UDID Leak : Identifying the Traitor

http://fredericjacobs.com/identifying-the-traitor

by FredericJ • 14 years ago

141 84 14 years ago

mtgx2• 14 years ago

This is a question we should keep asking Apple until they give a proper, real answer: Who gave this information to FBI? If they say they gave it, then we know Apple gave this information and it will be a PR nightmare for them. If they say they didn't, then they will imply FBI obtained it illegally and we can focus our attention on FBI.

rsynnott• 14 years ago

> If they say they didn't, then they will imply FBI obtained it illegally

Huh? How? Most companies who have an iOS app with over 12 million users could have given it.

Devilboy• 14 years ago

Very few (probably only one) companies' lists would have ALL of the 1000001 ids on the leaked list.

biot2• 14 years ago

It's rather like the FBI having a list of 12,000,000 wifi MAC addresses. Would the mere possession of such a list by the FBI be illegal? What if the MAC addresses supplied by Starbucks are from customers who voluntarily connect their devices to Starbucks' network and transmit their MAC address as part of the connection negotiation?

Similarly, what if the UDIDs are from people who installed a common app on their devices and agreed as part of the terms and conditions to allow information about their hardware (including device name, UDID, etc.) to be transmitted to the app vendor and to other parties including law enforcement?

EDIT: the question of whether they should have this information is completely separate from whether it's illegal for them to have this information. And, as noted by others, no proof has been presented that it was obtained from the FBI.

Dylan168072• 14 years ago

MAC address, user name, phone number, street address...

gyardley• 14 years ago

Not that Apple would bother to answer your questions, but why couldn't a developer have willingly shared this information with the FBI, in order to help them investigate a crime against that developer?

The paranoia on these UDID threads is ridiculous. Investigating crimes is what the FBI primarily does, so if they've got any information it's most likely for that - not some broad-spread domestic surveillance scheme.

FredericJ3• 14 years ago

Let me know if you find other relevant questions to ask.

OpenFeint2• 14 years ago

You might want to ask whether users have installed any game associated with OpenFeint. Some examples are listed on their Wikipedia page: http://en.wikipedia.org/wiki/OpenFeint.

jotaro173• 14 years ago

Yes, but is very dangerous, for example: https://twitter.com/jotaro17/status/243144140878143488/photo...

derp1101• 14 years ago

There are a lot more than 12 million iDevices out there, so why only 12,000,000?

The small number leads me to think that the UUIDs might belong to people the FBI are particularly interested in tracking. If your UUID is in there, fasten your tinfoil hat.

Just a thought.

FredericJ3• 14 years ago

Or it may be have been released by some dude making a fart app.

WhaleBiologist• 14 years ago

Or maybe the FBI are secretly releasing fart apps in order to get UDIDs.

retube• 14 years ago

Can someone explain what a UDID is (sounds like a MAC address or similar) and what the privacy or security implications are?

sbuk5• 14 years ago

Unique Data Item Descriptor

jahewson3• 14 years ago

No...

89a• 14 years ago

UDID = Unique Device Identifier.

It's a number that uniquely identifies your device

Peroni• 14 years ago

http://corte.si/posts/security/apple-udid-survey/index.html

zyb09• 14 years ago

Some insecure apps and services use the UDID as a way to identify users. For example you can get some profile data from OpenFeint with the UDID. There are probably a ton of other small things like this, but overall I wouldn't worry too much.

prof_hobart• 14 years ago

And some secure ones used to use it for multi-factor authentication - e.g. you still username/password, but you can only do it on the device that you registered on.

However, use of UDID has been deprecated by Apple, and they are now rejecting some new apps that read it. You're meant to use a unique application-level ID instead.

smutticus• 14 years ago

Why do people keep assuming that the FBI is actually involved in this? The only evidence of that is from the pastebin page. They could just as easily be lying.

We know nothing. Other than that there are 1,000,001 leaked UDIDs. Everything else is just speculation and needs to be regarded as such until such time as proven otherwise.

capitalisthakr• 14 years ago

Nice try, Mr. Secret Agent.

perlpimp• 14 years ago

its like spot-a-fed at the defcon. here we go.

guelo• 14 years ago

Anonymous' credibility is good. I haven't heard of an instance where they were caught lying in a high profile incident like this.

codehotter• 14 years ago

I have followed these lines of thought before. They contain a fatal mistake.

Anonymous is not a group that can have a reputation. At best, it's a subculture. Anyone can call themselves anonymous. Whoever didn't lie in all the previous incidents may not be behind this one - this could be a totally different person or group of persons with totally different ideals.

lmm• 14 years ago

That's an amusing statement. The whole point of anonymity is for your statements to be judged on their merits rather than your reputation.

belorn2• 14 years ago

If we have any indication that the information is false, first then should this really become an issue. Until then, FBI is the most likely source.

columbo2• 14 years ago

Why blindly trust an unknown entity that may have ulterior motives?

jahewson3• 14 years ago

The whole FBI story is not credible, it's the least likely explanation. I'd start looking for the app that all these UUIDs have in common. This data is probably a dump of that app's server-side database. And what about the zip codes? GeoIP.

cortesi• 14 years ago

Sorry, I don't think this strategy is workable. Consider - 74% of apps I tested sent the UDID to one or more upstream servers. Furthermore, Flurry alone received UDIDs from 15% of apps I tested. That's just one aggregator, and they surely have nearly 100% of UDIDs on file. The APNS tokens narrow it down somewhat, but not too much. It's also not at at all clear that there is a single source involved - this could be an amalgamation of a number of sources.

See this post for the source of these figures: http://corte.si/posts/security/apple-udid-survey/index.html

jotaro173• 14 years ago

Statistics created with the sample of 25,000 udids, Fruit Ninja is suspect? (Not conclusive) pic.twitter.com/vlyoE2ij

jrnkntl• 14 years ago

Why is "Facebook" pre-checked?

FredericJ3• 14 years ago

My bad. Fixed

stcredzero2• 14 years ago

http://pic.twitter.com/rLOyOHbh

The formatting of this blog is just awful for iPad users zooming in on the text.

alan_cx• 14 years ago

Traitor? Is Apple a nation state now?

Which leads to an interesting question for me. Given that many web sites have more users than many countries, should there be a more proscribed relationship?

sp332• 14 years ago

Maybe you're thinking of high treason? It's possible to be a traitor to things other than countries. Actually I think the reason more people are on FB than the US is because there are fewer obligations.

berntb4• 14 years ago

It would surprise me if intelligence organisations didn't make databases like this. I assume the CIA could get the user information from Apple, with or without Apple's consent.

I have no real problem if the UDID:s of my iPad/iPhone/iPod are stored with my name by intelligence organisations in democracies.

But... I do have problems with them being so incompetent that private information about me is leaked!!

pstuart2• 14 years ago

You have no real problems with the secret police monitoring you? Is that an expression of acceptance to something you cannot control or that you really are ok with it?

We have to accept that we are being spied upon because we have no control over that, but we should always resent and resist it when possible.

berntb4• 14 years ago

Terrorism is quite easy in today's world. By definition terror scares people, hence a strong voter pressure to stop it. This results in a Big Brother society.

The number of stopped terror attacks in the West over the last decade is quite large, that would hardly have happened without spying on the citizens.

Is it worth the security? I don't really know. As long as it is in very stable democracies, it ought to be safe...

ttt_• 14 years ago

>> intelligence organisations in democracies

Democracy != immutable state.

mtgx2• 14 years ago

The question is, is that legal/constitutional for CIA to have that data without a warrant on so many Americans?

ObnoxiousJul• 14 years ago

Are any jailbreaked iphones with privacy patches installed being leaked? Xhi2 analysis is not only about what triggers the correlation, what does not trigger the correlation is also important. My guess is jailbreaked are underrepresented in leaked UDID either because jailbreak is shielding users or because users able to install a jailbreak are more aware of computer security issues. Regular Iphone are cell phones remotely controled by a 3rd party, jailbreaked iphones are computers you control. I am no paranoid freak, I am just a regular sysadmin with a pretty low security awareness.

ajuc• 14 years ago

FBI will just fill 1000 fake datapoints to cover its informator.

terhechte• 14 years ago

I doubt it's Apple. I checked the list, and there're tons of German people in there too (one can see that by how they named their iPad). I really doubt that the FBI would be interested in tons of German girls, for example (many iPads seem to belong to girls named 'Sandra' (iPad von Sandra)). If Apple were the culprit here, they would have been able to just deliver the UUIDs from people residing in the states (since they know which UUID is connected to which app store).

I hardly think it's Apple that leaked the information. Even if it's hard to believe for some people: Apple values their users' personal information pretty high.

I personally believe that this is from a internal FBI job, so they got this information in a non-legal way.

jwr• 14 years ago

Seconded. The UDID for one of my iOS devices was there, and I am in Poland. It is definitely not just the US.

bediger4000• 14 years ago

The US Secret Service is apparently interested in busty Columbian girls, why wouldn't the FBI be interested in German girls? Fetishes come in all shapes, sizes and colors, even institutional fetishes.

accarrino• 14 years ago

i wonder if the FBI got the UDID list from Apple, or if the FBI has a stealth app in the App Store and people gave up their info voluntarily when they installed it...

mahrain• 14 years ago

Well, one piece of the puzzle is in the Lulzsec Pastebin itself. the hacked file's original filename is supposed to be "NCFTA_iOS_devices_intel.csv" and a quick Duckduckgo gave me http://www.ncfta.net/ those contractors as source of the data.

gonzo• 14 years ago

http://www.fbi.gov/news/stories/2011/september/cyber_091611 “The exchange of strategic and threat intelligence is really the bread and butter of the NCFTA,” said Special Agent Eric Strom, who heads the FBI unit—the Cyber Initiative and Resource Fusion Unit (CIRFU)—assigned to the NCFTA. “The success of this effort at every level comes down to the free flow of information among our partners.”

Dan Larkin (the FBI Agent who setup NCFTA in 1997) http://www.linkedin.com/pub/dan-larkin/25/90/910

Note that he used to be with CIRFU.

Now, check it out: https://www.allclearid.com/plans/mobile-app

ajanuary• 14 years ago

"I've never installed: Other" That's a looong list.

phelmig• 14 years ago

Finally it all depends on AntiSec. We have no idea wich 1'000'001 datasets they published (first 1m, last 1m or random). If they have access to all 12m UDIDs + the additional information (Country, Postal code, Addresses) they could at least release some statistics about it, this would make it a lot easier to find a (potential) source. (E.g. If we knew wich percentage of the UDIDs came from Europe etc.)

andyv88• 14 years ago

What about PokerStars?

Their US operations were shut down the FBI recently on bank fraud and money laundering charges.

http://www.tightpoker.com/news/pokerstars-shuts-down-2347/

Can anyone else confirm they have PokerStars installed? http://news.ycombinator.com/item?id=4473730

damncabbage• 14 years ago

  I've Never Installed: ... Other [            ]

This is a joke, isn't it? How could I possibly answer this question correctly?

(My deadpan-sarcasm filter isn't working very well right now.)

bcl• 14 years ago

Small datapoint: my iPhone and iPod aren't in this dump. The iPhone hasn't been used in about a year. And the iPod is infrequently used for playing games.

llimllib• 14 years ago

Negative datapoints are nearly completely useless in this scenario, as we only have ~8% of the leaked UDIDs.

Think about it this way: there are more than 250m iOS devices in the world[1]. I think 300m is a good, conservative estimate.

12m (~4%) of the world's UDIDs have leaked. 1m of those (~.33% of the total, 8% of the dump) have leaked.

A data point saying "my iOS device is in the dump" represents 1/1m of its group. Pretty significant, relative to 300m devices!

A data point saying "my iOS device isn't in the dump" has two possibilities; a 96% chance it isn't in the dump and a 3.66% chance it is but wasn't leaked.

As one of the 99.66% of iOS users, your data point represents just 1/299m of its group, and is thus ~300x less powerful than a positive data point.

[1] http://www.engadget.com/2011/10/04/apple-250-million-ios-dev...

stcredzero2• 14 years ago

Is the formatting of this blog meant to be iPad unfriendly?

http://pic.twitter.com/rLOyOHbh

siglesias• 14 years ago

Had the same problem. Use Safari's Reader feature.

brokenparser• 14 years ago

I recommend everyone to fill in this form, even if you don't own an iDevice. The person who leaked the information could be any ones son or daughter, we all know how careless we were ourselves when we were younger. The stakes have become higher, but that doesn't mean we should try to jail a kid with an Internet connection and deprive him/her of his/her future. We should all try to help ensure that incidents such as this leak cannot happen, in the simplest form by rejecting privacy policies which waive your privacy.

Please, why won't anybody think of the children?

DaveWoldrich• 14 years ago

I love all the outrage and concern. All your information is for sale in the walled garden, outside the walled garden, everywhere! You don't deserve to expect anonymity and privacy because you offer up all your secrets willingly.

Rabble all you want over this traitor business, even clamor for new laws to protect us (although that just makes things worse and poisons the waters). In my humble opinion, you breathless bloggers are all just wasting energy. Until we techies start designing networks and storage systems for anonymity and privacy, all your dirty laundry is money in the bank to these service providers and easily searchable by big brother.

lloyddobbler• 14 years ago

It's an interesting question...but as someone who used to word in the survey world, I've gotta say it: the questions here are not going to give very useful data. Here's a couple of examples (& a tl;dr):

1) "Have you been to the US recently"? The way this Q is worded suggests that the audience is not people who live in the US. Either way, the non-specificity of the Q makes me worry with what info will be extrapolated from the responses.

2) "I haven't installed the following apps: Facebook, LinkedIn...OTHER".

...there are a lot of apps I haven't installed. I hope you don't want me to list them all...?

tl;dr - when putting together a survey like this, be careful to look at it from all sides and see where you could be introducing a bias of some sort. Drawing conclusions from flawed data = FTL.

ikangai• 14 years ago

Actually, the notification tokens are a bigger threat, because they allow imposters to send notifications to apps. We know this from our own experience: http://www.ikangai.com/news/udids-leaks-and-push-notificatio... However, there is also a good thing: sending notifications with the tokens from the data can be used to identify the apps which collected the UDIDs.

pppqqqooowww• 14 years ago

For what it is worth, the languages used by users to name their devices are certainly not limited to US English. Out of the 1,000,001 device list, about 10,000 device names contain the Korean possessive "ui", about 5,000 contain the Japanese possessive "no", and a whopping 32,000 contained a Chinese possessive. Unsurprisingly, none contained all three. :-)

UDID Leak : Identifying the Traitor

Related Stories