Here at Books & Review, our information on hackers and hacking has mostly been gleaned from just a few sources: 1) "Hackers" - obviously; 2) "War games," starring a pubescent Matthew Broderick; 3) Tie - "Masterminds" starring a young Pete Campbell / "Lawnmower Man." Yes, we are really up on things. Thank you for noticing.
The joke might be on us now, though. Hacking group AntiSec has published what it claims is about 1 million Unique Device Identifier Numbers -- or UDIDs for the uninitiated -- for Apple devices that it said it accessed earlier this year from a computer belonging to an FBI agent.
A splinter operation of the Anonymous hacking collective, the group claims that it has collected more than 12 million UDIDs and personal data linking the devices to users from the FBI computer. AntiSec said it chose to publish only a portion of those records to prove it has them. How charitable.
In a note left on the website on Pastebin, a member of AntiSec said the group had culled some personal data such as full names and cell numbers from the published data. The group said it published enough information such as device type, device ID, and Apple Push Notification Service tokens to let users determine whether their devices are on the list.
Apple device owners who would like to check the list to see if they're affected click here.
No one seems to have verified AntiSec's claims about its data just yet. Nor is it clear why the unique device ID data and other personal information belonging to millions of Apple users would be on an FBI agent's computer in the first place. So, if you're technically inclined, have at it and get back to us.
A senior technology consultant at Sophos, Graham Cluley, said there is no way of knowing yet whether the hackers are bluffing or not. "We don't have any way of confirming the source of the data, or what else might have been taken, but it does appear that the files do contain at least some genuine Apple UDIDs," said Cluey via e-mail.
"Is it a big deal? Well, if the data was stolen from an FBI computer then questions will be asked as to what the FBI [was] doing with the data in the first place, as well as why it wasn't better protected," he said. "At the moment it feels as if the hackers might be more interested in embarrassing the FBI and causing mischief than putting innocent users at risk."
Apple's UDIDs are a set of alphanumeric characters used to uniquely identify an iPhone or iPad. The numbers are designed to let application developers track how many users have downloaded their application and to gather other information for data analytics. In 2010, The Wall Street Journal did an investigative report showing how application developers were using Apple's UDID to gather a lot of personal information about the device owner, including name, age, gender, device location and phone numbers. In response to concerns about the tracking, Apple no longer permits new iOS applications to track UDIDs.
AntiSec, in its message on Pastebin, said it had obtained the numbers from a Dell Vostro laptop allegedly belonging to an FBI special agent named Christopher Stangl from the FBI Regional Cyber Action Team in New York.
The computer was breached using the "AtomicReferenceArray vulnerability on Java," the post claimed. "During the shell session, some files were downloaded from his Desktop folder. One of them with the name of "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zip codes, cell phone numbers, addresses, etc.
"The personal details fields referring to people appears many times empty leaving the whole list incompleted [sic] on many parts," the post said. "No other file on the same folder makes mention about this list or its purpose."
According to AntiSec, the real reason the hacking group decided to publish the data was to expose the FBI's practice of tracking of device information belonging to Apple users.
"Well we have learnt [sic] it seems quite clear nobody pays attention if you just come and say 'hey, FBI is using your device details and info and who the f... knows what the hell are they experimenting with that,' well sorry, but nobody will care. FBI will, as usual, deny or ignore this uncomfortable thingie and everybody will forget the whole thing at amazing speed."
AntiSec further criticized Apple's use of UDID. "We always thought it was a really bad idea. That hardware coded IDs for devices concept should be erradicated [sic] from any device on the market in the future."
No word yet to confirm if AntiSec has officially declared war on grammar and spelling.