Can anyone enlighten us with what a hacker could use one (or a list of) UDID for?

The leak reported September 4 of 1 million UDID's by AntiSec makes me worry. But should I?

What is the worst case scenario with a hacker who has a million UDID's?


Now that more "truth" has come out, this leak was from a third party company, Blue Toad and by all reputable accounts, the leak did not in fact contain the either volume of UDID or the additional personal data that would strike anyone as "concerning." The leak was of data collected according to the existing policy by Apple and the app store and is not at all unique as hundreds of companies will have that volume and type of data due to the past use of UDID to identify customers.

The leaked document itself is mostly harmless from a technical standpoint, but quite shocking if you expected to be private and now have some details exposed publicly.

It contains one line with the following types of information for each device that is purported to be listed:

UDID, APNS token, device name, device type

Unless you are a programmer and run a service that could push a message through Apple's push notification service (APNS), then you can't really take any action whatsoever based on the leaked file.

If you do have records of transactions that list a UDID or a device name / type and wanted to confirm another piece of information, this file could be used to link two pieces of information together if you already had that information.

The real security ramifications are that this "leak" is from a spreadsheet file that supposedly contains 12 million entries - not the million that were leaked. The best information we have (if you believe the words of the release text which has some mild profanity if you care about that sort of thing) is that the real data that was stolen also had very personal information like zip codes, telephone numbers, addresses and full names of people associated with the UDID and APNS tokens.

That sort of information in a the hands of a skilled person (government employee, hacker, or simply an engineer with a grudge against you) is something that could do damage to most of us in terms of violating our privacy. Nothing in this release would seem to compromise the security of your using the device - but it does make things that would normally be seen as anonymous less so if the FBI is regularly carrying around lists of millions of subscriber information that would let them tie logs of application use to a specific device or a specific person.

The worst case event with the data leaked today would be someone who has already registered with Apple to send push notifications could perhaps attempt to send unsolicited messages to the million devices (assuming the APNS tokens are still valid) or otherwise correlate a device name with an UDID if they had access to sensitive logs or a database from a developer or another entity. This leak doesn't allow remote access in the way that knowing a password and user ID would.

  • 1
    If Apple is worth its salt, the APNS tokens will be revoked ASAP. However, I won't be getting my hopes up, they haven't been very responsive to security stuff in the past. – jrg Sep 4 '12 at 21:11
  • 2
    I'm personally going to be speaking with my congresspeople to understand if in fact the FBI is not only carrying around 12 million UDID/APNS tokens/assorted other personal data unencrypted on a portable computer, but even worse, managed to get it stolen. – bmike Sep 4 '12 at 21:14
  • 2
    APNS tokens are worthless to anyone who does not have the entire APNS digital certificate created by the app developer. It is not possible to send notifications to an app without that app's certificate. There is no need to revoke the tokens. In fact, Apple probably can't without putting new bits on the phone. – ohmi Sep 4 '12 at 21:24
  • @bmike thank you for your detailed answer. If indeed the FBI was carrying 12 million+ UDID's, what could they do with them and could they go as far as to track our iPhones' location and/or usage? – Ethan Lee Sep 4 '12 at 23:37
  • 1
    Hold on please! More sophistication needed, all we know is somebody got UDID's and said the FBI stole them. Plausible, certainly. So plausible that we would take ANYBODY's word over the FBI's, which perhaps might be why whoever took these threw the FBI under the bus! Let's wait to hear more before engaging in the useless appeal to the elected representatives... – chiggsy Sep 5 '12 at 17:37

As bmike notes, UDID on it's own isn't particularly damaging. However if the attackers are able to compromise other databases where UDID is used, the combination could yield quite a bit of identifying personal information, as this article from May, 2012 lays out: De-anonymizing Apple UDIDs with OpenFeint.

As with the recent highly-publicized Mat Honan hack, one security breach on it's own may not be overly troublesome, but the damage can grow exponential if the attackers can breach another service you use.

  • 4
    Very true about the ability to use this information to cross reference with other databases. This is way more scary with the possibility of address, name and phone numbers being linked in the 12 million record file. – bmike Sep 4 '12 at 20:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .