Hackers have released roughly one million Apple unique device identifiers (UDIDs), the fingerprints that Apple, ad and apps networks use to identify the devices of individual users, according to Forbes. The data includes the 40-character identifiers from Apple, as well as some of the users' personal information such as zip codes and cell phone numbers.
Late on Monday, Sept. 3, the Antisec segment of the Anonymous hacker group announced that it has dumped 1,100,001 UDIDs for Apple devices. In a lengthy statement posted with links to the data dumped on Pastebin, the hackers said they had stolen the Apple data from a much more extensive database comprised of more than 12 million users' personal information, allegedly stored on an FBI computer.
The database not only included the UDIDs, but also "user names, names of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc.," said the hackers. The amount of data about each user was highly variable, claims Anonymous, adding that it only released enough to the public "to help a significant amount of users to look if their devices are listed there or not."
Forbes' Andy Greenberg, who covers data security, privacy and hacker culture, downloaded the encrypted file and decrypted it.
"It does seem to be an enormous list of 40-character strings made up of numbers and the letters A through F, just like Apple UDIDs," Greenberg reported. "Each string is accompanied by a longer collection of characters that Anonymous says is an Apple Push notification token and what appears to be a username and an indication as to whether the UDID is attached to an iPad, iPhone or iPod touch."
According to the hackers' message, they managed to access and steal the data by exploiting a Java vulnerability on an FBI laptop in March of this year.
The Antisec statement also mocked NSA Director and General Keith Alexander, who recently made a recruiting pitch to attendees at the Defcon hacker conference. "It was an amusing hypocritical attempt made by the system to flatter hackers into becoming tools for the state," reads the group's statement. "We decided we'd help out Internet security by auditing FBI first." Anonymous claims that it has stripped the dumped data of most identifying details, but has uploaded it to Pastebin in an effort to raise awareness of the FBI's alleged device-tracking practices.
"We never liked the concept of UDIDs since the beginning indeed," adds the statement. "Really bad decision from Apple. Fishy thingie." Earlier this year, Apple has stopped allowing iOS apps to track UDIDs.
If the FBI, however, has indeed collected 12 million Apple UDIDs, privacy advocates will not rest until all hell breaks loose.
"We will probably see their damage control teams going hard lobbying media with bullshits to discredit this," adds the statement. "But well, whatever, at least we tried and eventually, looking at the massive number of devices concerned, someone should care about it."
Anonymous refuses to answer any more questions from the press regarding the data dump, at least for now. Before granting any interviews, the group demands that Gawker's Adrian Chen, who has been particularly critical of Anonymous, post a "huge picture of him dressing in a ballet tutu and shoe on the head" on Gawker's home page.
© Copyright 2024 Mobile & Apps, All rights reserved. Do not reproduce without permission.