In June 2010, Goatse Security obtained theemail addresses of approximately 114,000 Apple iPad users. This led to anFBI investigation and the filing of criminal charges against two of the group's members.
The GNAA had several security researchers within its membership. According to Goatse Security spokesperson Leon Kaiser, the GNAA could not fully utilize their talents since the group believed that there would not be anyone who would take security data published by the GNAA seriously. In order to create a medium through which GNAA members can publish their security findings, the GNAA created Goatse Security in December 2009.[2][3]
In order to protect its web browser frominter-protocol exploitation,Mozilla blocked severalports thatHTML forms would not normally have access to. In January 2010, the GNAA discovered that Mozilla's blocks did not coverport 6667, which left Mozilla browsers vulnerable to cross-protocol scripts. The GNAA crafted aJavaScript-basedexploit in order tofloodIRC channels. AlthoughEFnet andOFTC were able to block the attacks,Freenode struggled to counteract the attacks. Goatse Security exposed the vulnerability, and one of its members, Andrew Auernheimer, aka "weev," posted information about the exploit onEncyclopedia Dramatica.[19][20][21]
In March 2010, Goatse Security discovered aninteger overflow vulnerability within Apple's web browser,Safari, and posted an exploit on Encyclopedia Dramatica.[22] They found out that a person could access a blocked port by adding 65,536 to the port number.[23][24] This vulnerability was also found inArora,[25]iCab,[26]OmniWeb,[27] and Stainless.[28] Although Apple fixed the glitch for desktop versions of Safari in March, the company left the glitch unfixed in mobile versions of the browser.[22][29] Goatse Security claimed that a hacker could exploit the mobile Safari flaw in order to gain access and cause harm to the AppleiPad.[22][29]
In June 2010, Goatse Security uncovered a vulnerability within theAT&T website.[30][31] AT&T was the only provider of3G service forApple'siPad in theUnited States at the time.[32] When signing up for AT&T's 3G service from an iPad, AT&T retrieves theICC-ID from the iPad'sSIM card and associates it with the email address provided during sign-up.[30][33] In order to ease the log-in process from the iPad, the AT&T website receives the SIM card's ICC-ID and pre-populates the email address field with the address provided during sign-up.[30][33] Goatse Security realized that by sending aHTTP request with a valid ICC-ID embedded inside it to the AT&T website, the website would reveal the email address associated with that ICC-ID.[30][33]
On June 5, 2010, Daniel Spitler, aka "JacksonBrown", began discussing this vulnerability and possible ways to exploit it, includingphishing, on an IRC channel.[8][34][35] Goatse Security constructed aPHP-basedbrute force script that would send HTTP requests with random ICC-IDs to the AT&T website until a legitimate ICC-ID is entered, which would return the email address corresponding to the ICC-ID.[30][33] This script was dubbed the "iPad 3G Account Slurper."[35]
Goatse Security then attempted to find an appropriate news source to disclose the leaked information, with Auernheimer attempting to contactNews Corporation andThomson Reuters executives, includingArthur Siskind, about AT&T's security problems.[36] On June 6, 2010, Auernheimer sent emails with some of the ICC-IDs recovered in order to verify his claims.[34][36] Chat logs from this period also reveal that attention and publicity may have been incentives for the group.[37]
Contrary to what it first claimed, the group initially revealed the security flaw toGawker Mediabefore notifying AT&T[37] and also exposed the data of 114,000 iPad users, including those of celebrities, the government and the military. These tactics re-provoked significant debate on the proper disclosure of IT security flaws.[38]
Auernheimer has maintained that Goatse Security used common industry standard practices and has said that, "We tried to be the good guys".[38][39]Jennifer Granick of theElectronic Frontier Foundation has also defended the tactics used by Goatse Security.[38]
On June 14, 2010,Michael Arrington ofTechCrunch awarded the group a Crunchie award for public service. This was the first time a Crunchie was awarded outside the annual Crunchies award ceremony.[40][41]
TheFBI then opened an investigation into the incident,[42] leading to a criminal complaint in January 2011[10] and a raid on Auernheimer's house. The search was related to the AT&T investigation and Auernheimer was subsequently detained and released on bail[43] on state drug charges,[44] later dropped.[45] After his release on bail, he broke agag order to protest and to dispute the legality of the search of his house and denial of access to apublic defender. He also asked for donations viaPayPal, to defray legal costs.[15][46] In 2011 the Department of Justice announced that he will be charged with one count of conspiracy to access a computer without authorization and one count of fraud.[45] A co-defendant, Daniel Spitler, was released on bail.[47][48]
On November 20, 2012, Auernheimer was found guilty of one count of identity fraud and one count of conspiracy to access a computer without authorization,[49] andtweeted that he would appeal the ruling.[50] Alex Pilosov, a friend who was also present for the ruling, tweeted that Auernheimer would remain free on bail until sentencing, "which will be at least 90 days out."[51]
On November 29, 2012, Auernheimer authored an article inWired Magazine entitled "Forget Disclosure - Hackers Should Keep Security Holes to Themselves," advocating the disclosure of anyzero-day exploit only to individuals who will "use it in the interests of social justice."[52]
On April 11, 2014, the Third Circuit issued an opinion vacating Auernheimer's conviction, on the basis that venue in New Jersey was improper.[53][54] The judges did not address the substantive question on the legality of the site access.[55] He was released from prison late on April 11.[56]
In May 2011, aDoS vulnerability affecting severalLinux distributions was disclosed by Goatse Security, after the group discovered that a lengthyAdvanced Packaging Tool URL would causecompiz to crash.[57]
In September 2012, Goatse Security was credited byMicrosoft for helping to secure their online services.[9]
^abCriminal ComplaintArchived January 25, 2011, at theWayback Machine. United States District Court – District Court of New Jersey, Docket: MAG 11-4022 (CCC). Filed with the court January 13, 2011
