ID: IRCNE2012091606
Date: 2012-09-05
According to “Computerworld”, hacker group AntiSec has published what it claims is about 1 million unique device identifier numbers (UDIDs) for Apple devices that it said it accessed earlier this year from a computer belonging to an FBI agent.
The group claims that it has culled more than 12 million UDIDs and personal data linking the devices to users from the FBI computer. AntiSec said it chose to publish a portion of those records to prove it has them.
In an unusually lengthy note on Pastebin, a member of AntiSec said the group had culled some personal data such as full names and cell numbers from the published data. Instead, the group said it published enough information such as device type, device ID and Apple Push Notification Service tokens to let users determine whether their devices are on the list.
It was not immediately possible to verify the authenticity of AntiSec's claims about the data. Nor was it clear why the unique device ID data and other personal information belonging to millions of Apple users would be on an FBI agent's computer in the first place.
FBI spokeswoman Jennifer Shearer said the agency has no official comment on the claim.
Graham Cluley, a senior technology consultant at Sophos, said there is no way of knowing yet whether the hackers are telling the truth. "We don't have any way of confirming the source of the data, or what else might have been taken, but it does appear that the files do contain at least some genuine Apple UDIDs." Cluley said via email.
"Is it a big deal? Well, if the data was stolen from an FBI computer then questions will be asked as to what the FBI [was] doing with the data in the first place, as well as why it wasn't better protected," he said. "At the moment it feels as if the hackers might be more interested in embarrassing the FBI and causing mischief than putting innocent users at risk."
Apple's UDIDs are a set of alphanumeric characters used to uniquely identify an iPhone or iPad. The numbers are designed to let application developers track how many users have downloaded their application and to gather other information for data analytics. In 2010, The Wall Street Journal did an investigative report showing how application developers were using Apple's UDID to gather a lot of personal information about the device owner, including name, age, gender, device location and phone numbers. In response to concerns about the tracking, Apple no longer permits new iOS applications to track UDIDs.
In its message on Pastebin, AntiSec said it had obtained the numbers from the a Dell Vostro laptop allegedly belonging to an FBI special agent named Christopher Stangl from the FBI Regional Cyber Action Team in New York.
The computer was breached using the "AtomicReferenceArray vulnerability on Java," the post claimed.
According to AntiSec, the reason it decided to publish the data was to expose the FBI's tracking of device information belonging to Apple users.
- 2