The hackers who harvested an estimated 114,000 Apple iPad 3Gowner e-mail addresses defended their actions Friday as “ethical” and said they did nothing illegal.
The hacking group Goatse Security obtained the e-mail addresses using an automated PHP script that collected iPad 3G owners’ ICC-ID numbers and associated addresses from AT&T’s servers using a publicly-available feature of the carrier’s Web site
.
Related story
Anti-Spam bill at risk after Parliament suspended
Pharmaceuticals drive February spam
AT&T disabled the feature last Tuesday, a day before the Valleywag Web site first reported the story.
“We believe what we did was ethical,” said Goatse member Escher Auernheimer in a telephone interview today. “What we did was right.”
Goatse waited until AT&T had closed the hole before revealing its findings, said Auernheimer, who defended the release as “responsible disclosure” — the term given to security revelations made public only after a vendor has patched a bug or otherwise prevented a vulnerability. “We followed the disclosure process, which is more than you can say for at least a third of security researchers,” he argued, referring to researchers who post bug details before a patch is available.
“It was in the public interest to have this disclosed,” Auernheimer continued. “If someone had a Safari exploit for the iPad, for example, they could have gotten this information. It was in the public’s and AT&T customers’ interest [for the latter] to be able to mitigate this instantly.”
Rather than contact AT&T directly with what they’d uncovered, Goatse tipped off an unnamed third party, who in turn reported the design flaw to AT&T. Goatse took that route, Auernheimer said, to prevent AT&T from preventing the group from publicizing the e-mail address exposure. “We didn’t want an injunction [from AT&T] that would have kept us from disclosing the data. And we didn’t see the necessity of contacting AT&T directly.”
Goatse contacted several media outlets whose employees showed up on the list of e-mail addresses they’d obtained, including Fox News, Reuters and others. None responded to their messages.
Instead, Goatse contacted Gawker Media, the company that operates ValleyWag and other technology sites and blogs. “We gave the data only to Gawker,” said Auernheimer “They were the only one willing to dedicate resources to [the story].” According to Auernheimer, Gawker assigned several interns to the task of pouring over the list of 114,000 e-mail addresses.
Bloggers who have slammed Goatse over its disclosure are jealous that the group gave Gawker and ValleyWag an exclusive, Auernheimer said. “A majority of the people who have been critical are just upset that we went to Gawker with it,” he added.
Only iPad 3G owners’ ICC-ID numbers and e-mail addresses were obtained from AT&T’s servers, Auernheimer said, confirming what the carrier claimed earlier this week.
Since then, the Federal Bureau of Investigation (FBI) has launched an investigation into the address acquisition. The FBI said it was trying to decide if Goatse violated U.S. laws.
But according to Auernheimer, the agency has not contacted anyone belonging to Goatse. “No, we have had no contact with law enforcement,” he said, adding that he doesn’t believe the group broke the law.
In a blog post earlier today, Auernheimer spelled out Goatse’s case. “All data was gathered from a public webserver with no password, accessible by anyone on the Internet,” he wrote. “There was no breach, intrusion, or penetration, by any means of the word.”
But Auernheimer wasn’t sure that he and the other member of Goatse would not be prosecuted. “Hopefully, we aren’t, but a [prosecutor] can get a grand jury to do anything,” he said.
“We stand by what we did,” Auernheimer said. “We love America and did this in the public interest.”
AT&T declined comment, and referred Computerworld to the statement it issued earlier this week. In that statement, AT&T made no mention of any illegalities, saying only that, “The person or group who discovered this gap did not contact AT&T.”
Apple has not responded to requests for comment on the iPad owner e-mail disclosure.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg’s RSS feed . His e-mail address is [email protected].
Source:Computerworld
