Skip to Content

MobileMe mixup: Address book snafu exposes personal data to strangers?

These contacts, along with their notes, their phone numbers, dates of birth, and other information say a lot about the person whose address book this is, and also about the people who appear in that contact list, with all their personal and professional info.

There's one big problem. The screen shot you see wasn't made by the person who owns this me.com account. Under certain very specific conditions, Apple is inadvertently sharing data from other people's accounts. Ouch.

A TUAW reader sent us a video made as he renewed his me.com account from the UK. The address book data he accessed during that time included this Denver-based set shown here, as well as data from an Ireland-based user of Polish descent (all his contacts were back in Poland although his business was based in Ireland).

This all went down during the period when his MobileMe account was renewing. Each time he logged off and back on, he was presented with yet another set of contacts--none of them his. He writes, "Each time I logged off and on I got a different address book. All the other options were disabled (because my renewal was being processed) but clicking the Contacts icon showed me *an* address book," just not his address book.

With a little Internet-fu, he checked out some of the numbers and found that they were valid and operational. This leads him to believe that this is real data. My inspection of the local Denver data from his screen shots convinces me of the same. Further inspection of work addresses and personal family names makes us believe we know whose Denver-based address book this is. We've attempted to contact this person but as yet have not heard back.

The address book glitch ended once the registration process finished, leaving our TUAW reader with a series of screen shots and videos and a deep concern about Apple's ability to safeguard personal data. He's already contacted Apple about the bug. "I contacted them by two means: their web-chat thing where they told me that they 'had no reports of such an issue'. They suggested closing and reopening Safari (helpful eh?) and a generic autoresponse saying they'd reply within 5 days when i sent an email." He adds, "I don't think the people manning the help desk appreciated the seriousness of the situation."

TUAW has sent a heads-up to Apple and will keep monitoring the situation to see how it develops.

Categories

Bad Apple Security Mac MobileMe

These contacts, along with their notes, their phone numbers, dates of birth, and other information say a lot about the person whose...
 

Add a Comment

*0 / 3000 Character Maximum

37 Comments

Filter by:
elliot

Have there been any updates on this?

October 22 2009 at 12:04 PM Report abuse rate up rate down Reply
Scott F.

I was seeing this problem on my expired account the other day too, but it's not happening any more. Looks like Apple heard your crys and fixed whatever was the problem.
For wat its worth, I have had really good luck with MobileMe. I really love that all my contacts stay synced up between my 4 computers and iPhone. Sure I back up my contacts manually every week or so and I have time machine running on my home computer, but you would be stupid to not take care of your own data and expect Apple, Google, Yahoo, or anyone else to do a better job. It says right in the terms of service for MobileMe that they don't promise to not lose your data. And for 27 cents a day,*I* still think it's worth it and I am going to update my credit card info and renew.
just my 2 cents.

October 14 2009 at 11:59 AM Report abuse rate up rate down Reply
zhell

Next time, before making it public, email a short and to the point description of the problem, along with screenshots, to product-security@apple.com

Add this at the top:

I will not disclose this information further until 10PM UTC, October 16, 2009.

Should you not have responded to me by this time, I will share this information with other experts in the field, appropriate mailing lists, and potentially the press.

The people reading this address will respond within a few hours. Encrypt your message using their PGP key for added value, but it's not necessary (I usually do not encrypt my messages).

October 14 2009 at 8:53 AM Report abuse rate up rate down Reply
Maria

I'm glad you made this public. I'm sure the additional exposure you give this issue will help light a fire under Apple's butt to get the problem fixed.

October 13 2009 at 11:56 AM Report abuse rate up rate down Reply
Shunnabunich

They haven't discontinued MobileMe...why, again?

October 13 2009 at 10:49 AM Report abuse rate up rate down Reply
jennyp

I think this article and the above responses are uncovering the simple truth that MobileMe is completely unsafe as well as riddled with bugs.

I find it incredible that a company like Apple can't be bothered to put the necessary resources into making MobileMe a satisfactory service. Surely they are capable of doing so? It just ruins their reputation.

Um.. the exploding breasts are pretty alarming too ;)

October 13 2009 at 10:25 AM Report abuse rate up rate down Reply
Joey

last week I lost all the content of my public folder in iDisk and it was replaced with pictures and music of someone else. I online chatted with the help desk to resolve it, and they claimed it was not a problem on their end, but that someone must have mistakenly thought it was their account and manually did all this one file at a time through the browser. I didn't buy that, as there were many folders and files that no one would upload, like iTunes XML files and such. Clearly somehow iDisk paths and permissions got messed up. I thought nothing of it until I started reading about all these other mix ups. I love MobileMe when it works, but not at the risk of data loss and exposure. They've got one year to fix it before I have to renew.

October 13 2009 at 10:14 AM Report abuse rate up rate down Reply
young_98_98

This also happened to me. While renewing my wifes account we were able to access another random users data. However we were able to get tech support on the phone and they resolved.

October 13 2009 at 9:49 AM Report abuse rate up rate down Reply
Handy zubehor

I do, I figure that if you're not using them for what they were designed for (nursing infants) then you don't need them and shouldn't be inflating them for no reason. Like an overinflated tire they will pop similarly. Do you want to be the unsuspecting victim of an exploding Breast. Lose an eye just once and you'll appreciate what I'm telling you. Heed my warning, Don't look at em too closely, it could be your last look ever.
sd karte


October 13 2009 at 8:47 AM Report abuse rate up rate down Reply
3 replies to Handy zubehor's comment
stephen

Shakes head sadly - whoever is running MM needs to get canned if this is a legit bug. Apple needs to get over their market arrogance on this issue and admit they are craptastic at trying to run an enterprise level web service. They are going to lose major consumer confidence if they don't plug this hole fast and make amends to their user base.

October 13 2009 at 5:50 AM Report abuse rate up rate down Reply
Buy an ad here

Hot Apps on TUAW

Tweets

© 2012 AOL Inc. All Rights Reserved.