Feeds

Man admits writing script that slurped celebrity iPad data

Goatse troll first to fall

Providing a secure and efficient Helpdesk

A San Francisco man has admitted writing the code that plucked personal data of 120,000 early iPad adopters from servers AT&T had left wide open to the attack.

Daniel Spitler, 26, pleaded guilty in federal court in New Jersey to one count each of identity theft and conspiracy to gain unauthorized access to internet-connected computers, prosecutors said. A member of the troll and griefer collective known as Goatse Security, he surrendered to authorities in January, when he and alleged accomplice, Andrew Auernheimer, were criminally charged in the hack.

Auernheimer, aka Weev, has pleaded not guilty.

According to prosecutors, Spitler, Auernheimer, and other Goatse members identified a vulnerability on AT&T's servers that mapped an iPad's ICC-ID, or integrated circuit card identifier, to the name and email address of its owner.

Spitler admitted he was the one who wrote the "iPad 3G Account Slurper" script, which exploited the flaw to harvest as much data as possible. It worked by injecting large numbers of possible ICC-IDs into AT&T web addresses and recording the information that was returned each time it successfully guessed a valid number. For the attack to work, Spitler had to make his code mimic characteristics of the iPad.

In all, the attack mined the names and email addresses of about 120,000 elite iPad owners, including senior members of the White House, celebrities, journalists and wealthy financiers. The list also included top people inside some of the nation's most sensitive organizations, including William Eldredge, who commanded the largest strategic bomber group in the US Air Force.

By exposing their names and private email addresses, the vulnerability could have opened the iPad owners up to spear phishing attacks.

AT&T closed the vulnerability only after it was brought to their attention by Gawker, the publication that first reported the attack. The underlying bug, known as an insecure direct object reference, is the same kind of sloppy oversight that led to the recent leak banking data for more than 360,000 customers of Citigroup.

Spitler faces a maximum penalty of five years in federal prison and a $250,000 fine at sentencing, which is scheduled for September 28.

A sentence that stiff is probably overkill, considering there is no public evidence the hackers victimized any of the people whose information was needlessly leaked. (There is evidence some members considered spamming them, however.) Indeed, by bragging of their conquest to the media, they helped make sure AT&T fixed the vulnerability quickly. A more hardened gang of attackers would have been more tight lipped about the theft so the data could be used to mount stealthy attacks.

That doesn't mean Spitler and his alleged accomplices didn't break the law. And any time White House staffers and other powerful people are targeted in a hacking crime, you can be sure there will be consequences.

Members of other hacker collectives, take note. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.