Feeds

Man admits writing script that slurped celebrity iPad data

Goatse troll first to fall

Reducing security risks from open source software

A San Francisco man has admitted writing the code that plucked personal data of 120,000 early iPad adopters from servers AT&T had left wide open to the attack.

Daniel Spitler, 26, pleaded guilty in federal court in New Jersey to one count each of identity theft and conspiracy to gain unauthorized access to internet-connected computers, prosecutors said. A member of the troll and griefer collective known as Goatse Security, he surrendered to authorities in January, when he and alleged accomplice, Andrew Auernheimer, were criminally charged in the hack.

Auernheimer, aka Weev, has pleaded not guilty.

According to prosecutors, Spitler, Auernheimer, and other Goatse members identified a vulnerability on AT&T's servers that mapped an iPad's ICC-ID, or integrated circuit card identifier, to the name and email address of its owner.

Spitler admitted he was the one who wrote the "iPad 3G Account Slurper" script, which exploited the flaw to harvest as much data as possible. It worked by injecting large numbers of possible ICC-IDs into AT&T web addresses and recording the information that was returned each time it successfully guessed a valid number. For the attack to work, Spitler had to make his code mimic characteristics of the iPad.

In all, the attack mined the names and email addresses of about 120,000 elite iPad owners, including senior members of the White House, celebrities, journalists and wealthy financiers. The list also included top people inside some of the nation's most sensitive organizations, including William Eldredge, who commanded the largest strategic bomber group in the US Air Force.

By exposing their names and private email addresses, the vulnerability could have opened the iPad owners up to spear phishing attacks.

AT&T closed the vulnerability only after it was brought to their attention by Gawker, the publication that first reported the attack. The underlying bug, known as an insecure direct object reference, is the same kind of sloppy oversight that led to the recent leak banking data for more than 360,000 customers of Citigroup.

Spitler faces a maximum penalty of five years in federal prison and a $250,000 fine at sentencing, which is scheduled for September 28.

A sentence that stiff is probably overkill, considering there is no public evidence the hackers victimized any of the people whose information was needlessly leaked. (There is evidence some members considered spamming them, however.) Indeed, by bragging of their conquest to the media, they helped make sure AT&T fixed the vulnerability quickly. A more hardened gang of attackers would have been more tight lipped about the theft so the data could be used to mount stealthy attacks.

That doesn't mean Spitler and his alleged accomplices didn't break the law. And any time White House staffers and other powerful people are targeted in a hacking crime, you can be sure there will be consequences.

Members of other hacker collectives, take note. ®

Mobile application security vulnerability report

More from The Register

next story
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Microsoft: You NEED bad passwords and should re-use them a lot
Dirty QWERTY a perfect P@ssword1 for garbage websites
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
Crooks fling banking Trojan at Japanese smut site fans
Wait - they're doing online banking with an unpatched Windows PC?
NIST told to grow a pair and kick NSA to the curb
Lrn2crypto, oversight panel tells US govt's algorithm bods
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Mobile application security vulnerability report
The alarming realities regarding the sheer number of applications vulnerable to attack, and the most common and easily addressable vulnerability errors.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.