Hacker group responds to AT&T, leader held by FBI

@David

http://digitalmedia.oreilly.com/2005/02/02/hacktv.html

A delusional idiot media whore, AND an anti-semite. Lovely.

Had the vulnerability just been reported everything would be fine, but by exploiting the access point, downloading personal information, and then providing the data to Gawker, this guy became a common criminal hacker and should be jailed.

Speaking of Erica, anybody have a pic?

Uh oh:
http://www.jewishreview.org/local/Police-question-two-men-about-threats-to-Jewish-community

Looks like Andy has more than one problem.

Oh cut the strawman tactic. The fact that the hacker is a bearded acidhead does not change the fact that AT&T screwed up with those e-mail accounts and Mobile Safari has holes. If he posted similar info on Google, Adobe or MS you'd all be up in arms protecting the "truth" from the suspiciously long arms of law enforcement.

Victimless crime. Free Auernheimer and go after the real problem here - AT&T.

Seriously, this guy is an idiot (for the way he reported the breach and his general lack of PR smarts), but this wasn't a particularly sophisticated hack.

Hacker registers/logs on to AT&T site with iPad... sees that their email and/or details are being shown without any authentication, and sees the ICC-ID is being used to authenticate the user. Decides to try a few things, succeeds and ends up with a few email addresses... continues and gets 140K of them.

Probably should have stopped after a few, but seriously, this is the most amateurish kind of security hole. Just be glad the idiots at AT&T didn't decide to log you in to your account with the ICC-ID and show information like your address, or SSN.

Authentication by a unique token as a security device only works when that token is sufficiently large and random to mean just using a RNG to generate valid tokens. The ICC-ID of the device ISN'T sufficiently random to make it difficult for an attacker to guess those ids.

Maybe there needs to be a way to report this kind of stuff without relying on the company to do the right thing if you only contact them (and not have pissed off developers call the FBI or police themselves and accuse you of hacking (it's happened to people who've reported security flaws before)).

Or maybe you'd prefer people keep quiet and leave the hacking (and your information) to the black hats and trust companies like AT&T to keep your data secure!

It's Redbeard! Grower of the facial hair pirate pun.

I'm going to break into these hackers houses and steal a bunch of their stuff. I'll keep it for a few weeks and give it back.

It's the right thing to do, though, because it's showing how weak their home's security is. You see, if I had just pointed out how weak their security is WITHOUT stealing their stuff, it wouldn't have been as patriotic.

;)