The real source of Apple device IDs leaked by Anonymous last week

It's a reminder how powerful the combination of simple tools and a little reasoning can be.

I once found myself by chance with a customer just as they got smacked with a DDoS attack that they were completely unprepared for.

The security folks threw up their hands claiming that they couldn't do anything to stop the attack due to certain random elements. The executives panicked and everyone started pointing fingers while their site went offline. It was chaos.

I asked to have a look at logs on a hunch that the "random" element wasn't entirely random. One line of awk, grep and uniq later it was revealed that roughly 85% of the attack could be mitigated with a trivial change at the edge.

http://blog.bluetoad.com/2012/09/10/statement-from-bluetoad-...

Another theory on the “FBI” UDID leak

http://news.ycombinator.com/item?id=4484547

http://www.marco.org/2012/09/06/udid-theory

Reading through his analysis, it almost seems that he may have fallen victim to log file pareidolia as he doesn't make it clear how a device named "Hutch" or one named "Paul’s gift to Brad" a anything more than coincidences in a very large data set.

Doing some quick analysis of the file shows that there is a UDID that has the alternate names; "Hutch Hicken" (Bluetoad CTO), "Bluetoad Support" and "Customer Service iPad" among others, but could this also be representative of an older iPad that has been a pass-me down through the company?

Somewhat more interesting and possibly more revealing are the UDIDs 'ffffffffffffffffffffffffffffffffffffffff' (occurring three times) and the small number of records not conforming to the field size and format of other records (UDIDs > 42 characters, no APNS, device/iOS version number as fourth field).

For anyone interested the following ugly and slow one-liner will print out a summary of non-unique UDIDs along with their APNS and names.

  perl -F, -lane '$a{$F[0]}{$F[1]}=$F[2]; END { foreach $k (keys %a) {next unless ~~ keys %{$a{$k}} > 2; print "\nUDID : $k"; foreach $d (keys %{$a{$k}}){print "\t-> $d : $a{$k}{$d}"} } }' data

Then, can we agree to stop using: "Scientists have just..." "Al Qaeda destroyed..." "Economists think that..." "Experts believe..."

Tabloid-level writing at best. This is wrong in so many ways since in each case, you assume: - the group is a consistent entity - the group has no face and all members think alike - your ignorance about how that entity is actually working.

We should never use such expressions - being specific is the right way to write about opinions and facts.

But then we'd have to argue about what the word "hacker" means.

Seriously though, I'm actually quite OK with using "Anonymous" as a collective noun. Granted, it is a less accurate shorthand, but we all know what it means. For those who don't, I'm not sure using "a hacker claiming allegiance with Anonymous" would be any more enlightening. In fact, it may actually reinfornce the mistaken idea that so many in the non-tech media still seem to have, which is that Anonymous is some kind of more or less traditional, hierarchical, online terror organisation.

"An Anonymous", yeah, maybe. Still seems needlessly confusing to the less knowledgeable. But I'm open to being convinced.

You know Anonymous is a group, right?

Maybe you are thinking of anonymous? (lower case "a")

1. Anon breaches laptop, finds UDIDs.

2. Anon tells other anons he got the UDIDs from a laptop.

3. Other anons tell more anons it was a government laptop.

4. Release group writes "FBI laptop" in their pastebin.

(5. ??? --> 6. Profit!)

The heterogeneity and disorder in Anonymous (at least it was like this back in the day) means that the chain from leaker to releaser -- usually passing through several people and IRC channels -- plays out a bit like a game of telephone. This serves to protect the leakers, but it can mess with some of the details.

I don't think it is helpful to make excuses for Anonymous. If you'll allow me to abuse the ethical alignment terms: They appear to be a chaotic neutral, not a chaotic good. I'm not sure it makes much difference if they lied or are incompetent. Especially since there really isn't a specific 'they'.

  diff ours theirs | xargs fbi_arrest_warrent_generator.py

edit: [#] that seems a bit aggressive, but I am not aiming at the parent post here, apologies if it reads badly. I think I mean these guys would make it onto Americas Dumbest Hackers TV special if that were the case.

Of course, this brings up the question of why Blue Toad should have Personally Identifying Information about its customers' customers.

much of the argument against anonymous seems to rest on the march date. from the article:

  The discovery of the theft casts serious doubt on Anonymous’ claims that the data 
  came from the FBI, and was pilfered in March.

  "Timing-wise, (their) story doesn't make sense," he [the CIO] said.

  While searching, I stumbled on a partial password dump for the company! And it was 
  dated March 14, the same week that the hackers claimed they’d hacked into the FBI 
  computer. Suddenly, I felt a lot more confident again, and I mentioned this 
  connection in the email.

  He [the CIO] didn’t think the March leak (which they’d already been aware of) was 
  related, but that the rest of my findings were concerning.

again from the blog:

  I’m still not completely clear on all the technical details.

My original theory was that some ad service provider, analytics company, or app developer was working with the FBI on an investigation/attack and overzealously shared their customer's details (bad, bad--also horrific the amount of personal data collected, if Antisec's description of the original data set is true); but it could also follow that they were breached, hackers were circulating their database dump, and it was part of evidence in their investigation.

It sure looks like Anonymous lied. But they could still be telling the truth, if an FBI agent just happened to have Blue Toad's UDID list on his laptop. Which frankly doesn't sound as far fetched as alien overlords.