No, the UDID is a privacy catastrophe.
UDID is a few years old is it not? It's surprising it took people this long to figure this out.
The UDID leak is a privacy catastrophe
31–40 of 52 posts
Re: The UDID leak is a privacy catastrophe
#32Earlier quoted context omitted.
Indirectly it affects all of us.
*that have iDevices.
It affects anyone who lives in a society that is being tracked by their government.
It may be a good thing that the FBI can better track criminals, but if it is used to track political dissidents or to monitor foreign or unpopular companies it should be a concern for us all.
I'm not saying this is happening now, but we should be wary of going down that path.
Re: The UDID leak is a privacy catastrophe
#33Earlier quoted context omitted.
Thanks for that. Not super worried about people knowing my location or games I played :p However, this is of interest: >and in some cases (which affected millions of users) completely take over Twitter and Facebook accounts How is that possible? Are we going to see mass defacements/malware links or other bad stuff on Twitter and Facebook as a result? Also what is meant by 'take over'? Surely it doesn't mean from a UD…
I found vulnerabilities in two social gaming networks that let you take control of people's Facebook and Twitter accounts using _just_ the UDID. I never published the details of these vulnerabilities, but you can find an official acknowledgement from at least one of these companies (Chillingo of Angry Birds fame) in this WSJ piece: http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found-on...
Angry Birds was made by Rovio, not Chillingo.
Chillingo is a publisher of 3rd rate knockoffs.
Re: The UDID leak is a privacy catastrophe
#34Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.
You're the first I've heard say this. Would you mind passing a link along?
Re: The UDID leak is a privacy catastrophe
#35Earlier quoted context omitted.
I found vulnerabilities in two social gaming networks that let you take control of people's Facebook and Twitter accounts using _just_ the UDID. I never published the details of these vulnerabilities, but you can find an official acknowledgement from at least one of these companies (Chillingo of Angry Birds fame) in this WSJ piece: http://blogs.wsj.com/digits/2011/09/19/privacy-risk-found-on...
Angry Birds was made by Rovio, not Chillingo. Chillingo is a publisher of 3rd rate knockoffs.
Chillingo is the publisher of the original Angry Birds, and it's their social network (which is integrated with Angry Birds and therefore on millions of devices) that had the vulnerability.
Re: The UDID leak is a privacy catastrophe
#36Earlier quoted context omitted.
No, you need a push token, which is a combination of device id and app id, and is only generated when the user authorizes the app for remote notifications. Additionally, you need a certificate on the server that is authorized to send messages to that app id.
The push token is static for the device installation: it is not in combination with the "app id". http://stackoverflow.com/questions/2338267/is-the-apn-device...
Yeah, but the certificate used to push is.
Effectively, it's the same result: you can only push to one app with one set of credentials, and credentials are not shared between apps.
Re: The UDID leak is a privacy catastrophe
#37Re: The UDID leak is a privacy catastrophe
#38Has anyone verified that this UDID leak isn't just the old "Goatse Security" leak re-branded? I'm not saying I have any evidence to that, but it seems strange that the "ownage" document didn't mention anything about how the hack was done. Along those lines, has there been any talk of the attack vector? To get a list like this, it would seem that AT&T (as was the case with "Goatse Security") or Apple would need to be…
They did mention the vulnerability they used
During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of "NCFTA_iOS_devices_intel.csv" turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts. no other file on the same folder makes mention about this list or its purpose.
Re: The UDID leak is a privacy catastrophe
#39Given that the UDID has been deprecated in iOS5 and Apple are now rejecting apps that use it, I'd be interested to see what level of actual vulnerability there is these days.
You're the first I've heard say this. Would you mind passing a link along?
Straight from Apple's documentation: https://developer.apple.com/library/ios/#documentation/UIKit...