The Antisec hacking group released one million UDID’s, which are the unique string of numbers that individually identifies each iOS device. These were previously used by developers to track their app installations across Apple’s user base. In total, Antisec claims to have over 12 million of the UDIDs. How were these obtained? From the post from Antisec on pastebin:
During the second week of March 2012, a Dell Vostro notebook, used by Supervisor Special Agent Christopher K. Stangl from FBI Regional Cyber Action Team and New York FBI Office Evidence Response Team was breached using the AtomicReferenceArray vulnerability on Java, during the shell session some files were downloaded from his Desktop folder one of them with the name of “NCFTA_iOS_devices_intel.csv” turned to be a list of 12,367,232 Apple iOS devices including Unique Device Identifiers (UDID), user names, name of device, type of device, Apple Push Notification Service tokens, zipcodes, cellphone numbers, addresses, etc. the personal details fields referring to people appears many times empty leaving the whole list incompleted on many parts. no other file on the same folder makes mention about this list or its purpose.
So while the number of 12 million is not really that large compared to the total number of iOS devices activated, this is only a list pulled from one agent’s laptop. Possibly these were the devices flagged for surveillance for one reason or another, and also possible is that somewhere the FBI has a much more comprehensive list of iOS owners. This is reminiscent of the Carrier IQ flap, where a number of Apple and android devices had the monitoring program installed. How the Apple device’s UDID was acquired is unknown at this time. But it’s looking more and more like George Orwell’s 1984- Big Brother is watching you.
