AT&T Breach May Be Worse Than Initially Thought

ChrisPaget writes "I'm somewhat of an authority on GSM security, having given presentations on it at Shmoocon (M4V) and CCC (I'm also scheduled to talk about GSM at this year's Defcon). This is my take on the iPad ICCID disclosure — the short version is that (thanks to a bad decision by the US cell companies, not just AT&T) ICCIDs can be trivially converted to IMSIs, and the disclosure of IMSIs leads to some very severe consequences, such as name and phone number disclosure, global tower-level tracking, and making live interception a whole lot easier. My recommendation? AT&T has 114,000 SIM cards to replace and some nasty architectural problems to fix." Reader tsamsoniw adds that AT&T has criticized the security group responsible for pointing out the flaw, while the group claims they did it 'as a service to our nation.'

Phew

[Azureflare]

I'm glad I got the WiFi-only version!

Well

[Anonymous Coward]

I'm proud that Goatse Security revealed this gaping security hole.

Meanwhile on the Titanic....

[SunSpot505]

"Captain, I discovered that the bulkheads that seal the ship in case of a hull breach actually stop several floors short, and could be compromised in the event of a major collision."

"How dare you point out a fatal flaw in our Honorable Engineer's design. Now that the Icebergs know this, they will surely attack our boat! You should have kept your dumb mouth shut"

"but..."

Re:Well

[Krondor]

The best part about that team revealing this, was hearing NPR / CNN / BBC and others say Goatse in their broadcasts. Priceless!

Re:ICCID = IMSI

[The Yuckinator]

There's a luggage joke in here somewhere but I can't find it.

Re:So THAT'S how they'll do it.

[cynyr]

you seem a bit young, remember the baby bells? leasing your phone from ATT/MaBell? Their logo looks like the deathstar for a reason.

Re:ICCID = IMSI

[NixieBunny]

The story says that not all carriers encode it like this; some might have used such advanced encryption techniques as ROT13.

I wonder if the folks who do network design at AT&T have any idea at all that their job is related to security.

Re:ICCID = IMSI

[Anonymous Coward]

A suitcase full of artificial penises walks into an airport.