AT&T's Apology for Massive Security Breach

AT&T sent out emails to all iPad 3G users apologizing for a recent security breach uncovered by Goatse Security. The email called those who uncovered the vulnerability 'malicious' and Goatse Security wasn't at all happy with that.

Last week, a group calling themselves Goatse Security identified a massive hole in AT&T's system that allowed for the harvesting of more than 100,000 email addresses of iPad 3G owners. Included on the list were White House Chief of Staff, Rahm Emanuel and Mayor Michael Bloomberg. The group said that they had shared the exploit and a third party notified AT&T. However, because they had shared details of the security breach with third parties, Goatse said it wasn't sure who had information about the exploit and who could have had taken advantage before AT&T patched things up.

Given the high profile names included on the list of emails, the FBI said Thursday that it had opened an investigation into the breach, calling it a potential cyberthreat. Over the weekend AT&T sent out an email to all iPad 3G users, apologizing for the breach.

June 13, 2010

Dear Valued AT&T Customer,

Recently there was an issue that affected some of our customers with AT&T 3G service for iPad resulting in the release of their customer e-mail addresses. I am writing to let you know that no other information was exposed and the matter has been resolved. We apologize for the incident and any inconvenience it may have caused. Rest assured, you can continue to use your AT&T 3G service on your iPad with confidence.

Here’s some additional detail:

On June 7 we learned that unauthorized computer “hackers” maliciously exploited a function designed to make your iPad log-in process faster by pre-populating an AT&T authentication page with the e-mail address you used to register your iPad for 3G service. The self-described hackers wrote software code to randomly generate numbers that mimicked serial numbers of the AT&T SIM card for iPad – called the integrated circuit card identification (ICC-ID) – and repeatedly queried an AT&T web address. When a number generated by the hackers matched an actual ICC-ID, the authentication page log-in screen was returned to the hackers with the e-mail address associated with the ICC-ID already populated on the log-in screen.

The hackers deliberately went to great efforts with a random program to extract possible ICC-IDs and capture customer e-mail addresses. They then put together a list of these e-mails and distributed it for their own publicity.

As soon as we became aware of this situation, we took swift action to prevent any further unauthorized exposure of customer email addresses. Within hours, AT&T disabled the mechanism that automatically populated the e-mail address. Now, the authentication page log-in screen requires the user to enter both their e-mail address and their password.

I want to assure you that the e-mail address and ICC-ID were the only information that was accessible. Your password, account information, the contents of your e-mail, and any other personal information were never at risk. The hackers never had access to AT&T communications or data networks, or your iPad. AT&T 3G service for other mobile devices was not affected.

While the attack was limited to e-mail address and ICC-ID data, we encourage you to be alert to scams that could attempt to use this information to obtain other data or send you unwanted email. You can learn more about phishing by visiting the AT&T website.

AT&T takes your privacy seriously and does not tolerate unauthorized access to its customers’ information or company websites. We will cooperate with law enforcement in any investigation of unauthorized system access and to prosecute violators to the fullest extent of the law.

AT&T acted quickly to protect your information – and we promise to keep working around the clock to keep your information safe. Thank you very much for your understanding, and for being an AT&T customer.

Sincerely,

Dorothy Attwood
Senior Vice President, Public Policy and Chief Privacy Officer for AT&T

However, Goatse Security isn't exactly pleased about being called 'malicious.' The group responded to the letter with a blog post saying they loved America and disclosed the exploit because "the idea of the Russians or Chinese being able to subvert American infrastructure is a nightmare."

"In addition AT&T says the person responsible for this went “to great efforts”. I’ll tell you this, the finder of the AT&T email leak spent just over a single hour of labor total (not counting the time the script ran with no human intervention) to scrape the 114,000 emails. If you see this as “great efforts”, so be it. I know that the RBN has literally thousands of people working full-time to exploit software vulnerabilities. At any given moment, whatever efforts us researchers are making are dwarfed by those in the thrall of evil. So get real. You fucked up, we helped you that figure out and informed the public. You should thank us, but you can keep on shit-talking if you want. We know what we did was right.

When we disclosed this, we did it as a service to our nation. We love America and the idea of the Russians or Chinese being able to subvert American infrastructure is a nightmare. We understand that good deeds many times go punished, and AT&T is trying to crucify us over this. The fact remains that there was not a hint of maliciousness in our disclosure. We disclosed only to a single journalist and destroyed the data afterward. We did the right thing, and I will stand by the actions of my team and protect the finder of this bug no matter what the cost."

To read the full post, click here.