Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

pastebin.com

Post reply on HN
Print view View original

161–170 of 279 posts

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#161

Post by sideshownz »

We've recently discovered that even though the Apple docs suggest the APNS tokens may be unique to each app and may change over time they are NOT unique to an app and they also do not change (at least not over the last 18 months).

So if you have two apps on the same device they both share the same UDID and the same APNS token.

Whilst on the surface this may seem like a huge security issue it is not as bad as it seems, because in order to send push notifications to a device you must have the correct APNS .p12 certificate generated by Apple for the app AND the app must be installed on that device.

I would see the UDID's as more of a security breach given the fact that many developers are still using the now depreciated udid to interface with web services.

On a similar note, If you are developing an app and need to have a unique identifier you should be using Secure UDID or something similar https://github.com/crashlytics/secureudid and if you're sending data to you're own webservice, don't just use SSL, use encryption such SHA to prevent mitm sniffing of your data - Both iOS and Android both allow installation of root CA certs which is amazing for developing and sniffing API's but dangerous if your writing webservices and ONLY relying on SSL and no other encryption.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#162

Post by zwdr »

robomartin wrote: post #82

I doubt very much that Apple had anything to do with this. That's not the kind of company they are.

Wait, are syou serious? I didnt know anyone could be _that_ delusional about Apple. You _really_ think Apple cares about privacy? They aren't "that kind of company"? Where the hell do you get the idea that Apple cares about the morality of their decisions? Could it be that you are a fanboy? Wait, I know the answer to that already.

..."shit HN says", right here.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#163

Post by gizzlon »

tzs wrote: post #130

Is there some good reason for all those steps to actually get the file after downloading? I don't see the point of encrypting it, or of having a tarball with just one file. They also suggest checking the file integrity of the download, and then also checking the integrity of the final extracted file--this seems completely pointless as the final extracted file is derived deterministically from the download so you've a…

Encrypting it, at least, makes sense: They can take their time distributing the file without anyone peeking at it before they're suppose to. Then, when they release the decryption key, the file is already copied all over the place and really hard to shut down.

Guess all the verifying means they are afraid someone will distribute "altered" versions. Checking it twice is maybe a little drastic? Don't know how hard it is to generate a file that compresses to the same as their file (collision). But it's at least theoretically possible.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#165

Post by bornhuetter »

pilif wrote: post #87
arn wrote: post #78

Earlier quoted context omitted.

There are no "Apple IDs" in here. Just Apple device UDIDs.

You are right. I misread the announcement. That still leaves the issue of the personal data, but as I said: app developers could acquire that directly from the user. Possibly, the fact that personal data is missing so often actually might point to a non-apple leak, because they would have the link to personal data. Of course it could be fake, but it would be prsesent.

When he said "a popular iOS developer" I assumed he meant Facebook.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#166

Post by eduo »

squamos wrote: post #149
robomartin wrote: post #82

I doubt very much that Apple had anything to do with this. That's not the kind of company they are.

Apple has everything to do with this. They're the ones who decided to put UDIDs on all their devices to begin with. And they know they've royally screwed up too - that's why they've deprecated UDIDs in iOS 5 and have started rejecting applications that access it. But that hardly fixes the problem since everyone will just use the Bluetooth or wireless MAC addresses instead - its not guaranteed to be unique, but close…

So, essentially, you're saying whatever Apple does or doesn't do is a bad decision in the end since it would always fall back to the hardware identifiers, then. Right?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#167

Post by reddnotebook »

jonaldomo wrote: post #76
arasmussen wrote: post #55

Apple could probably figure out if this data came from an app developer because I'd bet there's only exactly one app which every single one of those 1,000,001 devices downloaded. Even if they threw in a few fake rows to mess up the data, they could find the app that has the highest percentage of downloads from that entire data set.

Another more likely possibility would be to identify people who are on the list and compare all their installed apps and search for a common denominator.

People delete apps though, you'd need their entire history to cross reference that. Not to mention false positives - how many people have the Twitter or Facebook app installed, for example?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#168

Post by eduo »

zwdr wrote: post #162
robomartin wrote: post #82

I doubt very much that Apple had anything to do with this. That's not the kind of company they are.

Wait, are syou serious? I didnt know anyone could be _that_ delusional about Apple. You _really_ think Apple cares about privacy? They aren't "that kind of company"? Where the hell do you get the idea that Apple cares about the morality of their decisions? Could it be that you are a fanboy? Wait, I know the answer to that already. ..."shit HN says", right here.

"Could it be that you are a fanboy?"

With the reply you've just sent and you seriously question if the parent is unbiased? Do you frankly consider yourself biased? Could it be that you're an anti-apple fanboy?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#169

Post by ommunist »

I think this leak plays for FBI in PR sense, not against it. All support slogans in the _anonymous message are exact description of the US foreign policy, so this message support distribution of wreck and havoc of people's lives in the third and second world. All this is rather strange.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#170

Post by davidp »

sideshownz wrote: post #161

We've recently discovered that even though the Apple docs suggest the APNS tokens may be unique to each app and may change over time they are NOT unique to an app and they also do not change (at least not over the last 18 months). So if you have two apps on the same device they both share the same UDID and the same APNS token. Whilst on the surface this may seem like a huge security issue it is not as bad as it seems…

> you should be using Secure UDID or something similar

As an app developer, does this give me some benefit over just generating and saving a random UUID on first launch?

Post reply on HN