AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types • Hacker News Board

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#181

Post by pi18n » Tue, Sep 04, 2012, 12:12 PM UTC

gizzlon wrote: post #163

tzs wrote: post #130

Is there some good reason for all those steps to actually get the file after downloading? I don't see the point of encrypting it, or of having a tarball with just one file. They also suggest checking the file integrity of the download, and then also checking the integrity of the final extracted file--this seems completely pointless as the final extracted file is derived deterministically from the download so you've a…

Encrypting it, at least, makes sense: They can take their time distributing the file without anyone peeking at it before they're suppose to. Then, when they release the decryption key, the file is already copied all over the place and really hard to shut down. Guess all the verifying means they are afraid someone will distribute "altered" versions. Checking it twice is maybe a little drastic? Don't know how hard it i…

MD5 is not the best cryptographic hash... it's weird that they would be so paranoid as to include two hashes but not use something harder to collide with.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#182

Post by RutZap » Tue, Sep 04, 2012, 12:13 PM UTC

pgrote wrote: post #74

video of the special agent. https://www.facebook.com/video/video.php?v=512364171294

I'm better off listening to http://www.linux.fm/ .. it's more fun than listening to this guy

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#183

Post by lylejohnson » Tue, Sep 04, 2012, 12:24 PM UTC

mehrshad wrote: post #135

taybenlor wrote: post #21

Earlier quoted context omitted.

Is there any evidence that this data comes from the source they claim? And is there some way to validate these are real UDIDs?

Sure - me. Both my iOS devices are on this list - confirmed both by name and UDID match. However, I renamed my iPad around last November after I started using it more in public, yet its original name (easy to find if you search for my HN nick) is the name listed. EDIT: Oh, and fwiw, law-abiding natural born US citizen here. But who am I kidding - LEAs don't give a toss about that.

How does that prove that an FBI laptop was the source of this information (per the grandparent post's question)?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#184

Post by CGamesPlay » Tue, Sep 04, 2012, 12:25 PM UTC

mehrshad wrote: post #135

taybenlor wrote: post #21

Earlier quoted context omitted.

Is there any evidence that this data comes from the source they claim? And is there some way to validate these are real UDIDs?

Sure - me. Both my iOS devices are on this list - confirmed both by name and UDID match. However, I renamed my iPad around last November after I started using it more in public, yet its original name (easy to find if you search for my HN nick) is the name listed. EDIT: Oh, and fwiw, law-abiding natural born US citizen here. But who am I kidding - LEAs don't give a toss about that.

Does it have an APNS token? Is it possible to send yourself a push notification and see what app it appears to come from?

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#185

Post by mathias » Tue, Sep 04, 2012, 12:28 PM UTC

antimatter15 wrote: post #18

One interesting thing I've found is that apparently 190 of those 1000001 people have named their devices "The Titanic", for that iTunes "The Titanic is syncing" pun. I'm curious if there's anything else interesting that might be found in this data.

Actually, it’s more like 166:

    $ grep -c -i "titanic\'" iphonelist.txt 
    166

It’s only 190 if you include names like “Titanic’s iPad”, but those aren’t funny.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#186

Post by AimHere » Tue, Sep 04, 2012, 12:37 PM UTC

lylejohnson wrote: post #183

mehrshad wrote: post #135

Earlier quoted context omitted.

Sure - me. Both my iOS devices are on this list - confirmed both by name and UDID match. However, I renamed my iPad around last November after I started using it more in public, yet its original name (easy to find if you search for my HN nick) is the name listed. EDIT: Oh, and fwiw, law-abiding natural born US citizen here. But who am I kidding - LEAs don't give a toss about that.

How does that prove that an FBI laptop was the source of this information (per the grandparent post's question)?

Your grandparent asked two questions. He answered the other one.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#187

Post by andyv88 » Tue, Sep 04, 2012, 12:48 PM UTC

Monotoko wrote: post #131

ErikD wrote: post #116

Earlier quoted context omitted.

What apps do you have installed? This is interesting to know since the data might be from a popular app instead of Apple.

Whatsapp, ebuddy pro, ebuddy XMS, Angry Birds, Angry Birds Space, FML, XKCD, Facebook, Spotify, BBC News, Dropbox, Steam and PokerStars are the more popular ones official I have installed. I also have Cydia, a few tweaks and finally Installous (didn't want to admit that - I don't use it often - but thought it may spread some light here)

What about Pokerstars?

Their US operations were shut down the FBI recently on bank fraud and money laundering charges.

http://www.tightpoker.com/news/pokerstars-shuts-down-2347/

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#188

Post by uxp » Tue, Sep 04, 2012, 12:56 PM UTC

rkaplan wrote: post #37

Question: is it possible for a malicious hacker to use this information for anything? E.g. sending rogue push notifications to a user, or tracking down a user's additional personal information by knowing his/her device UDID or APNs token? I sincerely hope both the U.S. government and Apple address this. I'd also be interested in hearing why Apple chose to have hardware coded unique ids for each device.

If a webservice tries to send a push notification to a device that has not registered for push notifications for the entitlement requesting the notification to be sent, the notification gets discarded. Remember, all notifications are to be pushed to Apple using a certificate generated on a per-app basis, who in turn pushes the message to devices.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#189

Post by bricestacey » Tue, Sep 04, 2012, 1:04 PM UTC

CGamesPlay wrote: post #184

mehrshad wrote: post #135

Earlier quoted context omitted.

Sure - me. Both my iOS devices are on this list - confirmed both by name and UDID match. However, I renamed my iPad around last November after I started using it more in public, yet its original name (easy to find if you search for my HN nick) is the name listed. EDIT: Oh, and fwiw, law-abiding natural born US citizen here. But who am I kidding - LEAs don't give a toss about that.

Does it have an APNS token? Is it possible to send yourself a push notification and see what app it appears to come from?

You need an appropriate cert for that.

Re: AntiSec leaks 1,000,001 Apple UDIDs, Device Names/Types

#190

Post by 54mf » Tue, Sep 04, 2012, 1:10 PM UTC

firebones wrote: post #70

wtn wrote: post #52

Earlier quoted context omitted.

The FBI stole an Instapaper server in an unrelated raid http://blog.instapaper.com/post/6830514157

So Marco Arment could go all CSI for us and let us know whether the sample corresponds to info he retained and which would have been on the server at the time.

I've been using Instapaper since pretty much the first day, and my information is not in the file. Not to say they don't have it, but, it's not in that file, FWIW.