Should I be worried?
As far as your email address being leaked?net effect: spam!?this isn't anything to lose sleep over. And the ICC-IDs, well, they probably
aren't of much use to hackers either?though it might be possible to plug the ICC-ID into a
SIM cloner. (We've reached out to a security researcher for clarification.)
But to play down this leak due to the relatively harmless nature of the exposed data is to miss the point: A thing that customers had assumed to be private, and entrusted to AT&T, was inadvertently made public. The worry here is less about your email address and ICC-ID than it is about a company that has all kinds of your personal data?your SS#, billing information and the like?can't seem to keep its data safe.
Any lessons? What can I do to safeguard against this?
It's a good policy to use a secondary email address when possible. A lot of the people on Ryan's list used their work email addresses?some from within the upper echelons of government and industry?which is generally a
bad idea. But again, this leak isn't so much about the exposed email addresses as it is about data security in general, so the only lesson you could really glean from this is to trust no one, which isn't very useful at all, ha ha! Ugh. [
Gawker]http://gizmodo.com/5559686/the-little-feature-that-led-to-atts-ipad-security-breach
Turns out, it's from a tiny convenience feature you probably never noticed. When you sign up for 3G service on iPad, AT&T looks at the SIM serial number, which Amoroso says "is not a secret, like the serial number on the dishwasher," and asks for an email address you'd like to be contacted at. When you access the AT&T website to check your data account from your iPad (Settings -> Cellular Data -> View Account), it pre-populates your email address using the ICC-ID, so you don't have to type the email address every single time, but just your password. That's the feature Goatse exploited, using a script that Amoroso describes as a "brute force attack," trying ICC-IDs as part of an HTTP request until they gave up an email address. And it's why the damage really does appear to be limited to iPads' ICC-IDs and the email addresses associated with them. How many accounts were exposed, precisely, is still an open question, since AT&T is "doing the forensics as we speak"
...
AT&T has already turned off the feature. If you to go your iPad's 3G account settings, you'll notice your email is no longer already completed, so you have to type the whole thing out. I hope you don't have a terribly long email address.
What about the future, though? Could it happen again? Well, Amoroso says "as we innovate on the provisioning process, reinventing the way we provision service, there will be growing problems," and "you can probably think of a lot of features because the community went through some sort of security issue that requried some hardening." So: maybe. It's the classic tradeoff between convenience and privacy.
The entire episode is a bit ironic in the context of a talk AT&T CEO Randall Stephenson gave at an IBM conference yesterday that was focused heavily on privacy and security: "If you lose the customers' confidence once on a privacy...it would be a hard issue to recover from." I guess we'll see.
