clock menu more-arrow no yes

Filed under:

How one security researcher solved the UDID leak mystery

New, 19 comments

The security researcher who traced the leak of 1,000,001 iPhone and iPad UDID numbers to publisher BlueToad has published a blog post detailing his methods.

iphone and ipad together
iphone and ipad together

Paul DeHart, CEO of publisher BlueToad, appeared on NBC News yesterday to admit that 1,000,001 iPhone and iPad UDID numbers leaked last week came from his company — now, the security researcher behind the discovery has published a blog post detailing his methods. Writing on the site of his consultancy Intrepidus Group, David Scheutz describes how he searched for duplicated UDIDs in the data set, discovering that devices with names such as "Bluetoad iPad" and "Bluetoad Support" appeared multiple times — digging further, he found an existing password dump from the company's servers, dated March 14th, the same day that hacktivists claimed to have stolen the data from the FBI. It seems like a solid case, but the most interesting part of Scheutz's post is his admission that there may be more to find out: "why haven't I noticed any of their applications in the (very few) lists of apps I've received?" Head over to the Intrepidus Group site to read the full post.