Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

pastebin.com

Post reply on HN
Print view View original

81–90 of 279 posts

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#81

Post by rogerchucker »

gyardley wrote: post #42

Refresh my memory - aren't the device tokens for the Apple Push Notification Service application-specific? That suggests this data comes from a single application, not Apple. The patchy personal information columns also suggests that this is a single (somewhat grabby) application's data store - presumably Apple would have more comprehensive records. My wild speculation, assuming what we're told is true - the applicat…

I doubt that they are a single app's data. Look at the repeat of certain Device names (try "Abo Mossa") and check their UDIDs - those UDIDs show an incremental pattern in their first 3 digits. This tells me: (a) those devices were bought in bulk and (b) those devices were never sold to one person - since the Device names were unchanged [assumption is that a regular customer cannot own so many devices]. I just don't see how one app (not pre-installed) could be on all the devices bought in bulk by one person and dump all its data to FBI.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#83

Post by crowding »

error54 wrote: post #3
error54 wrote: post #2

DL links for the lazy: http://freakshare.com/files/6gw0653b/Rxdzz.txt.html http://u32.extabit.com/go/28du69vxbo4ix/?upld=1 http://d01.megashares.com/dl/22GofmH/Rxdzz.txt http://minus.com/l3Q9eDctVSXW3 https://minus.com/mFEx56uOa http://uploadany.com/?d=50452CCA1 http://www.ziddu.com/download/20266246/Rxdzz.txt.html http://www.sendmyway.com/2bmtivv6vhub/Rxdzz.txt.html

Also, what's the point of releasing password protected files to public? I mean, they give you the password thus kind of making the whole password thing a moot point.

It also allows the file to be widely disseminated and mirrored before revealing what it contains, as an anti-DDOS measure.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#84

Post by rogerchucker »

arn wrote: post #79
rogerchucker wrote: post #75

Earlier quoted context omitted.

If you look at the UDID's for the '“Administrator”的 iPad's or '“Administrator”的 iPhone's, there seems to be an incremental pattern in their first 2-3 digits. Does that mean these devices were purchased/ordered in bulk and hence belong to some reseller? In which case, these must not have been sold to people and thus we don't see change in the Device names maybe? And thus the claim that this came from one or two apps s…

maybe an enterprise location or school that bought in bulk?

Wouldn't the devices' names still be changed when individual members of the enterprise/school activated them?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#85

Post by panarky »

schappim wrote: post #63

Looks like they've got Obama's iPad: thea:Downloads admin$ cat ./iphonelist.txt | grep -i obama '473d6e1ebf0b100ed172ce5f69c97ba6c8f12ad5','766a23201c6089be11845bfef624dbaada68be52155079850951836e9373e5cd','hobamain','iPad' 'c63e008e6271c3ac128eb6a242a9817528b6baef','b996a080e11265a0c93436ba0b13b7c07ee4e8eef6faeb8516917b015d7355fb','Obama','iPad'

Openfeint shows that 'Obama' last played 'Fishing Fun 2'

    curl 'https://api.openfeint.com/users/for_device.xml?udid=c63e008e6271c3ac128eb6a242a9817528b6baef

    
    
    
    true
    160
    1479631313
    165632
    Fishing Fun 2
    false
    
    
    
    
    
    
    
    
    Player 1479631313

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#86

Post by buro9 »

arasmussen wrote: post #55

Apple could probably figure out if this data came from an app developer because I'd bet there's only exactly one app which every single one of those 1,000,001 devices downloaded. Even if they threw in a few fake rows to mess up the data, they could find the app that has the highest percentage of downloads from that entire data set.

And if the data came from Apple?

I can't think of any apps that take a full address. Perhaps there are some, I just don't know them.

Apple could have been compelled to release this data to the FBI. Unfortunately, we're unlikely to ever know this and Apple are equally unlikely to want to shed light on it.

If the claim is true, that the source data included full postal address, then I find it hard to identify a better source for all of that than Apple themselves. And that the data was brought together from various systems, and that we're glimpsing data that was shared between Apple and the FBI.

Not to say that there's anything illegal about that, more that the laws that allow that are a bit screwed but that's another issue altogether.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#87

Post by pilif »

arn wrote: post #78
pilif wrote: post #73

Earlier quoted context omitted.

iOS developers don't have the Apple IDs nor ZIP codes nor addresses (unless they separately ask for them but at least the apple ID is very uncommon)

There are no "Apple IDs" in here. Just Apple device UDIDs.

You are right. I misread the announcement. That still leaves the issue of the personal data, but as I said: app developers could acquire that directly from the user.

Possibly, the fact that personal data is missing so often actually might point to a non-apple leak, because they would have the link to personal data. Of course it could be fake, but it would be prsesent.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#88

Post by biafra »

oasisbob wrote: post #34
graiz wrote: post #22

The fact that there is a column for APNS (Apple Push Notifications) suggests that this is a database dump from an iPhone app that supports push notifications. APNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database. The "NCFTA" seems to deal with identity theft. (Ironic)

APNS tokens are generally tied to a specific app so it may be possible to figure out what app leaked their database This isn't true, APNS device tokens are shared among apps on a device. The only time a device will have more than one device token is if it's being used for development. This isn't to say that Apple couldn't correlate the device tokens by looking for shared apps with active APNS entitlements.

I don't think so. The device token is even generated over the version of the app. Meaning: you get a new device token if the app version changes.
Post reply on HN