EMAIL DETAILS

_____

From: Phillips, Macon
To: Carney, James F.
Sent: Wed Jun 09 17:16:22 2010
Subject: FW: ipad data leak


fyi


From: Phillips, Macon
Sent: Wednesday, June 09, 2010 5:16 PM
To: Burton, William A.; Finkenbinder, Benjamin N.; 'meridith.webster@gmail.com'; Sweeney, Sean; Gibbs, Robert L.; Pfeiffer, Dan; Souza, Peter J.; Chang, Cindy; Hopkins, Marissa C.; Lesser, Eric P.
Subject: RE: ipad data leak


Basically it means that if you bought an ipad that uses ATT’s 3G network (so not the wifi-only model) the email address you used when registering the device was publically available (though not easily found). A security firm figured out the vulnerability and told ATT, but only after they downloaded what could be the email address for 114,000 ipad owners including some high profile folks


From: Burton, William A.
Sent: Wednesday, June 09, 2010 5:08 PM
To: Finkenbinder, Benjamin N.; meridith.webster@gmail.com; Sweeney, Sean; Gibbs, Robert L.; Pfeiffer, Dan; Souza, Peter J.; Chang, Cindy; Phillips, Macon; Hopkins, Marissa C.; Lesser, Eric P.
Subject: ipad data leak


Will be honest, I barely understand this story but apparently Gawker thinks it’s a big deal.


GAWKER: Apple's Worst Security Breach: 114,000 iPad Owners Exposed <http://gawker.com/5559346/apples-worst-security-breach-114000-ipad-owners-exposed>

Apple has suffered another embarrassment. A security breach has exposed iPad owners including dozens of CEOs, military officials, and top politicians. They—and every other buyer of the wireless-enabled tablet—could be vulnerable to spam marketing and malicious hacking.

The breach, which comes just weeks after an Apple employee lost an iPhone prototype in a bar, exposed the most exclusive email list on the planet, a collection of early-adopter iPad 3G subscribers that includes thousands of A-listers in finance, politics and media, from New York Times Co. CEO Janet Robinson to Diane Sawyer of ABC News to film mogul Harvey Weinstein to Mayor Michael Bloomberg. It even appears that White House Chief of Staff Rahm Emanuel's information was compromised.

It doesn't stop there. According to the data we were given by the web security group that exploited vulnerabilities on the AT&T network, we believe 114,000 user accounts have been compromised, although it's possible that confidential information about every iPad 3G owner in the U.S. has been exposed. We contacted Apple for comment but have yet to hear back. We also reached out to AT&T for comment. A call to Rahm Emanuel's office at the White House has not be returned.


AT&T closed the security hole in recent days, but the victims have been unaware, until now. For a device that has been shipping for barely two months, and in its wireless configuration for barely one, the compromise is a rattling development. The slip up appears to be AT&T's fault at the moment, and it will complicate the company's already fraught relationship with Apple. But it will also likely unnerve customers thinking of buying iPads that connect to AT&T's cellular network.

It will also do so at a pivotal moment, with the iPad 3G early in its sales cycle. Brisk sales for the original wi-fi iPad had promised to turn the 3G model into a similar profit machine. But further questions about AT&T, already widely ridiculed for its bad service, are going to make people think twice about spending up to $830 and $25 per month on the iPad 3G.

The specific information exposed in the breach included subscribers' email addresses, coupled with an associated ID used to authenticate the subscriber on AT&T's network, known as the ICC-ID. ICC-ID stands for integrated circuit card identifier <http://en.wikipedia.org/wiki/Subscriber_Identity_Module#Integrated_circuit_card_identifier_.28ICC-ID.29> and is used to identify the SIM cards that associate a mobile device with a particular subscriber.

Breach details: Who did it, and how

The subscriber data was obtained by a group calling itself Goatse Security <http://security.goatse.fr/> . Though the group is steeped in off-the-wall, 4chan <http://gawker.com/346385/what-the-hell-are-4chan-ed-something-awful-and-b> -style internet culture—its name is a reference to a famous gross-out Web picture—it has previously highlighted real security vulnerabilities in the Firefox <http://www.theregister.co.uk/2010/01/30/firefox_interprotocol_attack/> and Safari <http://encyclopediadramatica.com/Safari_XPS_Attack> Web browsers, and attracted media attention <http://blogs.wsj.com/digits/2009/04/14/did-weev-play-a-role-in-amazon-error/> for finding what it said were flaws in Amazon's community ratings system.

Goatse Security obtained its data through a script on AT&T's website, accessible to anyone on the internet. When provided with an ICC-ID as part of an HTTP request, the script would return the associated email address, in what was apparently intended to be an AJAX <http://en.wikipedia.org/wiki/Ajax_(programming)> -style response within a Web application. The security researchers were able to guess a large swath of ICC IDs by looking at known iPad 3G ICC IDs, some of which are shown in pictures posted by gadget enthusiasts to Flickr <http://www.flickr.com/photos/kalleboo/4662852294/> and other internet sites, and which can also be obtained through friendly associates who own iPads and are willing to share their information, available within the iPad "Settings" application.

To make AT&T's servers respond, the security group merely had to send an iPad-style "User agent" header in their Web request. Such header identify users' browser types to websites.

The group wrote a PHP script to automate the harvesting of data. Since a member of the group tells us the script was shared with third-parties prior to AT&T closing the security hole, it's not known exactly whose hands the exploit fell into and what those people did with the names they obtained. A member tells us it's likely many accounts beyond the 114,000 have been compromised.

Goatse Security notified AT&T of the breach and the security hole was closed.

We were able to establish the authenticity of Goatse Security's data through two people who were listed among the 114,000 names. We sent these people the ICC ID contained in the document—and associated with the person's iPad 3G account—and asked them to verify in an iPad control panel that this was the correct ICC ID. It was.

Victims: Some big names

Then we began poring through the 114,067 entries and were stunned at the names we found. The iPad 3G, released less than two months ago, has clearly been snapped up by an elite array of early adopters.

Within the military, we saw several devices registered to the domain of DARPA, the advanced research division of the Department of Defense, along with the major service branches. To wit: One affected individual was William Eldredge, who "commands the largest operational B-1 [strategic bomber] group <http://www.ellsworth.af.mil/library/biographies/bio.asp?id=12557> in the U.S. Air Force."


In the media and entertainment industries, affected accounts belonged to top executives at the New York Times Company, Dow Jones, Condé Nast, Viacom, Time Warner, News Corporation, HBO and Hearst. In finance, accounts belonged to companies from Goldman Sachs to JP Morgan to Citigroup to Morgan Stanley. Dozens of venture capital and private firms made appearances as well.

<http://cache.gawkerassets.com/assets/images/7/2010/06/ileakinside3.jpg>

In government, affected accounts included a GMail user who appears to be Rahm Emanuel and staffers in the Senate, House of Representatives, Department of Justice, NASA, Department of Homeland Security, FAA, FCC, and National Institute of Health.

Ramifications

There are no doubt other high-profile subscribers caught up in the security lapse, along with ordinary users who now have reason to worry that AT&T might expose more of their iPad data to hackers.

At the very least, AT&T exposed a very large and valuable cache of email addresses, VIP and otherwise. This is going to hurt the telecommunications company's already poor image with iPhone and iPad customers, and complicate its very profitable relationship with Apple. Exacerbating the situation is that AT&T has not yet notified customers of the breach, judging from the subscribers we and the security group contacted, despite being itself notified at least two days ago. It's unclear of AT&T has notified Apple of the breach.

Then there's the question of whether any damage can be done using the ICC IDs. The Goatse Security member who contacted us was concerned that recent holes discovered in the GSM cell phone standard mean that it might be possible to spoof a device on the network or even intercept traffic using the ICC ID. Two other security experts we contacted were less confident in that assessment. Mobile security consultant and Nokia veteran Emmanuel Gadaix told us that while there have been "vulnerabilities in GSM crypto discovered over the years, none of them involve the ICC ID... as far as I know, there are no vulnerability or exploit methods involving the ICC ID."

Another expert, white hat GSM hacker <http://www.enterprisemobiletoday.com/news/article.phpr/3855606/Hacker-Exposes> and University of Virginia computer science PhD Karsten Nohl, told us that while text-message and voice security in mobile phones is weak "data connections are typically well encrypted... the disclosure of the ICC-ID has no direct security consequences."

But that didn't mean he thinks AT&T is off the hook:

It's horrendous how customer data, specifically e-mail addresses, are negligently leaked by a large telco provider.

We suspect many AT&T customers will agree.