iPad users in the USA have found themselves caught up in a security gaff which saw subscriber data of some 114,000 of them exposed for anyone to see. Subscriber data such as email addresses the Integrated Circuit Card ID that authenticates them on the AT&T network. The security researchers which discovered the vulnerability ensured that AT&T were not only informed, but that it had also closed the hole down, before going public with the news. So why are they, and not the dumbass security folk at AT&T responsible for not securing that data in the first place, the ones under investigation by the FBI?
According to a Goatse spokesperson "All data was gathered from a public webserver with no password, accessible by anyone on the Internet. There was no breach, intrusion, or penetration, by any means of the word. The dataset was not disclosed until we verified the problem was fixed by the vendor". Indeed, the timeline of events could not be much clearer as far as the matter of acting responsibly goes.
The vulnerability was discovered and verified, with user data extracted as proof, and AT&T were informed via a third party. AT&T then acted to fix the vulnerability, and Goatse ensured that this fix was in place and working (meaning there was no further threat to use data) before contacting a journalist at Gawker with the story and the proof in the form of the acquired dataset. The journalist concerned, Ryan Tate, then acted with equal responsibility by redacting that information before publishing the story.
I agree fully with the Goatse spokesperson who says "iPad 3G users had the right to know that their email addresses were potentially public knowledge so they could take steps to mitigate the issue (like changing their email address). This was done in service of the American public". If the vulnerability had not been made public in this way do you really think AT&T or Apple would be stepping up and telling those iPad users about it? I don't.
So why, pray tell, are some in the security industry shouting from the rooftops about how irresponsible Goatse has been? And why, for goodness sake, is the FBI now investigating Goatse with a view to 'possible computer intrusions' and a 'potential cyberthreat' as if Goatse are the bad guys rather than AT&T?
Seriously people, get a grip. Gawker did not, it would appear, pay Goatse for this story. The only crime here is that anyone should be investigated for actually improving the security of iPad users.
Or would you prefer that next time such a hole is found the researchers do nothing, for fear of FBI investigation, and just let the bad guys find it and exploit the data instead?
