AT&T breach reveals 114,000 iPad owners' email addresses, including some elite customers
By Ross Miller 
posted June 9th 2010 7:15PM
posted June 9th 2010 7:15PM
For its part, AT&T tells AllThingsD that it was informed of the issue on Monday, that only the addresses and associated ICC-IDs were revealed, and that by Tuesday the "feature" that allowed addresses to be seen had been turned off. And as Security Watch's Larry Seltzer cautions in a statement to PC Mag, the impact of this breach -- just email addresses -- is probably somewhat exaggerated. Still, regardless of the magnitude, this can't be making AT&T's day at all bright, and you best believe a number of folks in Cupertino have fire in their eyes over this bad press.
[Thanks to everyone who sent this in]
@gadgetsngoods
FUUUUUUUUUUU
@scorpeo Why, do you miss it? It was just a post. Don't worry, it'll be back when the iPhone 4 is released. Hopefully then there won't be as much vitriol.
@rand0, being it was a polarity and not a majority, the EVO was doing quite well, and gaining in votes. I see engadget is back to censoring. Where are my comments you replied to??
@N900
You've got a private profile...say hi to Josh for me ;)
@Kanga I destroyed it. With my new full armed and operational internet obliterator weapon. Pray I don't destroy you with it
@Kanga
It was unbiased and people said they liked Evo.
Bad image for Apple ya know how it is.
@Lord Vader
I love Lord Vader. But people stop destroying my internets.
@Fez Nice they deleted his comment wtf o_o
Whoops my finger slipped
@seankovacs, exactly, I found it odd that most of the comments favored the EVO, yet the iphone had the lead in polarity.
@Kanga
are we playing musical chairs or are these comments flipping around?
Looks like they deleted your comments too seankovacs.
@Kanga because I'm pretty sure they intended a more unbiased EVO 4G reaction from people leaving comments.. FAR too many Apple detractors & EVO fanboys blasting away. I think I'm being VERY fair by saying that too.
@Tuan X
You can get rid of the comments without getting rid of the article. The article was AWESOME.
@Tuan X
You are being naive not fair. You honestly cannot call that many consecutive comments "fanboy posts".
@Tuan X
You can see very clearly that Engadget is quite capable of deleting comments... /(>. < \ )
Delete the comments, not the article. Easy. I want that article back.
@Kanga What are you talking about? Its on Digg, its on Twitter and both links go to engadget, but no specific article!
I think its just a bug!!!
I'm being optimistic here hehe
@Fez " And as Security Watch's Larry Seltzer cautions in a statement to PC Mag, the impact of this breach -- just email addresses -- is probably somewhat exaggerated."
Larry Seltzer is an idiot if he thinks CEOs and Government officials won't mind getting their inboxes clogged with spam.
@Fez
I swear, Android vs. Apple is worse than politics
Believe me, I am a fandroid and a democrat.
@Kanga The article was fantastic. But being in an editors shoes I can understand why they did that. It's like them realizing, "you know what, I think we did this way too prematurely. let's let the device drop first. give folks a chance to use it & then post a similar article & HOPEFULLY get some unbiased comments." But I just think their are currently WAY too many iPhone detractors on this site right now. Not that some aren't just preferable to the EVO but their are A LOT of people just anti-Apple commenting on posts. It is VERY evident.
@corylulu And his post gets deleted again lol
@Tuan X If they thought like that they could've been more mature about it and posted about why they thought it best to remove the article as well as the comments. They need to keep their readers happy and stop being moody teenagers.
@Fez nuh uh sweetie, engadget ain't the ones being moody teenagers. They didn't say anything, they deleted the article. so what's done is done. some people on the other hand cant let it go as if they got slapped in the face. so they go around spamming other articles because they can't have their way. That sounds more like a moody teenager imo.
@N900
Serves them right for wasting money on a toy.
@Eli Haj Thanks Eli. See there's your article people, you happy?
@Tuan X, that's a bunch of BS, don't try to sugarcoat it, most of us realize what's going on here! The comments clearly favored the EVO, engadget is a blog, not governed by the FCC, they do not have to censor anything.
@Lord Vader Someone force pushed it
@petebob796 Wow Engadget. Can you stoop any lower - what's with the comment and post deleting? Apple running the show there?
@Eli Haj Or why they would delete comments mentioning the other post. If it wasn't clear from the Apple overload the past couple days, it should be pretty clear that Engadget's in bed with Apple. Isn't that what dictators do, control the press?
@scorpeo
re: "that's a bunch of BS, don't try to sugarcoat it, most of us realize what's going on here!"
I'm not realizing what's going on here. In fact, I'm a bit confused as to why that article vanished. Why would Engadget removed an entire revenue-generating article regardless of who was winning the poll or who was dominating the comments section?
I'm sure Evo + iPhone is a massive page hit generator for Engadget at this time. The bulk of site visitors seem to visit iPhone news (as apparently corroborated by Engadget traffic during the iPhone 4 announcement), whereas a good chunk of people who actually bother to comment seem to favor Android news. Removing that article loses both audiences, wouldn't it?
re: "The comments clearly favored the EVO, engadget is a blog, not governed by the FCC, they do not have to censor anything."
Perhaps they were stifling a flamewar instead? I had only gotten down to the first page of comments when the article disappeared, so I never got to see if it all devolved into uninformative vitriol. I never even got to see the poll results, 'cause I didn't cast a vote.
@wrathkind, the comments generated in the censored article, were tame in comparison to previous articles. It appears engadget favors the iphone. Seeing that the comments in the censored article did not favor the iphone, engadget decided to censor it.
@scorpeo
re: "Seeing that the comments in the censored article did not favor the iphone, engadget decided to censor it."
... mm I dunno! :-/ I may be naive about this, but even when comments were shut down following the iPad launch, articles were never actually pulled (although comments and user accounts clearly were excised). As Tuan mentioned, the article was actually pretty good, so deleting it seems a waste.
As others mentioned, maybe it was just premature to compare the existing Evo to the unreleased iPhone? Or, maybe, people were needlessly reporting too many comments as they got more and more riled up. I wonder if Engadget is incapable of locking out further comments without withdrawing the entire article.
@Fragmented
I think that article shifts quite a bit of AT&T's network responsibilities onto Apple. I mean, basically they said that because you need your email address to activate the iPad, Apple is required to secure AT&T's website scripting. To me that sounds like an incredible leap in obligations.
First: "... the web security group exploited vulnerabilities on the AT&T network .... The slip up appears to be AT&T's fault at the moment. .... the security vulnerability was confined to AT&T servers..."
Then: ".... Apple bears responsibility for ensuring the privacy of its users, who must provide the company with their email addresses to activate their iPads. .... Apple has a pronounced responsibility to patrol the network vendors it chooses..."
Even though: "Goatse Security obtained its data through a script on AT&T's website, .... in what was apparently intended to be an AJAX-style response within a Web application. .... To make AT&T's servers respond, the security group merely had to send an iPad-style "User agent" header in their Web request. Such headers identify users' browser types to websites."
While their headline states the breach is Apple's, they also say: "It's unclear if AT&T has notified Apple of the breach."
They then quote someone who says ".... the disclosure of the ICC-ID has no direct security consequences. .... It's horrendous how customer data, specifically e-mail addresses, are negligently leaked by a large telco provider."
I mean, by that article's reasoning, my bank is responsible for ensuring that my ISP isn't compromised during an online banking session. Is that a correct analogy to what the article is saying? Even the comments section of that article criticizes them for fingerpointing.
Oh, never mind. They've since posted a follow-up article clarifying their sensational slant in the article Fragmented linked to. Well, actually, Gizmodo (the tech sub-blog) is providing the update to Gawker (the parent blog, I suppose).
http://gizmodo.com/5559586/should-i-worry-about-the-apple-ipad-%252B-att-security-breach-probably-not
@Kanga At&t is just trying to make a new porduct. ITELL ALL.
@Lord Vader
Long live, Lord Vader!
@Fez
Engad posted an explanation yesterday. They will post it again after they've spent some quality time with the iPhone, and can offer a thorough assessment.
i read the name of the hacker group and smiled
@kdu
It's those immature babies at ebaumsworld.com
@kdu
Maybe Apple could help out AT&T with some more secure OSX servers…..
@kdu
I googled them.
What was seen cannot be unseen.
@kdu
Goatse Security
"Gaping holes exposed."
I lol'd.
@scottkrk hahahaha that was funny wait till the hackers start to actually focus on Apple then we will see how much people will love their MAC then
AT&T can't do ANYTHING right these days! Seriously! Can anyone name ONE THING POSITIVE AT&T has done lately?
@DangerZone23
I really hope this security failure constitutes some sort of breach of contract.
@Fragmented
I missed that part. Did something in the article indicate that this was a failure on Apple's part, or do you just want that to be true?
@Fragmented
maybe, but att is (one of many) Apple problems
@DangerZone23
They gave Luke Wilson a job. That's got to count for something.
@eyerot "through a faked iPad UserAgent, which would then return the associated addresses."
a+faked+ipadilla+useragent...did you miss that part this time around too? Or do you want it to just not exist. Do your eyes defocus and your brain stops processing when you read it? Probably.
Remember why Google Voice is not on the iPhone. According to Apple's FCC finding, one reason is that Apple doesn't believe that Google does a good job protecting user data. Interesting...