Hackers claiming to have stolen information on 12 million Apple Inc. (AAPL) user accounts from an FBI computer said they have released some data from 1 million of those purported accounts.
Many of the hackersâ claims, posted this week in a long online missive from the group calling itself Anonymous, were unsubstantiated or refuted. The U.S. Federal Bureau of Investigation said in a statement yesterday that there was âno evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.â Apple didnât return phone and e-mail messages seeking comment on the hackersâ claims.
The hackers may have posted some legitimate usersâ device names and the unique identifier codes assigned to their iPhones, iPads and iPod Touches, according to Sean Sullivan, a security adviser at F-Secure Corp. who examined a data file that the hackers released. It isnât known whether the hackers really have the other information they claim to have redacted from the data file, including user names, mobile phone numbers and addresses.
âWhat they have released is not a very serious breach at all,â Sullivan said in an interview yesterday. As for claims that the information came from the FBI, he said, âtheyâve offered no additional corroborating evidence, theyâve offered nothing else — theyâve immediately demanded no interviews. I think theyâve made it up.â
The incident is the latest skirmish between hackers operating under the banner of Anonymous — who have often cultivated the media to promote their attacks, and have sometimes fallen short in their claims — and law-enforcement agencies and large corporations that the hackers argue are violating digital freedoms.
The hackers say they accessed the Apple data in March by breaking into a laptop of FBI agent Christopher Stangl, who has been active online in recruiting agents with cyber-security savvy. They claim to have used a vulnerability in Java, the popular Internet technology managed by Oracle Corp. (ORCL) whose flaws were exploited in attacks that infected more than 600,000 Mac computers in April and more than 100,000 Windows machines last week.
By themselves, the device codes released in the latest incident arenât sensitive. Called unique device identifier numbers, or UDIDs, they are just strings of numbers and letters that have limited value when viewed in isolation.
Still, taken with other information, they may be used to authenticate users trying to access a service. Amid privacy complaints, Apple earlier this year banned applications that use the code for tracking.
The hacked information could have come from other sources, including application developers or even Apple itself, F- Secureâs Sullivan said.
If the hackers have all the data they claim to have, that could expose millions of users to identity theft and fraud, Sullivan said. Based solely on the limited information thatâs been released so far, thereâs little risk to users, as account passwords and other sensitive data werenât included.
âAdditional investigation into this reported breach is needed to get to the bottom of the claims made by this hacker group,â
Representative Ed Markey, a Massachusetts Democrat, said in a statement yesterday, urging support for legislation for more transparency about what law enforcement collects from wireless carriers. âStill, it would be a mistake to allow this recent incident to pass without reexamining and recommitting ourselves to dealing with this vital personal privacy and protection issue.â
Follow Us on Instagram