Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The UDID leak is a privacy catastrophe

corte.si

Post reply on HN
Print view View original

21–30 of 52 posts

Re: The UDID leak is a privacy catastrophe

#22

Post by jordanthoms »

dekz wrote: post #9

> If your UDID is contained in the list, take a minute to help us identify the traitor that did give your information to the FBI without any your agreement and without warrant ! Wouldn't it also be useful to gather information about who WASN'T on the list and what Apps they have? Maybe device type as well.

Seeing as this is only 1 million sampled from a claimed 12 million list, that wouldn't be that useful since it's possible their UUID is just on the other part of the list.

Re: The UDID leak is a privacy catastrophe

#26

Post by api »

cortesi wrote: post #14
wamatt wrote: post #13

After reading this, I'm still a bit confused as to why this is a catastrophe? Should we change our paypal passwords? Or worry about getting more spam? etc Why should an end user (eg my mom) care? I'm not saying there aren't serious repercussions, just having a hard time seeing exactly what they are.

Have a quick read through the posts linked in the article this story points to. I show that using just a UDID, you could access the user's geolocation, games they played, private messages and friends lists on many of the affected social networks, and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts. This is with _just_ a UDID. Some of the companies I notified a year…

I think this proves that Apple's UDIDs are a horrible, insecure system. That is a privacy catastrophe.

Re: The UDID leak is a privacy catastrophe

#27

Post by robbiep »

objclxt wrote: post #20
robbiep wrote: post #18

If you disallow an app from sending you push notifications, will it still have your UDID/Device ID? Or if you never enable it, does the app & app server never get it?

Push notifications don't use the UDID. They use a different token. UDIDs can be requested without user consent by applications, although that functionality is supposedly deprecated from iOS 5 onwards.

thanks for clarifying

Re: The UDID leak is a privacy catastrophe

#29

Post by samfoo »

cortesi wrote: post #17
wamatt wrote: post #15

Earlier quoted context omitted.

Thanks for that. Not super worried about people knowing my location or games I played :p However, this is of interest: >and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts How is that possible? Are we going to see mass defacements/malware links or other bad stuff on Twitter and Facebook as a result? Also what is meant by 'take over'? Surely it doesn't mean from a UD…

I found vulnerabilities in two social gaming networks that let you take control of people's Facebook and Twitter accounts using _just_ the UDID. I never published the details of these vulnerabilities, but you can find an official acknowledgement from at least one of these companies (Chillingo of Angry Birds fame) in this WSJ piece: http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found-on...

By "Take control of..." you mean "act with the permissions of the app", I assume? I can't see how Angry Birds the app would ever have full control over my Facebook account unless there's a catastrophic vuln. in the Facebook API.
Post reply on HN