3G iPad Hack More Than Email Addresses?

If you have a 3G iPad on AT&T's network and you are one of the lucky 114,000 who's email addresses were exposed, you might have a bit more to worry about. In fact, even if you aren't one of those originally identified has having their email address exposed, you might still have something to worry about.Last week it was revealed that at least 114,000 account holders with an iPad on AT&T's network had their email addresses exposed. If you were one of those that had their email exposed, you likely already have your mea culpa from AT&T. If not, you should have it soon. They are assuring users that "no other information was exposed."

Chris Paget has written a blog post about the real risk as a result of the breach. Mr. Paget has given presentations on GSM security at events like this year's Defcon.

His post gets a bit technical, and unless you are familiar with the terms, you may be looking a few of them up on Wikipedia. The bottom line is, as I noted last week, the integrated circuit card identifier, or ICC-ID is easy to identify and AT&T used it in their web server in an inappropriate way. Mr. Paget says the ICC-ID is fairly easy to use to get a user's international mobile subscriber identity (IMSI). He claims that AT&T made some bad decisions when building out their network by simply rearranging a few numbers to calculate the IMSI from the ICC-ID. Most other GSM networks require access to an internal database to make the translation. He links to a document that shows you, or a hacker, exactly how to do it.

With the IMSI, you can get the billing name on the account, the phone number of the device and the ability to track the phone as it move from tower to tower on any GSM network.

Now that is scary. The quick fix is to get the hacked users a new SIM card. That means the old ICC-ID is no longer valid and AT&T has fixed their web server to no longer broadcast it to outside queries. With the network vulnerability exposed above, someone could still get your ICC-ID if they were determined, but they would need physical access to your device or the box it came it as it is printed on the outside. While not impossible, it is highly unlikely unless you are a high profile target, like iPad hacking victim Rahm Emanuel.

It will be interesting to see if the tech community at large agrees with Mr. Paget's analysis. One of two things will happen - either most will dismiss this argument and it will fizzle out, or it could grow to be the biggest widespread security issue caused by a large company since Sony installed rootkits on your PC with their DRM software on music CD's.

If you get the apology email from AT&T, you should pay attention to the news surrounding this issue. You might want to demand AT&T replace your SIM card.

[via Slashdot.org]