You down with UDID? Yeah, you know me… my location and app activities

September 7, 2012 8:00 am Published by Ken Westin

It was announced this week by the hacker group AntiSec that they compromised a laptop belonging to Supervisor Special Agent Christopher K. Stangl from the FBI taking advantage of vulnerability in Java that allowed them to gain access files on his system. The data they claim to have downloaded allegedly holds more than 12 million UDIDs ( Uniqe Device Identifiers) from Apple iOS devices.

Although there is cause for concern, there is no reason to panic… yet. The UDID is a unique number that identifies a given iOS device, a bit like a serial number. Simply having this number alone would not be an issue, as they are fairly anonymous.

However the file in question also maps UDIDs to names, phone numbers, zip codes, addresses in some cases. The UDIDs then are no longer anonymous but linked to their respective owners.

The UDID number has been used/misused by developers over the last few years to identify devices for advertisements, analytics and other purposes. The Internet is chock full of databases that map UDIDs to usernames, activities, location data, game scores, ad clicks as well as Facebook and other social media profiles. Even if you deleted an application from your phone the data can still persist in the Cloud.

So as we see more data breached, sold and shared, data will be mapped to previously anonymous data related to activities, location and app usage. So the damage of the breach consists of the possibility that connections that may not have existed before will be bridged and more robust profiles of targets available.

Categories: Off Topic

---

This post was written by…

Ken Westin has contributed 31 posts to The State of Security.

Twitter @KWestin

Google+ Ken Westin

Contact Ken Westin

Ken is a creative technologist with 13 years experience building and breaking things through the use/misuse of technology. In the past he has been an avid cyber criminologist with a knack for empowering electronic devices to defend themselves from malefactors. His technology exploits have been featured in Forbes, Good Morning America, Dateline, New York Times, The Economist and he has won awards from MIT, CTIA, Oregon Technology Awards, SXSW, Web Visions, Entrepreneur and others.