belong to some reseller? In which case, these must not have been sold to people and thus we don't see change in the Device names maybe? And thus the claim that this came from one or two apps seems a bit infeasible, no?
- dvdhsu 14y agoThe Chinese character "的" is being used here as a possessive; it just means that the iPad belongs to the "Administrator", which is the default account name for many Windows XP computers [1]. Because iTunes activates iPods, iPhones, and iPads under the current user account name, and because the default user account names in many XP installations is "Administrator", there are a plethora of devices with the same name: '“Administrator”的 iPad'. So, the only significance of this name is that there are quite a few Chinese Apple devices in this sample. Perhaps they are over-represented in the whole dataset; it's hard to say without having the breakdown of Apple devices sold by country, as well as the entire dataset. 1. http://www.mydigitallife.info/unhide-the-administrator-account-in-windows-xp/ http://www.mydigitallife.info/unhide-the-administrator-accou...
- saurik 14y agoThe UDID is a SHA1 of a few fields (including a couple MAC addresses): we actually know the exact algorithm; if you are seeing patterns in them it is either a trick your brain is playing on you or a trick the user is playing on you (some people modify their UDID occasionally to keep themselves from being tracked by apps).
- 14y ago
- schappim 14y agoLooks like they've got Obama's iPad: thea:Downloads admin$ cat ./iphonelist.txt | grep -i obama '473d6e1ebf0b100ed172ce5f69c97ba6c8f12ad5','766a23201c6089be11845bfef624dbaada68be52155079850951836e9373e5cd','hobamain','iPad' 'c63e008e6271c3ac128eb6a242a9817528b6baef','b996a080e11265a0c93436ba0b13b7c07ee4e8eef6faeb8516917b015d7355fb','Obama','iPad'
- panarky 14y agoOpenfeint shows that 'Obama' last played 'Fishing Fun 2' curl 'https://api.openfeint.com/users/for_device.xml?udid=c63e008e6271c3ac128eb6a242a9817528b6baef <?xml version="1.0" encoding="UTF-8"?> <resources> <user> <chat_enabled>true</chat_enabled> <gamer_score>160</gamer_score> <id>1479631313</id> <last_played_game_id>165632</last_played_game_id> <last_played_game_name>Fishing Fun 2</last_played_game_name> <online>false</online> <profile_picture_source nil="true"></profile_picture_source> <profile_picture_updated_at nil="true"></profile_picture_updated_at> <profile_picture_url nil="true"></profile_picture_url> <status nil="true"></status> <uploaded_profile_picture_content_type nil="true"></uploaded_profile_picture_content_type> <uploaded_profile_picture_file_name nil="true"></uploaded_profile_picture_file_name> <uploaded_profile_picture_file_size nil="true"></uploaded_profile_picture_file_size> <uploaded_profile_picture_updated_at nil="true"></uploaded_profile_picture_updated_at> <name>Player 1479631313</name> </user> </resources>
- bestes 14y agoSeriously? Personal info about the President was leaked? Not that this particular instance looks like a big deal. Doesn't the NSA secure the President's communication? That must be carrer-impacting-embarrassing for someone.
- kennywinker 14y agoPersonal information about someone who had their device name set to "Obama". Let's not get all crazy now.
- cortesi 14y agoThis is huge. I've been fearing this kind of leak for a long time. If you're unsure why this is huge, here are some posts of mine on this issue showing de-anonymization, complete takeover of social media accounts, and more: De-anonymizing UDIDs with OpenFeint: http://corte.si/posts/security/openfeint-udid-deanonymization/index.html http://corte.si/posts/security/openfeint-udid-deanonymizatio... A survey of how UDIDs are used: http://corte.si/posts/security/apple-udid-survey/index.html http://corte.si/posts/security/apple-udid-survey/index.html Why the Apple UDID had to die: http://corte.si/posts/security/udid-must-die/index.html http://corte.si/posts/security/udid-must-die/index.html I've often been asked what I thought the worst-case scenario is regarding the mis-management of UDIDs. My answer has always been that a large UDID database leaking would be a privacy catastrophe...
- novaleaf 14y agoso, any of you iOS guys find your device? it'd be interesting to know what apps you have in common (if any)
- deleted 14y ago[deleted]
- rogerchucker 14y agoIf you look at line #'s 3741 through 3845, you will see they all (105) belong to one Abo Mossa. Is Abo Mossa some kind of an iPhone/iPad reseller or is there something else going on?
- saurik 14y agoHe probably is using a tool that spoofs his UDID... a lot. ;P
- ajays 14y agoWhat's an easy way to figure out the UDID of a device (without hooking it up to a Mac to sync)?
- pgrote 14y agovideo of the special agent. https://www.facebook.com/video/video.php?v=512364171294 https://www.facebook.com/video/video.php?v=512364171294
- Monotoko 14y agoI have found my own UDID - I can confirm these are real UDID's - and now I want to know why an FBI agent had my (a brit) UDID on their laptop.
- ErikD 14y agoWhat apps do you have installed? This is interesting to know since the data might be from a popular app instead of Apple.
- Monotoko 14y agoWhatsapp, ebuddy pro, ebuddy XMS, Angry Birds, Angry Birds Space, FML, XKCD, Facebook, Spotify, BBC News, Dropbox, Steam and PokerStars are the more popular ones official I have installed. I also have Cydia, a few tweaks and finally Installous (didn't want to admit that - I don't use it often - but thought it may spread some light here)
- saurik 14y agoI run Cydia, and have determined only 16.7% of the UDIDs in that file are from jailbroken devices: I thereby do not believe that whatever managed to get this data is anywhere in our ecosystem.
- fla 14y agoDoesn't 16% sounds above the average ? Could it be related to app warez on jailbroken devices, somehow ?
- Monotoko 14y agoI have Installous, so that could make this possible. However you need to jailbreak (which often involves Cydia) in order to even get access to Installous, so how about the other 84%? (PS: I only use Installous if I need to trial an expensive app - I will buy the app if it does what I need :))
- robomartin 14y agoI doubt very much that Apple had anything to do with this. That's not the kind of company they are.
- squamos 14y agoApple has everything to do with this. They're the ones who decided to put UDIDs on all their devices to begin with. And they know they've royally screwed up too - that's why they've deprecated UDIDs in iOS 5 and have started rejecting applications that access it. But that hardly fixes the problem since everyone will just use the Bluetooth or wireless MAC addresses instead - its not guaranteed to be unique, but close enough
- eduo 14y agoSo, essentially, you're saying whatever Apple does or doesn't do is a bad decision in the end since it would always fall back to the hardware identifiers, then. Right?
- squamos 14y agoNot quite. Part of the point was that "hardware coded IDs for devices concept should be erradicated from any device on the market in the future." I'd place MAC addresses in that bucket as well. A company like Apple that's been changing the status quo for years should be striving to do the same when it comes to their user's privacy and anonymity
- deleted 14y ago[deleted]
- konstruktor 14y agoIf the full file (including addresses) gets into the wild, and I fear that this may happen, it will be a really useful tool for burglars. Many iOS devices probably correlate with many valuables in a home. That's a lot of lawsuits against everybody involved...
- crisnoble 14y agoPretty sure that a smart burglar could figure out approximate addresses of people who own iPhones by looking at publicly available Instagram or Twitter or Facebook or Flickr locations. Not to mention people telling the world "I'm camping this weekend" which a burglar hears as "I'll be gone all weekend, steal my things!"
- wpietri 14y agoI think a smart burglar would just look at any commonly available database of home sales. Anybody who has moved in the last few years into a more-expensive-than-average house should correlate much better with valuables than iPhones. However, I'd hope any criminal with brains like that would find something to do that has higher yield and lower risk than housebreaking. I'd suggest working for a private equity company.
- crisnoble 14y agoYeah i'm not really worried that burglars are going to use this data-set for harm. If they know about this data-set they likely know about databases of home sales or car sales or just plain old census data listing the average income by county.
- salimmadjd 14y agoFACEBOOK? If I had to bet on any company I would bet on Facebook as the main/top source of this data. Where else can you easily be profiled so easily by liking or sharing content the Big Bro would deem as subversive. Followed by phone carriers since they have already been working with Big Bro, then apple and google. Combine these and you should be able to know everything you want. Govs probably won't deal with smaller companies lest increasing chances of leakage, etc.
- brown9-2 14y agoI think there is another part of this alleged story that is equally as disturbing as the FBI having this data in the first place: that an FBI agent's laptop, let alone an agent in the "Cyber Action Team", was susceptible to a common Java vulnerability.
- redtxai 14y agook, FBI have all information about us, and now? what we gonna do?? come on guys...
- EYEARR 14y agoIf you want the list you can download it here, http://fileurl.me/41ld1 http://fileurl.me/41ld1
- ralfd 14y agoI HATE YOU!!!! "Please complete this survey to continue"
- ralfd 14y agoWhat do I do wrong? $ tar -xvzf decryptedfile.tar.gz tar: Unrecognized archive format tar: Error exit delayed from previous errors.
- sidcool 14y agoCan someone tell me what the AntiSec can do with these UDIDs? I mean they are just phone identifiers, what harm can their exposure cause?
- r00fus 14y agoMarco Arment thinks that the All Clear ID app is responsible for this leak: http://www.marco.org/2012/09/04/fbi-udid-leak http://www.marco.org/2012/09/04/fbi-udid-leak Can anyone who can confirm they're on the list confirm that was one of their apps?
- circa 14y agoDidn't see this posted. Check to see if your UDID was on the list. Obviously it only checks the one million that were released. - http://thenextweb.com/apple/2012/09/04/heres-check-apple-device-udid-compromised-antisec-leak/ http://thenextweb.com/apple/2012/09/04/heres-check-apple-dev...
- naughtysriram 14y agoAntisec leaks the stuff that was previously leaked to NCFTA (probably by Apple or did they hack into Apple?) The title gives different views. #justsaying
- afitnerd 14y agoFind out if your udid has been compromised http://udid.afitnerd.com/ http://udid.afitnerd.com/
- wallyfink 14y agoTerrifying!
- chmike 14y agoThis demonstrate once again the antagonism of beeing able to ensure security as was complained to be lacking for the 9/11 and that no honnest citizen gets trampled by it. I can't see a way out of spying it's own cytizen and keep them in the beleif they aren't to achive the goal. One of the question to be asked is who is controlling the controllers ?
- jfriedly 14y agoThey wrote in the release that they wouldn't give any more interviews until they saw "Adrian Chen get featured on the front page of Gawker, a whole day, with a huge picture of him dressing a ballet tutu and shoe on the head, no photoshop." Chen, a journalist at Gawker, actually did it: http://gawker.com/ http://gawker.com/ Not even bothering to submit this as a story to HN because I'm pretty sure Gawker links get auto-killed (with good reason, the Gawker article is crap).
- DanielKlein 14y agoO proprio Governo dos EUA nos Da essa BRexa eu sou Brasileiro e ja comsegui diverssas vezes invadir o site da aplle e Microsoft ee agora ireii tentar o do FBI em um COmputador Externo :D me Desejem Sorte