Antisec (Anon) responds to the FBIs denial of stolen Apple UDIDs

Antisec claims to have stolen Apple UDIDs from an FBI computer and the FBI quickly denies.

Anonymous quickly fires back that ...

""Also, before you deny too much: Remember we’re sitting on 3TB additional data. We have not even started,"

@AnonymousIRC Twitter

The claim to have 3TB of info was first released in a LulzSec youtube video




Personally, after the Apple UDID leak and knowing that the UDIDs are legit I am more inclined to believe that Anon's claims may be real. I also find it interesting MSM outlets are barely covering these developments and not a peep from Apple.

This should get interesting ...

Okay if anyone can clue me in what is the importance of the UDID stuff?

I tried to learn up on MD5's and SLA,s but Iam totaly lost to what it all means.

Do people use this to hack into systems or does this just identify who the data came from?

Just trying to figure out the importance of this whole thing thats all.

First the denial.

Then the down playing of it.

Then a blatant excuse of why they had the info.

and than nothing will come of it because American consumers are lazy and trade their liberty for comfort.

Ohhhh new distracting flashing app I must go play on my iphone and ipad...

Sad but true.

Originally posted by lunchmanstan
Okay if anyone can clue me in what is the importance of the UDID stuff?

I tried to learn up on MD5's and SLA,s but Iam totaly lost to what it all means.

Do people use this to hack into systems or does this just identify who the data came from?

Just trying to figure out the importance of this whole thing thats all.

Simple, its a privacy concern,

Either apple sold out its consumers by giving the info with out warrant to the FBI, or the FBI was illegally tracking them.

With the info they can track data usage and all that entails if they so wished, its the whole Warrant-less part of it that is the "big deal"

reply to post by lunchmanstan


Most "official" reports I have read claim that the UDIDs cannot be used maliciously but there are claims of a program that can "De-anonymize Apple UDIDs" and "misuse UDIDs in a way that allowed you to link a UDID to a user's identity, geolocation and Facebook and Twitter accounts""

Only god knows what else can be done but I will not link to that program ...

Originally posted by Tazkven
reply to post by lunchmanstan

 

Most "official" reports I have read claim that the UDIDs cannot be used maliciously but there are claims of a program that can "De-anonymize Apple UDIDs" and "misuse UDIDs in a way that allowed you to link a UDID to a user's identity, geolocation and Facebook and Twitter accounts""

Only god knows what else can be done but I will not link to that program ...

Even if its completely benign and nothing could ever possibly be done with it (then why have them in the first place) its still a violation, it would be like them looking up the serial numbers of various products you own, say like opening up the hood and checking the VIN on the parts in your car.

Getting your vin or serial off of car parts maybe useless, but its still a violation of your 4th amendment rights.

reply to post by benrl


Indeed it is, I totally agree.

I checked over the list to see info listed, they actually also released the APNS Token along with the UDIDs and Device type and name.

The APNS token is AKA Apple Push Notification service (APNs for short) is the centerpiece of the push notifications feature. It is a robust and highly efficient service for PROPAGATING INFORMATION TO DEVICES such as iPhone, iPad, and iPod touch devices.

Kind of scary ...

CNET says ...

CNET talked to a few people whose devices were on the list and whose names and numbers were included in their "Device Name Field.' CNET also was able to use the data, which had been mostly scrubbed by the hackers of personally identifiable information, to find names and phone numbers by cross referencing it with publicly-available third-party databases. People on the list could be targets for phishing attacks based on the information on the list and even more at risk if someone did a little bit of digging.

Regardless of how the leak is downplayed the truth is this a security leak of epic proportions and you can bet the farm that people are using this list and other sources for malicious activity ...

Not to mention what the FBI could do with this information. You basically have an RFID chip with audio and video capabilities, logging your every move, phone call, txts and internet lifestyle.

Scary stuff, indeed ...

I know this sounds verly verly fischy kiptin.

Let's see UDID= Serial Number on some macbooks and imacs? Could be the FaceTime i-Sight camera perhaps?

But what I'm pondering over is that name, Stangl, is very very familiar in the gaming world? or at least the last name is....not sure how that relates...wasn't a stangl on SWG or STO? or one of the other games, perpetual which went bonkers and belly up then cryptic studios got the star trek online game license?

Not sure how it figures, but the point seems to be that WE are aware that these UDID's or Hardware Serials are being perhaps misused or abused?

This is very interesting...

Epic proportions? Someone having access to the information on that list, could in real time have a "portal" to wreak havoc by cherry-picking targets, by all sorts of cross-referencing.

The only way to defeat this would be take your battery out of the phone when not in use...but still, true privacy dictates that this never should happen in the first place. The potential to abuse it precludes it from ever being added. Hardware ID's are much like MAC addresses, which is where the being able to "track" should end since it's publicly visible combined with an IP.

Much like the VIN on your windshield of your vehicle. It's right there in plain sight, so why complain if someone gets it? Anyone can see it.

But, I don't like the idea that someone could have the hardware id of my isight camera, they could use that as an anchor to "SEE" anything no matter what IP address you have...it's that anchor that will sink the ship, metaphorically. Those hardware id's were meant to be used internally, and if this indicates it goes deeper or includes more than we realize, then perhaps apple may not be as secure as we were led to believe, just an assertion.

I guess it would depend on whatever app is used if it transmits those hardware id's in any form shape or fashion, but I'm glad to know this than not know it. This is what I hate...all this modern tech meant to be more productive and give our lives enhanced meaning and enjoyment is perverted by the negative side of humanity, which seeks to destroy that innocent peace which was intended. So what ensues next is a war of "ideologies," and literally this is a "great tribulation' of what's good and bad in humanity. We must use technology and ideology in good faith to minimize ourselves of the threat or temptation to misuse it. Always take the high-road...unless you're RIGHT, otherwise, never compromise on being correct. If so, compromise negates being correct and makes it in-correct.

This is all over MSM right now...

reply to post by Tazkven


Now that's an invasion of privacy either corporate or govt use of that concept.

I still have a hard time believing that the FBI had info like that on their alleged agent's laptop without encryption or other simple security on the file.

IF that file were simply encrypted, it would not be of use to anyone but who had the key to unlock it.

Sounds very fishy as to the source, but the information if true is a glimmer of gold in a fool's gold sea...and that is what we should make note of.

This could be some PR campaign to strangle some marketshare from apple TO windows 8, but since nothing is important or lasting in IT / internet / network or applications of it, it will be obsolete soon enough.

It's the social engineering aspect of it that will propagate it. As long as you have no ethics or morality, there will be no real freedom or liberty on the internet...sad but true.

Change our way of using tech first then hope for a technological convergence. It's coming eventually. Then no one can hide from anyone else is the paradigm. Wouldn't that be nice? Heaven or hell your choice...lol.

...And Apple responds,

"The FBI has not requested this information from Apple, nor have we provided it to the FBI or any organization. Additionally, with iOS 6 we introduced a new set of APIs meant to replace the use of the UDID and will soon be banning the use of UDID,"

allthingsd.com

In my opinion this statement could be a conspiracy in and of itself, lol ... They basically just said the fix for this problem is the new devices, wow!

Then @AnonymousIRC responds ...

Next week expected iPhone 5 release. I know what people will be talking about, and it's probably not a new phone.

If I had an iOS device I would turn if off for awhile, just to be safe ... lol

Now could go down a very deep rabit hole.

S & F

Well that gives credibility to the assumption that Apple will discontinue UDID's on iOS6 and iPhone 5? What about iMac and ProBooks?

Their iSight cameras have a UDID in the form of the Serial Number. That's not supposed to translate across the network layer....only the MAC is visible and of course an IP address, which is dynamic.

This is interesting to say the least...combined with Java 7, update 7 still having a "bug." Which I haven't understood entirely, but some are advising to keep Java 6...for now...the updates are not fixing it. Allegedly.

Originally posted by Tazkven
...And Apple responds,

"The FBI has not requested this information from Apple, nor have we provided it to the FBI or any organization. Additionally, with iOS 6 we introduced a new set of APIs meant to replace the use of the UDID and will soon be banning the use of UDID,"

allthingsd.com

LOL FBI has not requested this information from Apple ya for sure only the Arabs names like Hussein, Bin. AL

reply to post by trekwebmaster


Hey trekwebmaster,

I found more info and posted it in a New Thread about "FinFisher's FinSpy Mobile" and how it uses an Ad-Hoc exploit or loophole with your UDID to remotely install itself on iDevices.

Also, is info of an iTunes exploit that allowed FinFisher to install itself onto Mac PCs thru iTunes that was left unsecured for 3 years unpatched.

Also it appears Anon is threatening to release something again, Maybe more UDIDs?

next: release coming, tribute to a good friend whos now jailed.

Source via Twitter AnonymousIRC

I posted this on another thread with the same topic, but no-one responded to it:

I wonder why no-one picked this up. It´s definitely related, and it would be really disturbing if this data originally came from the NCFTA, as the filename at least suggests.

From their "About the NCFTA" section:

The NCFTA, a non-profit corporation, evolved from one of the nation’s first High Tech Task Forces and, since 1997, has established an expansive alliance between subject matter experts (SMEs) in the public and private sectors (more than 500 worldwide) with the goal of addressing complex and often internationally-spawned cyber crimes. These SMEs, from industry, academia and government, each bring specific talents and experiences to the partnership. Through a steady cycling of such cross-sector national and international resources, both embedded at the NCFTA and through initiative-specific intelligence channels, the NCFTA is well positioned to adapt and regularly reinvent itself to better address today’s evolving threat landscape.

Reading through the veil of corporate buzzwords it comes down to a non-profit organisation, specialising in providing services related to solving/tracking cyber-related crime; an alliance of worldwide experts from the private and public sectors, as well as governments.

The primary objectives of this public/private alliance are to:
•Identify, mitigate, and neutralize cyber crime threats
•Rapidly build intelligence to the actionable level so that the threat can be: ◦Further located/identified (who all are involved and where they are located)
◦Mitigated through timely enhancement of security practices/procedures
◦Effectively neutralized through:
■Proactive law enforcement engagement (domestically & internationally)
− This can/may include both criminal and civil avenues in coordination with appropriate authorities
■Implementation of interim technology solutions (i.e. null-routing of botnet traffic or similar interdiction action via TLD’s or ICANN)

(Emphasis added by me)

From this I conclude that they do work with law enforcement agencies such as the FBI and it may very well be that they are the ones who provided the data in cvs format to the agent.

It´s no surprise to me really, but we are being spied on massively!

Since the supposed statement from AntiSec listed the filename as "NCFTA_iOS_devices_intel.csv" I searched for NCFTA and found the above... what do you guys think?

NCFTA Website

reply to post by RationalDespair


I have also noticed no one seems to really care about this, I think its a security risk of epic proportions and a massive cover up. I believe both the Feds and Apple are both lying and it all ties into UK's Gamma International's FinFisher's FinSpy Mobile tools and maybe other tools as well.

I covered it pretty well in the link to the thread in my post above this one.

This is a major conspiracy and its no coincidence that articles like this one keep popping up daily ...

A legal battle is brewing between technology companies and the U.S. government over whether law-enforcement agents have the right to obtain passwords to crack into smartphones of suspects. Google Inc. earlier this year refused to unlock an alleged pimp's cellphone powered by its Android software—even after the Federal Bureau of Investigation obtained a search warrant.

The Wall Street Journal

It's all related and getting ready to explode into a huge scandal unless the FBI and Apple are successful in their lies and lobbying/threatening to remove these stories form the MSM.

reply to post by Tazkven


I agree, but honestly, even if it would all "explode" and it would come out in the open that we´re being spied on, I´m pretty sure the MSM won´t report on it and other than that, the people simply don´t seem to care enough.

I´ve been telling my friends and family about some of these things related to "smart" phones and electronic banking and such, but they either think I´m being paranoid or don´t care as long as it doesn´t effect them personally.