FBI Says Laptop Wasn't Hacked; Never Possessed File of Apple Device IDs(wired.com)
wired.com
FBI Says Laptop Wasn't Hacked; Never Possessed File of Apple Device IDs
http://www.wired.com/threatlevel/2012/09/fbi-says-laptop-wasnt-hacked-never-possessed-file-of-apple-device-ids
16 comments
Well the last time (June 2010) #AntiSec released UUIDs of Apple devices - Weev went to jail. [1,2]
The '#FuckFBIFriday' releases have shown the incompetence of the FBI in this realm. So I wouldn't be so quick to side with the FBI...
[1] http://en.wikipedia.org/wiki/Weev
[2] http://freeweev.info/
The '#FuckFBIFriday' releases have shown the incompetence of the FBI in this realm. So I wouldn't be so quick to side with the FBI...
[1] http://en.wikipedia.org/wiki/Weev
[2] http://freeweev.info/
I wouldn't be inclined to trust anything the FBI has to say on this, not because I have my tinfoil hat on, but within the context of the allegation they are an unreliable witness, so to speak.
The question is, are these UDIDs real? If so, then where did AntiSec get them from if not a compromised FBI laptop? If they'd hacked Apple or a carrier, surely they'd be quite as happy to crow about that as anything else.
I can understand the idea of pinning the leak on the FBI, I'm just unsure as to how plausible that is. They and their contractors have shown themselves leaky enough to not need any fabrication of evidence in the pursuit of lulz.
The question is, are these UDIDs real? If so, then where did AntiSec get them from if not a compromised FBI laptop? If they'd hacked Apple or a carrier, surely they'd be quite as happy to crow about that as anything else.
I can understand the idea of pinning the leak on the FBI, I'm just unsure as to how plausible that is. They and their contractors have shown themselves leaky enough to not need any fabrication of evidence in the pursuit of lulz.
We checked our app's push notification token database against the leaked list, and there are intersections (who we then notified). So I'm inclined to believe that the list is genuine.
However, the story as to how they got released and from where is anyone's guess at this point.
However, the story as to how they got released and from where is anyone's guess at this point.
I made a word cloud of the leaked device names:
http://i.imgur.com/k6Cfb.jpg
I had to remove the words: iphone, ipad, ipod and DE as they overwhelmed the display.
http://i.imgur.com/k6Cfb.jpg
I had to remove the words: iphone, ipad, ipod and DE as they overwhelmed the display.
The "van" is striking; it's the Dutch version of the German "von". The fact that the former is larger than the latter indicates that the list contains more Dutch UDIDs than German, interesting.
Not necessarily, because "van" is much more common in Dutch names than "von" is in German names. (One reason for this is that "von" used to be restricted to German nobility, while there was no such restriction for "van", and as a result "von" is still relatively rare in German names.)
Additionally, "van" and "von" are possessive pronouns in Dutch and German respectively, which might explain why they are used (e.g. "iPod van Mike" means "Mike's iPod" — the owner may still be Dutch but "van" is not part of his name). Again I think this is relatively less common in German, where the genitive case could be used instead.
Additionally, "van" and "von" are possessive pronouns in Dutch and German respectively, which might explain why they are used (e.g. "iPod van Mike" means "Mike's iPod" — the owner may still be Dutch but "van" is not part of his name). Again I think this is relatively less common in German, where the genitive case could be used instead.
The frequency of van/von as part of last names is irrelevant because this is mostly about first names plus possessive markers. Dutch has genitive case on names as well (name + s), so I don't see why 'von' should be less frequent than 'van'.
Reply from Jebus (who has been hellbanned):
Would you mind sharing the library used to generate that cloud? It looks awesomeSorry I didn't respond earlier. I walked away after posting that and didn't get back to hacker news.
I used the java IBM word cloud generator:
http://www.softpedia.com/progDownload/IBM-Word-Cloud-Generat...
I couldn't find the exact project page. I used this as there were too many words to upload to wordle.
I used the java IBM word cloud generator:
http://www.softpedia.com/progDownload/IBM-Word-Cloud-Generat...
I couldn't find the exact project page. I used this as there were too many words to upload to wordle.
How does that hellban thing work? I wasn't notified, and that's a pity because I think I have made some valuable comments, and now I realize no one was able to read them? And probably will never try to contribute again since it's a waste of time and is not appreciated.
What was your earlier account? I can check if the comments or submissions are viewable.
Jebus
Have you noticed the number of "steve jobs" in these device names ? :p
Ha! I find myself almost disappointed mine isn't in there.
Total curiosity, as I'm in a vaguely similar situation: how did you choose to notify these people, and what did you tell them?
I couldn't find mine on the list, but I assume if a good number of people do then we can assume they're real.
My first suspicion was that they're faked with generic names attached just to get some press coverage.
My first suspicion was that they're faked with generic names attached just to get some press coverage.
Not to say the FBI didn't get hacked, but the filename "NCFTA_iOS_devices_intel.csv" is very strange to me.
It's almost exactly what I would pick if I were making up a filename to incriminate the FBI/NCFTA. However, it seem's much too long for a usual filename. Especially the "intel" part: if you work for the FBI, everything about your job is intel. Why would you put it in the filename?
It's almost exactly what I would pick if I were making up a filename to incriminate the FBI/NCFTA. However, it seem's much too long for a usual filename. Especially the "intel" part: if you work for the FBI, everything about your job is intel. Why would you put it in the filename?
Because putting "topsecret" in the file name seems even more childish? It's an interesting double tap kind of announcement, hacking an FBI lapper seems like a pretty big win in and of itself, because he had java in his browser and went to a contaminated website... All very topical stuff.
If you were disgruntled and made off with that kind of data from a carrier or Apple or perhaps even an app vendor, how would you put it out to screw them?
Clearly the data is real. It leaked out from somewhere. I think some other aspects around it are just window dressing though.
If you were disgruntled and made off with that kind of data from a carrier or Apple or perhaps even an app vendor, how would you put it out to screw them?
Clearly the data is real. It leaked out from somewhere. I think some other aspects around it are just window dressing though.
For some reason I originally interpreted it as being a reference to Intel the chip manufacturer, but in retrospect that wouldn't make a lot of sense.
There's just not enough information contained in the filename to be able to suggest anything.
People have different naming conventions. Maybe Christopher likes his filenames to be precise. Who knows.
People have different naming conventions. Maybe Christopher likes his filenames to be precise. Who knows.
When I read that, I thought "intel" referred to the company, rather than being short for "intelligence." Then again, it's not capitalized, so maybe I'm mistaken.
One other comment has me thinking, though. If it's fake, can you go to jail for just pretending to hack the FBI if they never really did it?
One other comment has me thinking, though. If it's fake, can you go to jail for just pretending to hack the FBI if they never really did it?
Should also have had spaces not underscores. Regular Windows users don't follow *nix naming conventions.
Sure they do, if they've been using computers since the DOS days.
You clearly don't hang out with a lot of old Windows users. its all 8LETTERS.txt or "Lots of Letters & stuff.doc" but never, ever conforms to a consistent convention. I'm pretty sure an exuberant Anon declared this was "intel".
And perhaps because of that, they are still using computers the DOS ways.
Source FBI statement:
http://www.fbi.gov/news/pressrel/press-releases/statement-on...
There's just too much wiggle room in that statement for it to inspire any confidence.
There's just too much wiggle room in that statement for it to inspire any confidence.
"The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time, there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data."
> At this time, there is no evidence indicating that an FBI laptop was compromised
Yes, there is. It's on pastebin.
They need to say why the evidence is false.
Yes, there is. It's on pastebin.
They need to say why the evidence is false.
We currently only have it on AntiSec's word that the information came from an FBI laptop, so technically their statement is true.
According to this blog, several organizations aggregate said information[1] so it's possible that one of them was hacked. I wouldn't expect AntiSec to frame the FBI, but then again they're not exactly buddy-buddy.
[1]http://corte.si/posts/security/apple-udid-survey/index.html
According to this blog, several organizations aggregate said information[1] so it's possible that one of them was hacked. I wouldn't expect AntiSec to frame the FBI, but then again they're not exactly buddy-buddy.
[1]http://corte.si/posts/security/apple-udid-survey/index.html
No, there isn't. The pastebin info "says" it was a compromised laptop. You or I have no idea if that is true or not.
Evidence is just stuff. It's not some magic object sprinkled with truth and certainty pixie dust.
The connection between a given explanation and any evidence is a probabilistic inference (Bayes Rule actually). You always have to weigh the likelihood of the evidence occurring due to other reasons, be it accident or fraud.
Considering that a number of folks with large UDID lists have stated they've found intersections, it seems the data itself is the real deal.
The only thing that's left is to debate the likelyhood of how they got it.
At the moment the burden is on the FBI. It'll take time to find the truth. Even if the FBI release was written in good faith, they're a large organization, and it takes time to figure out what's going on.
The connection between a given explanation and any evidence is a probabilistic inference (Bayes Rule actually). You always have to weigh the likelihood of the evidence occurring due to other reasons, be it accident or fraud.
Considering that a number of folks with large UDID lists have stated they've found intersections, it seems the data itself is the real deal.
The only thing that's left is to debate the likelyhood of how they got it.
At the moment the burden is on the FBI. It'll take time to find the truth. Even if the FBI release was written in good faith, they're a large organization, and it takes time to figure out what's going on.
Yes, also if someone leaks 1 million people's private data onto the internet I'd think it would be FBI's responsibility to investigate how that happened.
Considering the FBI's anti-American history, they don't deserve the benefit of doubt.
If it really is from a compromised FBI laptop, you can assume they nabbed more than just this one file. All they would need to do is release another file that would be much harder to deny as "evidence."
The thing that really makes me wonder is why not come out and say that a) they do/do not an agent named Christopher Stangl and b) If they do, that his equipment is secure.
Because they do, and it isn't.
Agent Christopher K Stangl:
http://www.facebook.com/video/video.php?v=512364171294
http://www.facebook.com/video/video.php?v=512364171294
The fact that the agent's name and position are already publicly available might suggest that AntiSec simply used his name to appear more credible.
Or they targeted him because he was publicly known.
Or they targeted him because he was publicly known.
Yes, I know, saw his LinkedIn profile too. Not that either of those could be faked but lets not go there. I was agreeing with the comment that this denial was a very weak statement from the FBI. There were specific facts in the accusation which the FBI chose not to directly contradict, which I found somewhat odd on their part. That doesn't help the FBI convince me that they weren't caught with their floppy out if you know what I mean.
As I've learned from the TV show "The Newsroom," ask the follow-up! Have they looked for evidence? Could the data have been on an FBI agent's personal laptop rather than an "FBI laptop?" Do they consider data in the class of Apple UDIDs to be "private?"
I'm certainly more inclined to believe them over the kids who posted the file. AntiSec could be deliberately misleading people (for the lulz, I suppose), or perhaps just simply didn't understand what they were looking at and what it meant.
Though, of course, it wouldn't be the first time in recent memory that the FBI flatly denied a damaging fact.
Though, of course, it wouldn't be the first time in recent memory that the FBI flatly denied a damaging fact.
I'm not. I find it far more likely that the FBI doesn't know they've been hacked yet. It takes time for institutions that large to figure stuff out.
And yet they flatly deny it instead of say they're investigating or they're not sure.
That takes some hubris. And that's a trait that has gotten more than one organization owned by Anonymous/*sec in the past.
That takes some hubris. And that's a trait that has gotten more than one organization owned by Anonymous/*sec in the past.
And yet they flatly deny it instead of say they're investigating or they're not sure.
They don't deny it. They say that "At this time there is no evidence indicating that an FBI laptop was compromised". That's different. The evidence is just not here at this time.
They don't deny it. They say that "At this time there is no evidence indicating that an FBI laptop was compromised". That's different. The evidence is just not here at this time.
> That takes some hubris. And that's a trait that has gotten more than one organization owned by Anonymous/*sec in the past.
That would require acknowledging them as a real threat. I don't think the government is really there yet. They seem to perpetuate the opinion of the parent post:
> the kids who posted the file.
Note the usage of 'kids'.
That would require acknowledging them as a real threat. I don't think the government is really there yet. They seem to perpetuate the opinion of the parent post:
> the kids who posted the file.
Note the usage of 'kids'.
> Note the usage of 'kids'.
That's probably true. The whole thing smacks of grasping for straws. It's just spreading FUD. UDID data has been flying around WiFi hotspots and in plaintext over networks for years. Harvesting them is like harvesting names and addresses from postcards. I wouldn't put it past people to aggregate a bunch of them, then pin it on some well known government agency to pull a publicity stunt like this.
The first people to fail to protect the privacy of app users: iOS app developers and the folks at Apple who wrote that part of the SDK. (Who should've known the result of counting on hordes of hobbyist devs to "do the right thing" with the UDID.)
That's probably true. The whole thing smacks of grasping for straws. It's just spreading FUD. UDID data has been flying around WiFi hotspots and in plaintext over networks for years. Harvesting them is like harvesting names and addresses from postcards. I wouldn't put it past people to aggregate a bunch of them, then pin it on some well known government agency to pull a publicity stunt like this.
The first people to fail to protect the privacy of app users: iOS app developers and the folks at Apple who wrote that part of the SDK. (Who should've known the result of counting on hordes of hobbyist devs to "do the right thing" with the UDID.)
Given the weasely non-denial denial, it's probably safer to assume the FBI is the source. If they were sure it couldn't come back to them why would they leave room to mea culpa?
"there is no evidence indicating that an FBI laptop was compromised"
If their security really is as bad as AntiSec claims, this would make perfect sense.
If their security really is as bad as AntiSec claims, this would make perfect sense.
While you can read that claim as being "we are too clueless/dumb to even realize we were hacked" an equally valid explanation is that they know that they either do not have the dataset being distributed, have sufficient canaries in said datasets that they know which ones come from them (for finding leaks, etc), and/or know that no one person has access to a broad non-targetted list with this info.
or they may know that there's no agent with the name/job description specified, or they may know the true origin of the information in question. There are a lot of ways the FBI could be sure the information didn't come from them.
> There are a lot of ways the FBI could be sure the information didn't come from them.
And far more ways that they couldn't be sure.
And far more ways that they couldn't be sure.
I find it most interesting that Apple hasn't mentioned a word as to this leak at all. The FBI has denied, NCFTA has refused to comment, but why hasn't anyone asked Apple as to their comments? This much data floating around had to have come from someone with lots of info, and if it isn't apple, then who?
Apple has historically kept quiet while news media roils around, I wouldn't expect a direct response from Apple unless this gets even louder.
And more charitably, if there's a federal investigation going on in response to this, they may be restricted in what information they can volunteer.
And I don't quite know what they could do: everyone knows UDIDs aren't the greatest idea in the world now, which is why they've already been deprecated and will be replaced by application specific tokens in the future.
Their Twitter statement, "TOTALLY FALSE", contradicts their much more vague official statement "At this time, there is no evidence indicating ..."
All we have is a claim, and a disclaim - both being equal likely to be false.
What is left to do is find out the original source. was it apple (can 12 million devices really be all devices from date X?), a carrier (is 12 million apple customers reasonable), or is it from an app?
What is left to do is find out the original source. was it apple (can 12 million devices really be all devices from date X?), a carrier (is 12 million apple customers reasonable), or is it from an app?
Read the statement carefully:
“The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.”
it doesn't actually deny that the laptop was compromised, or that the FBI asked for and received the data - it just say "at this time there is no evidence" of that.
The twitter statement "Statement soon on reports that one of our laptops with personal info was hacked. We never had info in question. Bottom Line: TOTALLY FALSE" is a lot clearer.
I wonder why they had to move from "TOTALLY FALSE" to "at this time we have no evidence."
There's also a lot of wiggle room there for them to say that the laptop was not an FBI laptop (perhaps it belonged to the NCFTA), or that the NCFTA requested/received the information from Apple, not the FBI.
The FBI may not be lying, but they're awfully good at telling the truth very carefully.
“The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.”
it doesn't actually deny that the laptop was compromised, or that the FBI asked for and received the data - it just say "at this time there is no evidence" of that.
The twitter statement "Statement soon on reports that one of our laptops with personal info was hacked. We never had info in question. Bottom Line: TOTALLY FALSE" is a lot clearer.
I wonder why they had to move from "TOTALLY FALSE" to "at this time we have no evidence."
There's also a lot of wiggle room there for them to say that the laptop was not an FBI laptop (perhaps it belonged to the NCFTA), or that the NCFTA requested/received the information from Apple, not the FBI.
The FBI may not be lying, but they're awfully good at telling the truth very carefully.
The kind folks at thenextweb have a set up a CGI script running against queries against the csv file and are encouraging people to submit their device ID's to "see if they're one the list".
Isn't this the same as when in the aftermath of massive password leaks, people set up websites where you can "check and see if your password was leaked"? What am I missing here?
Isn't the whole point is not to share the device ID or password with anyone? Why should someone send their device ID to thenextweb? What will they do with it?
Q: "Here's my password/device ID. Can you tell me if it's leaked?" A: "It is now."
Isn't this the same as when in the aftermath of massive password leaks, people set up websites where you can "check and see if your password was leaked"? What am I missing here?
Isn't the whole point is not to share the device ID or password with anyone? Why should someone send their device ID to thenextweb? What will they do with it?
Q: "Here's my password/device ID. Can you tell me if it's leaked?" A: "It is now."
It's well known that the FBI's IT infrastructure is an unparalleled disaster and its agents are tragically unskilled when it comes to technology, even the ones tasked with technology related investigations.
Therefore, there's no reason to believe the FBI even knows if they had that data, if they had stored that data on a particular laptop, or if their laptop had been compromised.
Therefore, there's no reason to believe the FBI even knows if they had that data, if they had stored that data on a particular laptop, or if their laptop had been compromised.
I've been fetching results from the openfeint api for a bunch of the UDID's. I'm not sure, but it may be significant that so many of the UDIDs get a result from the API. Shouldn't openfeint only know about the UDID if the user has played some game in their network? And wouldn't we expect that to be a distinct minority of the total population of all ipad/iphone owners?
In their shoes that's exactly what I would say. I would give as little information for as long as I could.
What else are we expecting them to say? That the data belongs to people being investigated for X or Y? The phone of the special agent? The bar where he was drinking when the laptop got compromised? "Oops, we messed up"?
What else are we expecting them to say? That the data belongs to people being investigated for X or Y? The phone of the special agent? The bar where he was drinking when the laptop got compromised? "Oops, we messed up"?
"Bureau of Paranormal Activity Research?! Are you kidding? There is no such a thing!", said Director.
Nobody really thought the FBI would admit to being hacked, right?
While there is no evidence that they did get hacked, they are incompetent enough that I find it very plausible.
While there is no evidence that they did get hacked, they are incompetent enough that I find it very plausible.
At this point I'm not inclined to believe the FBI any more than AntiSec ... Maybe less. (typed on an iPad that's not on the list)
> (typed on an iPad that's not on the list)
list is only 1/12th of the original file,
But don't worry, more than 200 million iOS devices are out there. 12 million is only 6% of the key-space so, you're probably not in the original dump that's in the hands of "anonymous".
list is only 1/12th of the original file,
But don't worry, more than 200 million iOS devices are out there. 12 million is only 6% of the key-space so, you're probably not in the original dump that's in the hands of "anonymous".
If the Antisec account is accurate (that they popped this agent's computer), then they most likely possess further evidence that they could release to corroborate their claim (The .csv file may have been the only interesting file, but presumably they copied off lots of uninteresting ones as well).
So if the FBI is lying, they have to assume that Antisec's next move would be to release more corroborating evidence (because who wouldn't be upset over being called a liar), which would then make the FBI look incredibly foolish (as well as now on record as having given false statements).
This leads me to believe that the FBI is telling the truth, and that Antisec obtained the list from somewhere else, and is just having a laugh at the FBI's expense.
Sadly, I don't think either of these groups have built up an immunity to Iocane powder.