2 charged with stealing iPad users' information

Print   Email   Font ResizeBy David Porter

Associated Press

Posted: 01/18/2011 08:46:05 PM PST
NEWARK, N.J. -- Two men who authorities say were competing to impress their fellow hackers were arrested Tuesday on federal charges they stole the e-mail addresses of more than 100,000 Apple iPad users, including politicians and media personalities.

The theft and the AT&T security weakness that made it possible were revealed months ago, and U.S. Attorney Paul Fishman said there was no evidence the men used the swiped information for criminal purposes. Authorities cautioned, however, that it could theoretically have wound up in the hands of spammers and scam artists.

Daniel Spitler, a 26-year-old bookstore security guard from San Francisco, and Andrew Auernheimer, 25, of Fayetteville, Ark., were charged with fraud and conspiracy to access a computer without authorization.

Fishman said the men and their cohorts were engaged in "malicious one-upsmanship" as they sought to impress each other and others online.

"We don't tolerate committing crimes for street cred," Fishman said. "Computer hacking is not a competitive sport, and security breaches are not a game."

Spitler appeared in federal court in Newark and was released on $50,000 bail. A U.S. magistrate ordered him not to use the Internet except at his job at a Borders bookstore.

"I maintain my innocence and I'm not worried about this case at all," Spitler said outside court. "The information in the complaint is false. This case has been blown way out of proportion."

At Auernheimer's court appearance in Fayetteville -- where he also faces drug charges stemming from a search of his home in June -- he was ordered held pending a bail hearing Friday. He told a magistrate that he had been drinking until 6:30 a.m., and he mocked the case against him, telling federal officials in the courtroom, "This is a great affidavit -- fantastic reading."

The stolen e-mail addresses, on their own, aren't that valuable; many of them could easily have been guessed by knowing a person's name and how his or her organization structures its e-mail addresses.

But once they knew a person was an iPad owner and an AT&T customer, cybercriminals and spammers could have sent e-mails that looked like they came from Apple or AT&T, tricking the recipient into opening them.

Those e-mails could, in turn, plant malicious software on the recipient's computer or trick the person into sharing vital private information, such as Social Security or credit card numbers.

In June, AT&T acknowledged a security weak spot on a website that exposed the e-mail addresses of apparently more than 100,000 iPad users. The company said that the vulnerability affected only iPad users who signed up for AT&T's 3G wireless Internet service and that it had fixed the problem.

Print   Email   Font ResizeReturn to Top  

View the original article here