Publishing Company Admits That Anonymous' UDID Data Leak Was Actually Taken From Their Database

from the the-plot-thickens dept

Last week, there was a big story in which AntiSec, a part of Anonymous, claimed to have downloaded personal info on about 12 million Apple device users from an FBI agent’s computer. They released about a million UDIDs to “prove” it, claiming they had a lot more information as well. The FBI quickly denied that the evidence came from them, and Apple later insisted that it had not shared such info with the FBI either. Now, a Florida company, Blue Toad, has told NBC that an analysis of the leaked data and its own data set has made it almost certain that the data actually originated from Blue Toad’s servers (whether or not it eventually got onto an FBI machine is a separate issue):

“That’s 100 percent confidence level, it’s our data,” [Blue Toad CEO Paul] DeHart said. “As soon as we found out we were involved and victimized, we approached the appropriate law enforcement officials, and we began to take steps to come forward, clear the record and take responsibility for this.”

Apparently, Blue Toad’s technology is used by tons of app publishers to help them build their own digital editions and apps — which is why it would have access to all of this information.

The researcher who figured out that the data came from Blue Toad, David Schuetz, has pointed out that he can’t say for certain if the FBI later got the same data, or where Anonymous got the data, but he does suggest that people should be skeptical of claims like that:

“It does raise questions,” he said. “I think people need to question what they see online, whether it comes from Anonymous or from a news organization or from a politician or from a corporation. You need to not take things at face value right away and jump straight to what you think it says. Somebody says, ‘Oh, this came from the FBI, everybody believes it. Well, let’s think about (it).”

Good advice.

Filed Under: , , , ,
Companies: blue toad

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Publishing Company Admits That Anonymous' UDID Data Leak Was Actually Taken From Their Database”

Subscribe: RSS Leave a comment
76 Comments
Willton says:

Re: Re: Re: Curious

Who says Blue Toad is lying? For all we know, it could be Blue Toad’s database and they shared it willingly with the FBI. Remember, the file the UDID’s came from allegedly contained NCFTA in the file name, and the NCFTA is all about private industry sharing data with the law enforcement.

And from whom did that file name originate? Why, it was Anonymous. So we are supposed to believe that Anonymous undertook no renaming of such information to suit their purposes?

Anonymous Coward says:

Re: Re: Re: Curious

Not getting an IRS fine tooth exam.
Not getting busted for other things they have done in violation of the law.
There is a handy list of ways to apply pressure.

Yes, to convince them to expose information, not lie. I’m sure that the FBI engages in some strong-arm tactics in order to gain information from a source who does not initially wish to cooperate. But I have yet to see the FBI convince such a party to lie to the public as part of a cover-up.

Willton says:

Re: Re: Re: What do App developers need UDID's for?

Well, recent evidence includes their use of GPS to track people without a warrant (they said they could even though the Constitution says they could not)

That’s not evidence of lying, that’s evidence of being mistaken or wrong. The U.S. Attorney argued that the FBI had the right, and the US Attorney lost the case at the Supreme Court. To say that the FBI was lying is to say that the FBI knew at the outset that their conduct was unconstitutional, and you lack an evidentiary basis for saying so.

and MegaUpload charges et al, etc.

Please explain how this is evidence of lying.

Rikuo (profile) says:

Re: Re: Re:2 What do App developers need UDID's for?

Okay I will.

It has been documented, in court, that the New Zealand police (the specific unit in question is the Kiwi version of SWAT) was told to use heavy force (armed police) and to be quick, because they were told BY THE FBI that Kim Dotcom had some sort of device that when triggered, would delete data from Megaupload servers.
The FBI told them this, despite the fact that the DAY BEFORE the raid and arrests of Kim Dotcom and other Megaupload employees, that the FBI had taken control of said servers, thus there was no way for Dotcom to have deleted the evidence (unless maybe the FBI were incompetent and possibly left the servers on and hooked up to the internet…)

Willton says:

Re: Re: Re:3 What do App developers need UDID's for?

It has been documented, in court, that the New Zealand police (the specific unit in question is the Kiwi version of SWAT) was told to use heavy force (armed police) and to be quick, because they were told BY THE FBI that Kim Dotcom had some sort of device that when triggered, would delete data from Megaupload servers.
The FBI told them this, despite the fact that the DAY BEFORE the raid and arrests of Kim Dotcom and other Megaupload employees, that the FBI had taken control of said servers, thus there was no way for Dotcom to have deleted the evidence (unless maybe the FBI were incompetent and possibly left the servers on and hooked up to the internet…)

Source please. Also, you do realize that there is a difference between taking control over a server and taking physical possession of said server, right?

FuzzyDuck says:

Re: Re: Re:4 What do App developers need UDID's for?

Here’s a source, last few paragraphs:

http://www.3news.co.nz/VIDEO-What-really-happened-in-the-Dotcom-raid/tabid/817/articleID/264651/Default.aspx

The FBI disabled access to the servers prior to the raid.

You don’t really seriously believe that the FBI waited with that until after the raid do you? That would be a hallmark of incompetence.

JMT says:

Re: Re: Re:4 What do App developers need UDID's for?

“Also, you do realize that there is a difference between taking control over a server and taking physical possession of said server, right?”

How would a “doomsday” delete button work if the FBI already had control of the servers?

The FBI told the NZ Police they had to use rapid force to prevent the use of a delete function, even though they knew it wouldn’t work even if he did have one, which he didn’t because they made it up. Kinda hard to see how the FBI did anything but lie about this one.

Anonymous Coward says:

Re: Re: What do App developers need UDID's for?

I dunno, let’s start with all the fbi initiated terrorist plots. Arresting those that refuse to buy into there plots anyway. CISPA shit, etc., etc. They are a govt. agency, therefore they lie by definition. Pick me apart if you will but I stand by the statement the f ahh bi lies.

Willton says:

Re: Re: Re: What do App developers need UDID's for?

Right. Because the FBI’s word is so credible.

The FBI is a governmental agency tasked with the duty of upholding the law and serving the public. Anonymous is a bunch of hackers who engage in criminal behavior. Who do you think has more to lose from getting caught lying?

pixelpusher220 (profile) says:

Re: Re: Re:2 What do App developers need UDID's for?

Uh, its still extremely plausible that everybody is telling the truth here EXCEPT the FBI.

In contacting the authorities, the company could have easily given FBI the ability to grab some data to investigate, then anonymous hacks the FBI’s laptop.

Only liar in this situation is the FBI who claimed no knowledge of the situation at all.

Or they just don’t know what the hell they’re doing…

Anonymous has pulled off some pretty significant hacks before…what reason would they have to lie? Whereas the FBI has been caught routinely lying over the decades. They have a reputation to protect…

Chosen Reject (profile) says:

Re: Re: Re:2 What do App developers need UDID's for?

Who do you think has more to lose from getting caught lying?

Anonymous. They depend entirely on their credibility. The FBI will be here tomorrow if the entire group acknowledged they’ve been killing kittens for 20 years and lying about it. Sure, some heads might roll, a few people would take the fall (willingly or not), there might even be a re-org and renaming, but the FBI would still be around in some form and most of the current FBI personnel would be moved to the new group if that were the case. The FBI has nothing to lose.

BTW, I’ve seen your posting history. You seem to be a (possibly patent) lawyer that likes kowtowing to authority and getting angry at people. You just seemed a tad bit too protective of the FBI here that I just had to look.

Willton says:

Re: Re: Re:3 What do App developers need UDID's for?

Anyonymous depends on their credibility? Um, they are a faceless organization that commits computer crimes and hides behind pseudonymous hacker names. They would have a much easier time of reorganizing and renaming than an agency of the federal government has.

Furthermore, the FBI is not some faceless organization; it’s composed of people just like any organization. In the case of the FBI, those people include lawyers and law enforcement agents whose credibility in court is essential to staying employed. If any FBI agent were to get caught lying to the public to cover-up any misdeeds perpetrated in their official capacity, their careers would be over.

As for my background, it’s irrelevant. Patent lawyers get pissed off about government just as much as you do. I just take exception to the general feeling at Techdirt that you can’t trust good people to do good things once they’ve been employed by the government. People who join the FBI don’t generally do it because it gives them a chance to lord over people unjustly; they do it because they want to serve their country and their fellow Americans.

DCX2 says:

Re: Re: Re:4 What do App developers need UDID's for?

If any FBI agent were to get caught lying to the public to cover-up any misdeeds perpetrated in their official capacity, their careers would be over.

This isn’t quite the FBI, but the gist is still the same. Whose career was ended when they lied about Pat Tillman? Whose career was ended when they lied about Jessica Lynch?

For that matter, can you even name the FBI agent who denied that the UDID’s came from them? Kinda hard to end someone’s career for lying when they’re an anonymous FBI agent…

Willton says:

Re: Re: Re:5 What do App developers need UDID's for?

This isn’t quite the FBI, but the gist is still the same. Whose career was ended when they lied about Pat Tillman? Whose career was ended when they lied about Jessica Lynch?

That isn’t even analogous to the situation here. The false stories regarding Tillman and Lynch revolve around purported leaks from the Pentagon. They did not involve official statements from the Pentagon.

For that matter, can you even name the FBI agent who denied that the UDID’s came from them? Kinda hard to end someone’s career for lying when they’re an anonymous FBI agent…

I can’t, but the FBI does, and if the FBI is proven to have lied about this, I can assure you that whoever made that assertion will be out on his ass, if not in jail.

Willton says:

Re: Re: Re:6 What do App developers need UDID's for?

By the way, I stand corrected regarding the Tillman case. As per Wikipedia (so take it FWIW), “members of Tillman’s unit burned his body armor and uniform in an apparent attempt to hide the fact that he was killed by friendly fire. His notebook, in which ? according to author Jon Krakauer ? Tillman had recorded some of his thoughts on Afghanistan, was also burned; “a blatant violation of protocol”. Several soldiers were subsequently punished for their actions by being removed from the United States Army Rangers.”

DCX2 says:

Re: Re: Re:7 What do App developers need UDID's for?

Thanks for proving my point that anonymous people in a government agency can say whatever they want without risking their career. Note that only the soldiers were punished, the people in the Pentagon who “unofficially” lied to the press probably still have a job.

Willton says:

Re: Re: Re:8 What do App developers need UDID's for?

Thanks for proving my point that anonymous people in a government agency can say whatever they want without risking their career. Note that only the soldiers were punished, the people in the Pentagon who “unofficially” lied to the press probably still have a job.

I don’t see anyone from the press outing their lying sources. If you want someone who can out those persons, talk to the Washington Post.

By the way, nice use of scare quotes. If you don’t have facts to prove your position, use innuendo. That’s always convincing.

Anonymous Anonymous Coward says:

Re: Re: Re:2 What do App developers need UDID's for?

Actually, I think that they are tasked with upholding the Constitution, not the law. When they bend the Constitution to fit their need for power, they subvert their oath:

I will support and defend the Constitution of the
United States against all enemies, foreign and
domestic; that I will bear true faith and allegiance to
the same; that I take this obligation freely, without
any mental reservation or purpose of evasion; and that
I will well and faithfully discharge the duties of the
office on which I am about to enter. So help me God.

That ‘protect and serve’ is nothing more than marketing speak.

DCX2 says:

Re: Re: Re:2 What do App developers need UDID's for?

You seem rather invested in this topic, Willton. Close to half the comments on this article are from you (at time of writing this comment)

It seems like you have trust in the government. I don’t. Not that I trust Anonymous hackers, but after reading some stories about what the government is up to, I find it impossible to trust any government agency.

For example, we have the FBI busting its own fake terrorist plots, NSL gag orders being contested anonymously, warrantless surveillance on a mass scale that Senators in-the-know are saying would offend the public, killing US citizens without any form of due process, taking the electronic property of people like David House without a warrant (and keeping it for almost two months!), indefinite detention without trial, setting up a fake vaccination campaign in Pakistan in hopes of getting a lead on bin Laden…I’m sure I could go on if I had to. I mean, shit, the government can be so paranoid that they even shredded the banana peel of the al-Haramain lawyers.

And that’s just within the last decade, if you were up for it then I could go on about Nixon and Watergate, Reagan and Iran-Contra, Reagan giving Saddam chemical weapons to use against Iran, the FBI spying on MLK Jr and other pacifists, the Tuskegee syphilis experiment (one of the sickest things I ever heard about)

Anonymous Coward says:

Re: Re: Re:3 What do App developers need UDID's for?

You know, if I focused on all of the negative things in life, I’d go crazy.

It’s certainly important to be aware of the misdeeds of your government, but to assume everything the government does is a lie is quite unreasonable. There are a lot of good people who are either elected officials or government employees looking out for the common citizen and are not part of the “big cover-up”.

Or, if you truly believe that everything is really a lie, what’s the point in living?

slander (profile) says:

Re: Re: Re:2 What do App developers need UDID's for?

The FBI is a governmental agency tasked with the duty of upholding the law and serving the public.

And a pretty piss-poor job they’ve been doing, at that. Unless you consider siding with corporate and media interests over the people “serving the public.” Oh, wait – judging by your history, you do.

Anonymous is a bunch of hackers who engage in criminal behavior.

And the FBI would never stoop to criminal behavior. They would never manufacture evidence. They would never lie in court. They would never wiretap without warrant.

Who do you think has more to lose from getting caught lying?


Given the FBI’s storied history of lying through their proverbial teeth and not giving and apparent rat’s ass about how it affects their public image, I would have to say that Anonymous would.

Willton says:

Re: Re: Re:3 What do App developers need UDID's for?

Given the FBI’s storied history of lying through their proverbial teeth and not giving and apparent rat’s ass about how it affects their public image, I would have to say that Anonymous would.

Would you be so kind as to provide some examples of the FBI’s “storied history of lying through their proverbial teeth and not giving and apparent rat’s ass about how it affects their public image”? As is custom around here, accusations are not viewed favorably without supporting evidence. Just ask Mike Masnick.

slander (profile) says:

Re: Re: Re:4 What do App developers need UDID's for?

Just because I have so much love and respect for such a fine, upstanding gentleman as yourself:

http://www.forbes.com/sites/benkerschberg/2011/05/05/federal-court-rebukes-fbi-for-lying-to-the-court-about-surveillance-records/

http://www.youtube.com/watch?v=YaA6Myrvz4Y

http://www.ticklethewire.com/2011/12/27/ex-u-s-atty-accuses-fbi-and-prosecutors-of-illegally-obtaining-documents-and-lying-about-it/

Of course, I suppose it would be somewhat redundant to mention COINTELPRO, warrantless GPS tracking, and the phony terrorist bombing plots created out of whole cloth.

Berenerd (profile) says:

Re: Re: Re:2 What do App developers need UDID's for?

Has, at any point, Anonymous lied about what they did? Doing a criminal act does not make them liars. It makes them criminals. Fibbing makes them liars. The FBI has been proven to lie, therefore it is safe to assume they are doing so now. I would push it and say refusing to tell the truth is criminal in nature in most of the instances where they have been caught in their lie.

That Anonymous Coward (profile) says:

Re: Re: What do App developers need UDID's for?

Antisec hasn’t been parading around a bunch of “lone wolf” terrorist’s and plots they put into motion.

Antisec hasn’t been using post-its as a legal request for information.

Antisec hasn’t been planting GPS trackers on cars belonging to brown people for the crime of being brown.

Antisec hasn’t violated the laws of a sovereign nation pursuing a flawed case in US courts.

Antisec did not train agents using flawed racist propaganda.

Antisec might not be teenagers.

Remember when the Government needs them to be nerds not to be feared they downplay what they can do, but when they want to pass a law to spy on more people suddenly they can use a phone to destroy power plants with the power of their minds.

That’s just off the top of my head… there is more.

Beta (profile) says:

Re: Re:

“Even if it was Blue Toad, what were they doing with all that information in a non-encrypted form, not to mention all the supposed billing information.” (emphasis added)

As I understand it, Antisec claimed that the data included “zipcodes, cellphone numbers, addresses, etc.”, while in the NBC story, Apple spokeswoman Trudy Mullter said (or implied) that the Blue Toad data did not include personal information such as account or billing information. So now Antisec can prove its case by revealing the personal information. If Antisec is reluctant to cause so much trouble for so many people, let’s have a test. There must be people out there who have found their own devices on the list; maybe some of them are prepared to say, “Antisec, here’s my UDID, here’s a message encrypted with my phone number, I challenge you to publish the cleartext.” (There are probably better protocols, this is just off the top off my head.)

Anonymous Coward says:

This stinks of damage control, and now all of a sudden we have sympathetic posters here standing up for the honour that is the fbi, please,
There working the internet like they are working main stream media, give them enough time and they’ll get good at it, then the greatest tech tool to this date, will be their most powerfull weapon, internet propaganda

Anonymous Coward says:

Re: Re: Re:

Yes, because every time you find someone posting in favor of the FBI, it must be some sort of PR stunt.

?You’re an idiot.

You’ve posted 19 posts on this subject, all of them defending the fbi, being insulting, and asking for prove of some of our claims, while providing none to backup yours, except……..’but, but,but, its the government, …..governments dont lie’

The us government is a disgrace, they do not follow the constitution, there is no more checks and balances in your government, and the executive order was the day you americans accepted your dictatorship.

You dont question, but always obey, you are an enabler, there are true patriots in your country, and you sir, ARE NOT FUCKING ONE OF THEM

F! says:

Re: Re: Re: Re:

“and you sir, ARE NOT FUCKING ONE OF THEM”

Hmmm, sounds to me like Wilton is fucking all of them – in the literal sense of course. Perhaps I misunderstood, and you meant the way Wilton isn’t fucking one of them is only in the figurative…

Me? I say fuck the gov’t. Fuck them HARD. After all, they’ve already fucked everyone else, and will continue to do so. I cringe to envision what they’ll accept as climax… Perhaps rape is more appropriate a term. Rape of the most brutal, violent sort. That’s what the gov’t has been doling out for years. We can expect (and will recieve) nothing better.

Anonymous Coward says:

Shit I’d take the fall for the kind of money the FBI is most likely paying them.

FBI fucks up – outrage
– Followed by some more outrage.

Some other place fucks up – outrage followed by we’re sorry Tony Hayward style.
– Followed by I resign with a big fucking check.
– Followed by okay okay just don’t let it happen again, again O_o

Richard Hack (profile) says:

I'm still skeptical

I’m skeptical about this company’s claims.

Their statement claimed a “significant match” with the stolen UIDs, and then the quote above says “100 percent certainty”.

Frankly, I’m not convinced. It could be that they merely have the same UIDs that the hackers stole. They also aren’t very forthcoming as to how or when the data was stolen (if they even know).

However, the hackers who claimed the FBI was involved should provide more proof of their claims at this point. Otherwise the impact of their release does nothing but damage their credibility given this company’s claims.

Wally (profile) says:

Re: I'm still skeptical

“Frankly, I’m not convinced. It could be that they merely have the same UIDs that the hackers stole. They also aren’t very forthcoming as to how or when the data was stolen (if they even know).”

I would not be surprised at all if BlueToad Publishing was a front for data mining and phishing scams. They got caught and are stuttering through their admittance which usually means they are A)They were caught off gaurd, B) Are hiding something much more sinister (explains their nervousness about the investigation), or C) Both and and B.

Anonymous Coward says:

What we can’t believe is the government. Political leaders give the directions to what law enforcement will concentrate on. Items such as the Cablegate affair already show citizens just how much they can trust the government to act in their name.

Enforcement branches such as the FBI do follow what the head of the agency directs it to do. Given the past attempts at entrapment over fake terrorist plots setup, equipped, planned, supported, and assisted to the carry through, leaves one with the idea that the FBI can’t be trusted either. You think maybe they didn’t lie to these patsy’s to get them to take the bait?

Or maybe you have the idea the FBI just went up to the prospective target and said, “Hi, I’m the FBI and I’m here to help you”. Somehow I don’t think that was the way it was played.

The explicit assumption left is the FBI lied.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Ctrl-Alt-Speech

A weekly news podcast from
Mike Masnick & Ben Whitelaw

Subscribe now to Ctrl-Alt-Speech »
Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...