
A digital publishing company named BlueToad has come forward to take responsibility for the leak of a million iOS unique device identifiers (UDIDs) that were previously attributed to an alleged FBI laptop hack. In a number of interviews published Monday, BlueToad apologized to the public for the incident, explaining that hackers had broken into the company’s systems in order to steal the file. The company says, however, that it had “nowhere near” the alleged 12 million UDIDs that hacking group AntiSec claims to have in its possession.
According to BlueToad, the company was able to match its own data against the list released by AntiSec last week which, according to an interview with NBC, showed a 98 percent correlation. “As soon as we found out we were involved and victimized, we approached the appropriate law enforcement officials, and we began to take steps to come forward, clear the record and take responsibility for this,” DeHart told NBC. “I had no idea the impact this would ultimately cause. We’re pretty apologetic to the people who relied on us to keep this information secure.”
AntiSec claimed last week that it had successfully hacked into an FBI-owned laptop and obtained a list of 12 million UDIDs. The group alleged these were being collected by the FBI for unknown reasons. AntiSec then released the first million of those UDIDs publicly, with the promise that there were plenty more where those came from. Numerous users were able to find their UDIDs on the listincluding some journalists and security researchersbut there was skepticism from the beginning that the FBI was actually involved. The FBI itself issued a statement saying it had no evidence of such data collection or a hack. Apple soon followed with its own statement saying the FBI had not requested UDIDs from Apple, and even if it had, Apple would not have handed them over.
As such, it was widely suspected that the list in fact came from a social network of some kind, or some other app that collects user data. As we wrote in our Ask Ars on the topic, the UDID itself is just a string of characters that uniquely identifies a particular iPhone, iPad, or iPod touchpractically every developer that offers apps on the App Store has a list of UDIDs somewhere, and the UDID alone cannot reveal much about you. But many app-makers did collect some personally identifiable information from userssuch as names, phone numbers, addresses, and other dataand associated it with their UDIDs. As such, it is possible to de-anonymize a UDID and associate it with other information floating around on the Internet.
Read also:
App Store app publishing company comes forward as source of leaked Apple … (9 to 5 Mac)
Red-Faced Blue Toad Says It's the Source of Leaked Apple UDIDs (All Things Digital)
Blue Toad Publishing Company Admits Stolen 'FBI' UDIDs Came From Them (Mac Rumors)
Explore: 88 additional articles.