GigaOM » UDIDs

The Apple Roundup: Don’t forget about the iPod

Erica Ogg — Tue, 11 Sep 2012 18:06:30 +0000

With so many people writing about Apple, finding the best stories and reports isn’t easy. Here’s our daily pick of stories about the company from around the Web that you shouldn’t miss:

Apple’s September event used to be about iTunes and new iPods. The iPhone, however, has usurped the attention (and profits) from Apple’s iconic music player, but iPods still account for three-quarters of all MP3 players sold. So let’s not forget: before Apple executives get around to announcing the new iPhone tomorrow, they’ll probably show us new iPods. (via MacRumors)
CNN walks us through Apple’s careful event choreography. For those planning to follow along the iPhone event tomorrow (we’ll be live blogging!), check this out first and see for yourself how closely Apple sticks to the same basic script.
David Schuetz, the mobile security expert that tracked those Apple device IDs leaked by Anonymous, tells us how he figured out the true source of the UDIDs — an appmaker in Florida, not the FBI.
American Airlines is the first major airline approved for iPad use in “all phases of flight.” And it won’t just be the pilots who’ll use the tablets to replace flight manuals, charts and maps. Soon AA flight attendants will use the devices to keep track of passenger details and in-flight service, says Smart Planet.
Thompson Reuters analysts attempt to divine the future of the iPhone by combing through Apple’s mobile patent portfolio. (via 9to5 Mac)

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Leaked Apple device IDs not stolen from FBI, but Florida app maker

Erica Ogg — Mon, 10 Sep 2012 16:57:37 +0000

Hacker collective Anonymous may not have been truthful about the source of the Apple device identifiers it posted on the web last week. (Shocking, right?) The group claimed the 1 million unique device identifiers (UDIDs) tied to Apple iPhones, iPads and iPods it made public were taken from an FBI agent’s computer, but the FBI denied that outright. On Monday, a Florida company that works with mobile content said it was the source of the UDIDs, according to both NBC News and the New York Times.

The company is called BlueToad, and it builds mobile apps for 6,000 publishers to display their content on mobile devices like Apple’s iOS devices. CEO Paul DeHart said his company compared the file released by the hackers and found a 98 percent match to UDIDs in its own databases, according to NBC’s report. The group published 1 million device IDs, but claimed to have stolen 12 million from the FBI.

DeHart also told the NYT that the 12 million number isn’t correct, and that the theft didn’t occur in March, another claim:

‘We decided to come forward to apologize to our customers, partners and the public in general that this got out there,’ Mr. DeHart said in an interview. ‘We face thousands of attacks every day that we’ve been successful at defending. This one happened to get through.’

Mr. DeHart said his company had contacted law enforcement, as well as Apple, to alert them to the breach and had hired an outside security firm to patch its systems. He said BlueToad had ‘nowhere near’ the 12 million identification numbers that the hackers claimed to have stolen.

Anonymous last week said that part of its aim in posting the UDIDs, besides to illustrate that the FBI might be tracking Americans’ cell phones, was to demonstrate that Apple’s use of the identifiers tied to specific devices, even while anonymized, was a dangerous idea. But even while it appears the group was lying, the point reminded us of the possible privacy invasion resulting from advertisers, app makers, Apple and possibly other organizations having a number that, with a bit of additional information, can reveal the identity of a device’s owner.

Apple denied handing over the UDIDs to law enforcement, but also noted that it intends to do away with the use of UDIDs in favor of a new solution in its next major mobile software update, which should be sometime in the next few weeks.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Apple denies handing over UDIDs to FBI or anyone else

Erica Ogg — Wed, 05 Sep 2012 17:15:34 +0000

First, the FBI denied possessing 12 million unique device IDs (UDIDs) tied to Apple iOS devices that hacking group Anonymous says it stole from an FBI agent’s computer. Now Apple is denying any knowledge or transmission of those UDIDs to the law enforcement agency as well. All of this calls into question the original story that the hackers told.

Here’s what Apple told AllThingsD on Wednesday about the millions of device IDs in question:

‘The FBI has not requested this information from Apple, nor have we provided it to the FBI or any organization. Additionally, with iOS 6 we introduced a new set of APIs meant to replace the use of the UDID and will soon be banning the use of UDID.’

To back up a bit: On Tuesday a group associated with Anonymous posted a file online that contained 1 million Apple UDIDs, or ID numbers assigned to 1 million iOS devices. In a long note posted with the download link to the file, the group claimed it stole a file with 12 million Apple UDIDs from the laptop of an FBI agent in March. The group says it chose to post just 1 million of those to start with.

Then, later Tuesday the FBI issued a statement that it hadn’t found any evidence to back up the hackers’ story: “At this time there is no evidence indicating that an F.B.I. laptop was compromised or that the F.B.I. either sought or obtained this data.”

Anonymous said part of the plan of releasing the list of UDIDs was to highlight the danger of letting companies and advertisers (or law enforcement) know the potential identity of whereabouts of a device and its owner.

But if Apple didn’t hand over the UDIDs and the FBI didn’t have them, where did they come from? The hacking group has some more explaining to do — which, doubtless, it will.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Anonymous reminds Apple that UDIDs are creepy

Erica Ogg — Tue, 04 Sep 2012 13:55:46 +0000

This post has been updated with a statement from the FBI.

Web-based hacker collective Anonymous published 1 million Apple UDIDs on the web early this morning from a trove of 12 million that it allegedly stole from an FBI agent’s laptop in March. Buried within the rambling, bizarre missive from the group about why it published these unique device identifiers — besides attempting to embarrass the FBI for tracking that many iOS devices, and creating general mayhem — was a pointed comment about Apple’s decision to use and publish UDIDs in the first place with iOS devices.

From the group’s post about it on PasteBin:

Also we think it’s the right moment to release this knowing that Apple is looking for alternatives for those UDID currently and since a while blocked axx [access] to it, but well, in this case it’s too late for those concerned owners on the list. we always thought it was a really bad idea. that hardware coded IDs for devices concept should be erradicated [SIC] from any device on the market in the future.

There are many problems associated with having the unique number on a device as personal as an iPhone or iPad or iPod touch be public and associated directly with a device. UDIDs do not contain information that allows a device’s owner to be identified, but when combined with other information, it can. Apple knows this, and that’s why a year ago it started trying to get app developers and advertisers to stop tracking users across apps through vast databases of collected Apple UDIDs. In August 2011 Apple outlawed the practice, but it wasn’t until March that it started to actually crack down.

A June report in the Wall Street Journal hinted Apple was working on an alternative to UDIDs. The new identifier would be anonymous and “likely to rely on a sequence of numbers that isn’t tied to a specific device.” The idea is to make owners of iOS devices feel slightly less creeped out and that their iPhone, iPad or iPod’s couldn’t be so easily tracked by app makers or advertisers — or law enforcement.

But Apple still hasn’t publicized any alternative yet, as Anonymous has helpfully reminded us.

Apple did not immediately respond to a request for comment.

Update 2:25 p.m.: The plot thickens: the FBI has issued a statement denying the UDIDs were taken from one of its agents. As the agency told the New York Times, ”At this time there is no evidence indicating that an F.B.I. laptop was compromised or that the F.B.I. either sought or obtained this data.”

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Has Apple come up with a less creepy way of tracking app use?

Erica Ogg — Fri, 08 Jun 2012 19:45:08 +0000

Apple may be working a system to replace UDID tracking across iOS apps. The Wall Street Journal says a new tool for helping third-party app makers track the behavior of their customers could be rolled out “in the next few weeks.”

It’s not entirely clear how it would work. According to the report, “the new anonymous identifier is likely to rely on a sequence of numbers that isn’t tied to a specific device.” It’s described as a system that should make people feel a little bit more comfortable than having their iPhone, iPad or iPod’s unique device identifier tracked by app makers or advertisers.

Last year Apple announced it was outlawing iOS apps in its App Store that used UDIDs, or universal device identifiers, to track users across apps. It’s a practice that helps advertisers and developers understand user behavior, but that came across as really creepy to people who didn’t want their behavior to be secretly monitored through their personal gadgets. It wasn’t until March that it appeared Apple was actually starting to crack down, however.

WWDC, the company’s annual gathering of app makers, kicks off Monday, so it clearly makes sense to introduce the system next week, but that’s obviously not a sure thing.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Apple cracks down on UDID use

Erica Ogg — Mon, 26 Mar 2012 16:31:54 +0000

Apple said seven months ago it would begin outlawing apps on its iOS App Store that use a device’s universal device identifier, or UDID. Reports are rolling in that indicate the company has started to actually enforce this policy.

UDIDs are a unique string of numbers associated with a device that can let developers of apps track their apps. Or when passed between apps, UDIDs allow ad networks, for example, to build a profile noting user habits and preferences associated with that device, which allows them to more carefully target their ads.

The rejection of their use doesn’t seem to be completely universal just yet, however. TechCrunch says Apple’s process is happening like this: “Two of the 10 review teams started doing blanket rejections of apps that access UDIDs this week. Next week, that will rise to four [of] the ten teams, and keep escalating until all 10 teams are turning down apps that are still using UDIDs.”

This, of course, comes as Apple has gotten some negative attention for its handling of privacy violations — including approving apps for sale in its App Store that have violated Apple’s privacy guidelines by uploading users’ contacts to the app developers’ servers. Some members of Congress have been sniffing around this privacy issue and others, including a loophole in Apple’s software that allows the uploading of user photo libraries.

And it’s just a few days since the Federal Trade Commission made it known that it is concerned about comprehensive tracking when it comes to personal data, and that it wants to see “privacy by design” built into consumer web services and apps.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.