One million unique device identifier numbers (UDIDs) published for Apple devices that hacker group AntiSec said it accessed earlier this year from a computer belonging to an FBI agent.
The group, which is a splinter operation of the Anonymous hacking collective, said it has grabbed more than 12 million UDIDs and personal data linking the devices to users from the FBI computer. AntiSec said it chose to publish a portion of those records to prove it has them.
In a lengthy note on Pastebin, a member of AntiSec said the group found personal data such as full names and cell numbers from the published data. Instead, the group said it published enough information such as device type, device ID and Apple Push Notification Service tokens to let users determine whether their devices are on the list.
It was not immediately possible to verify the authenticity of AntiSec’s claims about the data. Nor was it clear why the unique device ID data and other personal information belonging to millions of Apple users would be on an FBI agent’s computer in the first place.
FBI spokeswoman Jennifer Shearer said the agency has no official comment on the claim.
Graham Cluley, a senior technology consultant at Sophos, said there is no way of knowing yet whether the hackers are telling the truth.
“We don’t have any way of confirming the source of the data, or what else might have been taken, but it does appear that the files do contain at least some genuine Apple UDIDs,” Cluley said.
“Is it a big deal? Well, if the data was stolen from an FBI computer then questions will be asked as to what the FBI [was] doing with the data in the first place, as well as why it wasn’t better protected,” Cluley said. “At the moment it feels as if the hackers might be more interested in embarrassing the FBI and causing mischief than putting innocent users at risk.”
Apple’s UDIDs are a set of alphanumeric characters used to uniquely identify an iPhone or iPad. The numbers let application developers track how many users have downloaded their application and to gather other information for data analytics.
In its message on Pastebin, AntiSec said it had obtained the numbers from a Dell Vostro laptop belonging to an FBI special agent from the FBI Regional Cyber Action Team in New York.
They were able to breach the computer using the “AtomicReferenceArray vulnerability on Java,” the post said. “During the shell session, some files were downloaded from his Desktop folder. One of them with the name of “NCFTA_iOS_devices_intel.csv” turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zip codes, cell phone numbers, addresses, etc.
“The personal details fields referring to people appears many times empty leaving the whole list incompleted (sic) on many parts,” the post said. “No other file on the same folder makes mention about this list or its purpose.”
According to AntiSec, the reason it decided to publish the data was to expose the FBI’s tracking of device information belonging to Apple users.
“Well we have learnt (sic) it seems quite clear nobody pays attention if you just come and say ‘hey, FBI is using your device details and info and who the f… knows what the hell are they experimenting with that,’ well sorry, but nobody will care. FBI will, as usual, deny or ignore this uncomfortable thingie and everybody will forget the whole thing at amazing speed.”
The group criticized Apple’s use of UDID. “We always thought it was a really bad idea. That hardware coded IDs for devices concept should be erradicated (sic) from any device on the market in the future.”