Goatse Security

So, AT&T calls us malicious in their letter to their customers. I think this calls for a statement to clear the air.

AT&T had plenty of time to inform the public before our disclosure. It was not done. Post-patch, disclosure should be immediate– within the hour. Days afterward is not acceptable. It is theoretically possible that in the span of a day (particularly after a hole was closed) that a criminal organization might decide to use an old dataset to exploit users before the users could be enlightened about the vulnerability.

Even in this disclosure, which I feel they would not have made if we hadn’t publicized this vulnerability, AT&T is being dishonest about the potential for harm.

I had previously thought that only an attacker who could crack the secret Ki key (I believe but am not certain that David Hulton and Skyper could based on information I have received about their presentation in Dubai, and if they have figured it out who knows who else has) could use the ICCIDs in this breach. Later, two security researchers from iSec Partners revealed that an attacker of much lower sophistication could use the ICC-IDs to determine iPad owner location.

iSec is a well-established name in the security industry and is known for its absolute integrity. I had the good fortune of meeting iSec hacker Josha Bronson at a convention. His abilities were second to none. I have no reason to doubt iSec’s claims.

Beyond that, AT&T is not highlighting the potential for a skilled attacker to use a Safari exploit, or other iPad application exploit based on this dataset to takeover the iPad. A complete list of iPad 3G customers (which could have been generated from this vulnerability) would have the ideal bit of data for those in the RBN with zero-day Safari exploits to acquire.

I released a semantic integer overflow exploit for Safari through Goatse Security in March— it was patched on Apple’s desktop Safari but has yet to be patched on the iPad. This bug we crafted allows the viewer of a webpage to become a proxy (behind corporate and government firewalls!) for spamming, exploit payloads, password bruteforce attacks and other undesirables. The kicker is that this attack cannot be detected by any current IDS/IPS system. We released this in March, mind you, and Apple still hasn’t got around to patching this on the iPad! I know through personal experience that the patch time for an iPad vulnerability is over two months and counting. Given that, the number of parties which probably have active iPad exploits likely numbers in the hundreds, if not the thousands. The iPad simply is not a safe platform for those that require a secure environment.

Robert “RSnake” Hansen, one of the world’s foremost web application security researchers and the author of “Detecting Malice”, talked a little about our March release on his blog.

The potential for this sort of attack and the number of iPad users on the list we saw who were stewards of major public and commercial infrastructure necessitated our public disclosure. People in critical positions have a right to completely understand the scope of vulnerability immediately. Not days or weeks or months after potential intrusion.

In addition AT&T says the person responsible for this went “to great efforts”. I’ll tell you this, the finder of the AT&T email leak spent just over a single hour of labor total (not counting the time the script ran with no human intervention) to scrape the 114,000 emails. If you see this as “great efforts”, so be it. I know that the RBN has literally thousands of people working full-time to exploit software vulnerabilities. At any given moment, whatever efforts us researchers are making are dwarfed by those in the thrall of evil. So get real. You fucked up, we helped you figure that out and informed the public. You should thank us, but you can keep on shit-talking if you want. We know what we did was right.

When we disclosed this, we did it as a service to our nation. We love America and the idea of the Russians or Chinese being able to subvert American infrastructure is a nightmare. We understand that good deeds many times go punished, and AT&T is trying to crucify us over this. The fact remains that there was not a hint of maliciousness in our disclosure. We disclosed only to a single journalist and destroyed the data afterward. We did the right thing, and I will stand by the actions of my team and protect the finder of this bug no matter what the cost.

-Escher Auernheimer