Home > Security

Computerworld - The hackers who harvested an estimated 114,000 Apple iPad 3G owner e-mail addresses defended their actions Friday as "ethical" and said they did nothing illegal.

The hacking group Goatse Security obtained the e-mail addresses using an automated PHP script that collected iPad 3G owners' ICC-ID numbers and associated addresses from AT&T's servers using a publicly-available feature of the carrier's Web site.

AT&T disabled the feature last Tuesday, a day before the Valleywag Web site first reported the story.

"We believe what we did was ethical," said Goatse member Escher Auernheimer in a telephone interview today. "What we did was right."

Goatse waited until AT&T had closed the hole before revealing its findings, said Auernheimer, who defended the release as "responsible disclosure" -- the term given to security revelations made public only after a vendor has patched a bug or otherwise prevented a vulnerability. "We followed the disclosure process, which is more than you can say for at least a third of security researchers," he argued, referring to researchers who post bug details before a patch is available.

"It was in the public interest to have this disclosed," Auernheimer continued. "If someone had a Safari exploit for the iPad, for example, they could have gotten this information. It was in the public's and AT&T customers' interest [for the latter] to be able to mitigate this instantly."

Rather than contact AT&T directly with what they'd uncovered, Goatse tipped off an unnamed third party, who in turn reported the design flaw to AT&T. Goatse took that route, Auernheimer said, to prevent AT&T from preventing the group from publicizing the e-mail address exposure. "We didn't want an injunction [from AT&T] that would have kept us from disclosing the data. And we didn't see the necessity of contacting AT&T directly."

Goatse contacted several media outlets whose employees showed up on the list of e-mail addresses they'd obtained, including Fox News, Reuters and others. None responded to their messages.

Instead, Goatse contacted Gawker Media, the company that operates ValleyWag and other technology sites and blogs. "We gave the data only to Gawker," said Auernheimer "They were the only one willing to dedicate resources to [the story]." According to Auernheimer, Gawker assigned several interns to the task of pouring over the list of 114,000 e-mail addresses.