Quick check to see if your UDID was leaked(kimosabe.net)

51 pointsby bbunixvor 14 Jahren29 comments

Quick check to see if your UDID was leaked

http://kimosabe.net/test.html

14 comments

Why don't you allow partial UDID searches? I should be able to type, say, ten digits and see some results. You could also make it so I type the first eight and the last eight characters.

Easier data entry and I don't have to give you my full UDID.

bbunixvor 14 Jahren

There would be no way for you to know if you got matched without possibly disclosing other matches as well...

sp332vor 14 Jahren

The "other matches" are already disclosed, it's too late.

ukjadoonvor 14 Jahren

Could this be another attempt to get more UUIDs? Why should I trust this link?

mgzvor 14 Jahren

If you want to lookup your UDID but afraid to expose it, use partial search at http://pastehtml.com/udid

Groxxvor 14 Jahren

Ah, many thanks, that's a much nicer system. No need to trust anything. Have you considered submitting it?

SnaKeZvor 14 Jahren

What can he do with just a UUID? Really, i don't know...

jared314vor 14 Jahren

They could asked for a hash of the device uuid. That would be safer, but you would still have to visit the site. With that request they could match ip, browser info, and device uuid.

Perhaps, it could be put entirely into javascript.

bbunixvor 14 Jahren

Entering 40 characters is hard enough by itself. Tell the average user to send an MD5 hash over... if you care that much you do what I did initally, download it, unpack it, and grep.

jared314vor 14 Jahren

I was trying to avoid the "Receipt of stolen property" issue, while maintaining personal privacy. Usability was lower on my list of concerns.

bbunixvor 14 Jahren

That's a good point. Gotta trust someone, kimosabe! This is me: http://linkedin.com/in/bbunix, and no I don't want UDIDs.

joebeeteevor 14 Jahren

Thanks for doing this.

ukjadoonvor 14 Jahren

=) Thanks!

Evbnvor 14 Jahren

There are ways to do this securely, like client side hashing, that are worth learning and showing off to make you a better web developer and set a good example for others. Yo have a chance to learn and teach here.

emeidivor 14 Jahren

"Has your password been compromised? Type it here to check. Please also leave me your email message so I can inform you in case the password gets leaked later on."

Seriously ...

_cbdevvor 14 Jahren

You do realize that AntiSec stated they have access to about 12.000.000 UDIDs while leaking only 1.000.001?

Maybe you should note that on your site, so even negative Results don't get too confident in their security

bbunixvor 14 Jahren

Good point, I'll update it now...

sidcoolvor 14 Jahren

Can someone tell me what the AntiSec can do with these UDIDs? I mean they are just phone identifiers, what harm can their exposure cause?

x0xMaximusvor 14 Jahren

If anyone is interested, the top device names sorted by popularity :: http://maxnanis.com/files/apple_udid_top_device_names.txt

vhfvor 14 Jahren

Has someone here found his device in the list ?

If you found yours (I don't say mine since I don't own a single apple device), what do ?

FredericJvor 14 Jahren

If you've been exposed take some time to help us identify who gave this UDID's to the FBI. (Already working with 3 exposed device owners) http://news.ycombinator.com/item?id=4473833

disclosurevor 14 Jahren

Another UDID checklist: http://dazzlepod.com/apple/ Partial UDID search accepted, i.e. search "d565" instead of your full UDID "d56504ca3b268177f76fef0c2c446ba183afd12b"

[deleted]vor 14 Jahren

epovor 14 Jahren

Actually all you need to do is permit people to enter wildcards and print the results if (say) less than 100 matches are found, so they enter 12346789 and you search for 12346789

Nogwatervor 14 Jahren

I had some trouble manually retyping my UDID. It turns out that once you click on the serial number, you can go to Edit->Copy Identifier (UDID).

kevinSuttlevor 14 Jahren

You can also click to show your UDID, leave your mouse where it is, and CMD-C like usual.

shortlivedvor 14 Jahren

Does the leak apply to ipads too?

delinkavor 14 Jahren

Yes. The "article" on pastebin said "iOS devices" and my download of the million-and-one has mentions of lots of iPads.

delinkavor 14 Jahren

This is rather disappointing. After downloading the dump and verifying for myself that We[1] are not on the list, I need a partial match method for the entire list, not just the one-and-a-million released to the public.

[1] "We" - me and the family

sixcornersvor 14 Jahren

You could ask the bad guys. Do the FBI have an email address? Maybe you could get somewhere with a freedom of information request?