MuscleNerd's alert
If you have an iOS device, your UDID may have been leaked to the public today. A group of hackers commonly known as Antisec have exploited a file on the computer of an FBI agent to leak over one million out of 12 million unique device identifiers (UDID) that were present in the file that was on the computer.
--- there you have. 1,000,001 Apple Devices UDIDs linking to their users and their APNS tokens. the original file contained around 12,000,000 devices. we decided a million would be enough to release. we trimmed out other personal data as, full names, cell numbers, addresses, zipcodes, etc. not all devices have the same amount of personal data linked. some devices contained lot of info. others no more than zipcodes or almost anything. we left those main columns we consider enough to help a significant amount of users to look if their devices are listed there or not. the DevTokens are included for those mobile hackers who could figure out some use from the dataset.
What is UDID:
UDIDs are different for every single iOS device and developers have used them in the past to gain anonymous information about devices for their applications. UDIDs can be used to gain information about your device such as the device type, device name, and much more personal information.
In a detailed but rambling announcement on Pastebin first posted on YCombinator, AntiSec described how they got the UDIDs:
---
During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts. no other file on the same folder makes mention about this list or its purpose.
The UDIDs have been published along with minimal user data to make people aware that the FBI may be tracking citizens using that information.
The leak is a disturbing move for many that has caused a great deal of unease for Apple device users, which are worried about their personal security and identity. If you’re one of the worried iOS device users, TheNextWeb has created a Web-based program that can check your UDID against those leaked to see if you were one of the many that were exploited from this file on the FBI agent’s computer. TheNextWeb claims that the program will not record your UDID, only compare it with the database. Additionally, you can enter just a fraction of your UDID if you’re worried about security.
There is now a version of the UDID list in plaintext available online.
The FBI has now issued a public statement:
"The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time, there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data," the FBI said.
Good luck everybody!
Read more via modmyi via arstechnica
0 comments