The harvesting of over 100,000 iPad 3G owners' e-mail addresses was not a hack or a classic data breach, but a brute-force attack of a minor feature AT&T offered to Apple customers, experts said Wednesday.
According to New York-based Praetorian Security Group, which obtained a copy of the PHP script used to scrape e-mail addresses from AT&T's servers, the attack succeeded because the mobile carrier used poorly designed software.
A nine-person hacking group known as Goatse Security claimed responsibility for the script, which amassed 114,000 e-mail addresses.
"There's no hack, no infiltration, and no breach, just a really poorly-designed Web application that returns e-mail address when ICC-ID is passed to it," Praetorian said in a late Wednesday entry on its security blog.
An ICC-ID (Integrated Circuit Card Identifier) is the unique number assigned to each SIM card. A mobile device's SIM stores information that identifies the specific wireless customer to his or her carrier. The iPad 3G contains a SIM card.
AT&T confirmed the nature of the attack to technology blog Gizmodo. Gawker, Gizmodo's parent Web site, first reported the e-mail harvesting Wednesday.
The script Praetorian made public was a "brute-force attack," according to AT&T's chief security officer Ed Amoroso, who spoke with Gizmodo.
When iPad 3G owners sign up for wireless data service with AT&T, the carrier detects the SIM's 19-digit ICC-ID -- essentially a serial number -- then asks for a contact e-mail address. AT&T uses the e-mail address to populate one of two log-in fields in the iPad's settings screen so that the user has to enter only a password to check his or her account status.
That same e-mail address was what the script harvested. E-mail addresses apparently belonging to New York Mayor Michael Bloomberg and top executives at Dow Jones, The New York Times Co. and Time Warner were among those collected.
AT&T turned off access to the feature Tuesday and apologized to customers in a statement it issued Wednesday. It also said that only e-mail addresses linked to each ICC-ID, not financial information or other personal data, was snatched from its servers.
Voor maar €499 heb je het goedkoopste iPad model, de 16 GB WiFi. Prima om er thuis en in de tuin alles mee te kunnen doen wat je maar wilt. En vanaf vrijdag 23 juli is hij gewoon op een normale manier in Nederland verkrijgbaar.
iFixYouri did a little science experiment the other day. Many people have been talking that the new iPhone has strong glass, less prone to scratching, 30 times stronger than plastic, etc. Will the new glass prove to be ultra strong and never break?
Apple confirmed weeks of speculation Monday with the introduction of a new iPhone handset.
The new Apple iPod Touch. The 64GB device features a 2-megapixel camera, and, based on its markings, appears to be a test unit. Even if we can assume this device is real, it's still anybody's guess as to whether this supposed iPod Touch will ever reach store shelves. An iPod Touch with camera was rumored to be released last fall, but the device was reportedly scrapped at the last minute due to production problems.
