Feeds

Man admits writing script that slurped celebrity iPad data

Goatse troll first to fall

SANS - Survey on application security programs

A San Francisco man has admitted writing the code that plucked personal data of 120,000 early iPad adopters from servers AT&T had left wide open to the attack.

Daniel Spitler, 26, pleaded guilty in federal court in New Jersey to one count each of identity theft and conspiracy to gain unauthorized access to internet-connected computers, prosecutors said. A member of the troll and griefer collective known as Goatse Security, he surrendered to authorities in January, when he and alleged accomplice, Andrew Auernheimer, were criminally charged in the hack.

Auernheimer, aka Weev, has pleaded not guilty.

According to prosecutors, Spitler, Auernheimer, and other Goatse members identified a vulnerability on AT&T's servers that mapped an iPad's ICC-ID, or integrated circuit card identifier, to the name and email address of its owner.

Spitler admitted he was the one who wrote the "iPad 3G Account Slurper" script, which exploited the flaw to harvest as much data as possible. It worked by injecting large numbers of possible ICC-IDs into AT&T web addresses and recording the information that was returned each time it successfully guessed a valid number. For the attack to work, Spitler had to make his code mimic characteristics of the iPad.

In all, the attack mined the names and email addresses of about 120,000 elite iPad owners, including senior members of the White House, celebrities, journalists and wealthy financiers. The list also included top people inside some of the nation's most sensitive organizations, including William Eldredge, who commanded the largest strategic bomber group in the US Air Force.

By exposing their names and private email addresses, the vulnerability could have opened the iPad owners up to spear phishing attacks.

AT&T closed the vulnerability only after it was brought to their attention by Gawker, the publication that first reported the attack. The underlying bug, known as an insecure direct object reference, is the same kind of sloppy oversight that led to the recent leak banking data for more than 360,000 customers of Citigroup.

Spitler faces a maximum penalty of five years in federal prison and a $250,000 fine at sentencing, which is scheduled for September 28.

A sentence that stiff is probably overkill, considering there is no public evidence the hackers victimized any of the people whose information was needlessly leaked. (There is evidence some members considered spamming them, however.) Indeed, by bragging of their conquest to the media, they helped make sure AT&T fixed the vulnerability quickly. A more hardened gang of attackers would have been more tight lipped about the theft so the data could be used to mount stealthy attacks.

That doesn't mean Spitler and his alleged accomplices didn't break the law. And any time White House staffers and other powerful people are targeted in a hacking crime, you can be sure there will be consequences.

Members of other hacker collectives, take note. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.