AT&T Explains iPad Security Breach

First thing I thought of when I read this "We apologize for the incident and any inconvenience it may have caused. Rest assured, you can continue to use your AT&T 3G service on your iPad with confidence."

is this from 37 Signals:

------------------------------------

“We apologize”

You say “I apologize” to someone when you bump into them on the subway, not if you spill your coffee all over them. Then you’re “really, really sorry!”. If your service is important to your users, it’s a lot more like spilling coffee all over them than it is like bumping into them when you go down.

Also, you should find someone willing to take personal responsibility. Even if it’s not directly their fault. There’s always someone who’s in charge, someone who stops the buck. Hiding behind a faceless “we” is weak.

“Any inconvenience”

First of all, if I depend on a service and can’t get to it, it’s not an inconvenience. It might bloody very well be a full-on crisis. An inconvenience is when I can’t get my flavor of milkshake at Potbelly’s or if there’s line at the grocery store. This ain’t that.

Using the word “any” makes it even worse. It’s implying that you don’t really care what bucket my frustrations fit in. Every feeling I have about this will apparently fit the “inconvenience” header. Wrong.

“This may have caused”

Again, this is slighting the very real experience that I am actually having right now. If this didn’t affect me, you don’t really need to say you’re sorry. If it did affect me, it didn’t “may have caused”. It caused! Stop wavering.

------------------------------------

http://37signals.com/svn/posts/1528-the-bullshit-of-outage-l...

From the hacking group:

all data was gathered from a public webserver with no password, accessible by anyone on the Internet.

Sounds like an AT&T's-website security breach (big shocker there, their sites are horrendous and half-broken at all times). Further down they describe the attack:

Members of the group used the UCC-ID that is on each iPad 3G and pinged the AT&T login page with it. That page returned an e-mail address associated with that iPad 3G. They then wrote a simple script to ping the page with a series of numbers repeatedly until they had 114,000 e-mail addresses.

So... AT&T is a moron (further shock. Can you feel the shock? It's shocking.). It has nothing to do with the iPad.

Why is AT&T making ALL "Hackers" out to be BAD? AT&T: That Huge iPad Security Breach Wasn't Our Fault -- It Was The Fault Of Bad People Called "Hackers"

Has anyone else seen the movie, "Hackers Wanted" [2008] that was narrated by Kevin Spacey?

> "that affected some of our customers with AT&T 3G service for iPad"

The way AT&T's whole email is worded seems as though AT&T went to great lengths to avoid clarifying if your particular email was stolen.

Are the ICC-ID numbers hard to guess, or are they sequential/predictable?