Feeds

Man admits writing script that slurped celebrity iPad data

Goatse troll first to fall

Build a business case: developing custom apps

A San Francisco man has admitted writing the code that plucked personal data of 120,000 early iPad adopters from servers AT&T had left wide open to the attack.

Daniel Spitler, 26, pleaded guilty in federal court in New Jersey to one count each of identity theft and conspiracy to gain unauthorized access to internet-connected computers, prosecutors said. A member of the troll and griefer collective known as Goatse Security, he surrendered to authorities in January, when he and alleged accomplice, Andrew Auernheimer, were criminally charged in the hack.

Auernheimer, aka Weev, has pleaded not guilty.

According to prosecutors, Spitler, Auernheimer, and other Goatse members identified a vulnerability on AT&T's servers that mapped an iPad's ICC-ID, or integrated circuit card identifier, to the name and email address of its owner.

Spitler admitted he was the one who wrote the "iPad 3G Account Slurper" script, which exploited the flaw to harvest as much data as possible. It worked by injecting large numbers of possible ICC-IDs into AT&T web addresses and recording the information that was returned each time it successfully guessed a valid number. For the attack to work, Spitler had to make his code mimic characteristics of the iPad.

In all, the attack mined the names and email addresses of about 120,000 elite iPad owners, including senior members of the White House, celebrities, journalists and wealthy financiers. The list also included top people inside some of the nation's most sensitive organizations, including William Eldredge, who commanded the largest strategic bomber group in the US Air Force.

By exposing their names and private email addresses, the vulnerability could have opened the iPad owners up to spear phishing attacks.

AT&T closed the vulnerability only after it was brought to their attention by Gawker, the publication that first reported the attack. The underlying bug, known as an insecure direct object reference, is the same kind of sloppy oversight that led to the recent leak banking data for more than 360,000 customers of Citigroup.

Spitler faces a maximum penalty of five years in federal prison and a $250,000 fine at sentencing, which is scheduled for September 28.

A sentence that stiff is probably overkill, considering there is no public evidence the hackers victimized any of the people whose information was needlessly leaked. (There is evidence some members considered spamming them, however.) Indeed, by bragging of their conquest to the media, they helped make sure AT&T fixed the vulnerability quickly. A more hardened gang of attackers would have been more tight lipped about the theft so the data could be used to mount stealthy attacks.

That doesn't mean Spitler and his alleged accomplices didn't break the law. And any time White House staffers and other powerful people are targeted in a hacking crime, you can be sure there will be consequences.

Members of other hacker collectives, take note. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?