Quick check to see if your UDID was leaked

by bbunix • 14 years ago

51 29 14 years ago

ukjadoon2• 14 years ago

Could this be another attempt to get more UUIDs? Why should I trust this link?

bbunix4• 14 years ago

That's a good point. Gotta trust someone, kimosabe! This is me: http://linkedin.com/in/bbunix, and no I don't want UDIDs.

ukjadoon2• 14 years ago

=) Thanks!

joebeetee• 14 years ago

Thanks for doing this.

Evbn• 14 years ago

There are ways to do this securely, like client side hashing, that are worth learning and showing off to make you a better web developer and set a good example for others. Yo have a chance to learn and teach here.

SnaKeZ• 14 years ago

What can he do with just a UUID? Really, i don't know...

jared3142• 14 years ago

They could asked for a hash of the device uuid. That would be safer, but you would still have to visit the site. With that request they could match ip, browser info, and device uuid.

Perhaps, it could be put entirely into javascript.

bbunix4• 14 years ago

Entering 40 characters is hard enough by itself. Tell the average user to send an MD5 hash over... if you care that much you do what I did initally, download it, unpack it, and grep.

mgz• 14 years ago

If you want to lookup your UDID but afraid to expose it, use partial search at http://pastehtml.com/udid

Groxx• 14 years ago

Ah, many thanks, that's a much nicer system. No need to trust anything. Have you considered submitting it?

_cbdev• 14 years ago

You do realize that AntiSec stated they have access to about 12.000.000 UDIDs while leaking only 1.000.001?

Maybe you should note that on your site, so even negative Results don't get too confident in their security

bbunix4• 14 years ago

Good point, I'll update it now...

FredericJ• 14 years ago

If you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) http://news.ycombinator.com/item?id=4473833

x0xMaximus• 14 years ago

If anyone is interested, the top device names sorted by popularity :: http://maxnanis.com/files/apple_udid_top_device_names.txt

shortlived• 14 years ago

Does the leak apply to ipads too?

delinka2• 14 years ago

Yes. The "article" on pastebin said "iOS devices" and my download of the million-and-one has mentions of lots of iPads.

delinka2• 14 years ago

This is rather disappointing. After downloading the dump and verifying for myself that We[1] are not on the list, I need a partial match method for the entire list, not just the one-and-a-million released to the public.

[1] "We" - me and the family

sixcorners• 14 years ago

You could ask the bad guys. Do the FBI have an email address? Maybe you could get somewhere with a freedom of information request?

Nogwater• 14 years ago

I had some trouble manually retyping my UDID. It turns out that once you click on the serial number, you can go to Edit->Copy Identifier (UDID).

kevinSuttle• 14 years ago

You can also click to show your UDID, leave your mouse where it is, and CMD-C like usual.

robomartin• 14 years ago

Why don't you allow partial UDID searches? I should be able to type, say, ten digits and see some results. You could also make it so I type the first eight and the last eight characters.

Easier data entry and I don't have to give you my full UDID.

bbunix4• 14 years ago

There would be no way for you to know if you got matched without possibly disclosing other matches as well...

sp332• 14 years ago

The "other matches" are already disclosed, it's too late.

emeidi• 14 years ago

"Has your password been compromised? Type it here to check. Please also leave me your email message so I can inform you in case the password gets leaked later on."

Seriously ...

vhf• 14 years ago

Has someone here found his device in the list ?

If you found yours (I don't say mine since I don't own a single apple device), what do ?

epo• 14 years ago

Actually all you need to do is permit people to enter wildcards and print the results if (say) less than 100 matches are found, so they enter 12346789 and you search for 12346789

sidcool• 14 years ago

Can someone tell me what the AntiSec can do with these UDIDs? I mean they are just phone identifiers, what harm can their exposure cause?

disclosure• 14 years ago

Another UDID checklist: http://dazzlepod.com/apple/ Partial UDID search accepted, i.e. search "d565" instead of your full UDID "d56504ca3b268177f76fef0c2c446ba183afd12b"

Quick check to see if your UDID was leaked

Related Stories