11–20 of 52 posts
> If your UDID is contained in the list, take a minute to help us identify the traitor that did give your information to the FBI without any your agreement and without warrant ! Wouldn't it also be useful to gather information about who WASN'T on the list and what Apps they have? Maybe device type as well.
The device type is given in the leak
If you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) http://news.ycombinator.com/item?id=4473833
See this post for the source of these figures:
Should we change our paypal passwords? Or worry about getting more spam? etc Why should an end user (eg my mom) care?
I'm not saying there aren't serious repercussions, just having a hard time seeing exactly what they are.
After reading this, I'm still a bit confused as to why this is a catastrophe? Should we change our paypal passwords? Or worry about getting more spam? etc Why should an end user (eg my mom) care? I'm not saying there aren't serious repercussions, just having a hard time seeing exactly what they are.
Unfortunately, there's just not much an ordinary user can do. There's no way for a user to tell if an app accesses and broadcasts their UDID (if you're an expert you can use mitmproxy or a similar tool), and certainly no way to tell if the UDID is being used safely. I would recommend de-linking your social media accounts from all apps unless you know they're safe, but that's the kind of drastic advice that people tend not to take.
After reading this, I'm still a bit confused as to why this is a catastrophe? Should we change our paypal passwords? Or worry about getting more spam? etc Why should an end user (eg my mom) care? I'm not saying there aren't serious repercussions, just having a hard time seeing exactly what they are.
Have a quick read through the posts linked in the article this story points to. I show that using just a UDID, you could access the user's geolocation, games they played, private messages and friends lists on many of the affected social networks, and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts. This is with _just_ a UDID. Some of the companies I notified a year…
However, this is of interest:
>and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts
How is that possible? Are we going to see mass defacements/malware links or other bad stuff on Twitter and Facebook as a result?
Also what is meant by 'take over'? Surely it doesn't mean from a UDID alone, a hacker could log into that associated account with full permissions?
I'm assuming any scripted attack would only have the permissions that any other FB/Twitter app has, and could be blocked in App settings if it started doing 'bad stuff'?
Along those lines, has there been any talk of the attack vector? To get a list like this, it would seem that AT&T (as was the case with "Goatse Security") or Apple would need to be compromised to get this list.
Earlier quoted context omitted.
Have a quick read through the posts linked in the article this story points to. I show that using just a UDID, you could access the user's geolocation, games they played, private messages and friends lists on many of the affected social networks, and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts. This is with _just_ a UDID. Some of the companies I notified a year…
Thanks for that. Not super worried about people knowing my location or games I played :p However, this is of interest: >and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts How is that possible? Are we going to see mass defacements/malware links or other bad stuff on Twitter and Facebook as a result? Also what is meant by 'take over'? Surely it doesn't mean from a UD…
http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found-on...
Has anyone verified that this UDID leak isn't just the old "Goatse Security" leak re-branded? I'm not saying I have any evidence to that, but it seems strange that the "ownage" document didn't mention anything about how the hack was done. Along those lines, has there been any talk of the attack vector? To get a list like this, it would seem that AT&T (as was the case with "Goatse Security") or Apple would need to be…
If you disallow an app from sending you push notifications, will it still have your UDID/Device ID? Or if you never enable it, does the app & app server never get it?