AT&T

15 Jun

Indisputable risk of the AT&T iPad hack

Tagged AT&T, cracking, iPad, networking security, phishng, spear phishing, weaponized email

The tech and security news stream has been full of iPad AT&T hack coverage with AT&T trying to downplay the severity of the hack and security experts rebutting AT&T's claims stating that the ICC-ID can be used to determine other information.  I'm not an expert on 3G security and don't know much about ICC-IDs but I can tell you that this leak has serious indisputable security implications regardless of potential attacks via the 3G network which everyone seems to be focusing on at the moment.

The leak of verified email addresses, especially of high-profile individuals and those with security clearance, is a huge problem.  Obtaining current email addresses is the first step in targeted attacks like the recent one against Google and others. 

Now that these addresses are public you can bet many accounts on that list are receiving carefully crafted, targeted phishing emails known in the industry as "spear phishing" or "weaponized email".  A single click on a link in a very legitimate looking email could compromise not only the computer on which the link was clicked but potentially every computer on the same network.  Imagine if New York City Mayor Michael Bloomberg or White House Chief of Staff Rahm Emanuel, both whose emails were leaked, were to click on a malicious link in an email appearing to be from a legitimate source.  What kind of damage could that do?  If Google and other high-tech corporations could be hacked, I'm sure the US government is not unhackable.

All code on this site is free for use at your own risk and provided as-is under the WTFPL license unless otherwise stated. Attribution is appreciated but not required.
Blog content, with the exception of externally quoted material, is licensed under the Creative Commons Attribution 3.0 license