Tweet
The criminal complaint includes Internet Relay Chat logs purportedly between Auernheimer and Spitler. Click to enlarge.Two men were charged with computer crimes today for allegedly hacking into AT&T servers and stealing e-mail addresses and other information of about 120,000iPad users last summer.
Andrew Auernheimer, 25, was arrested in his home town of Fayetteville, Ark., while appearing in state court on unrelated drug charges, and Daniel Spitler, 26, of San Francisco, surrendered to FBI agents in Newark, N.J., according to the U.S. Attorney's office in New Jersey. Both men were expected to appear before federal judges in Arkansas and New Jersey.
They each face one count of conspiracy to access a computer without authorization and one count of fraud in connection with personal information. They're also looking at a maximum of 10 years in prison and a $500,000 fine.
Last June, Auernheimer told CNET that members of his hacker group, which calls itself Goatse Security, uncovered a hole in AT&T's Web site used by iPad customers on the 3G wireless network and went public with it by revealing details to Gawker Media.
Up until then, AT&T automatically linked an iPad 3G user's e-mail address to the iPad's unique number, called Integrated Circuit Card Identifier (ICC-ID) so that whenever the customer accessed the AT&T Web site, the ICC-ID was recognized, the e-mail address was automatically populated and the ICC-ID was displayed in the URL in plain text.
Spitler is accused of writing a script called the "iPad 3G Account Slurper" and using it to harvest AT&T customer data via a brute force attack on the site that fooled the site into revealing the confidential information, according to the criminal complaint filed last week but unsealed and released publicly today.
The complaint includes Internet Relay Chat messages supposedly sent between Auernheimer and Spitler in which they talk about selling the e-mail addresses to spammers, shorting AT&T stock before releasing details of the breach, and destroying evidence.
"If we can get a big dataset we could direct market iPad accessories," Auernheimer says in a message to Spitler, according to the complaint.
In another chat session included in the compalint, Spitler says he would like to stay anonymous so he doesn't get sued. "Absolutely may be legal risk yeah, mostly civil you absolutely could get sued," Auernheimer replied, the complaint read.
Before going to Gawker, Auernheimer also allegedly contacted Thomson-Reuters and the San Francisco Chronicle, and sent an e-mail to a board member at News Corp. whose e-mail address was leaked in the breach in attempts to get news articles written about the incident, according to the complaint.
Asked if he reported the hole to AT&T, Auernheimer replied "totally but not really...I don't (expletive) care I hope they sue me," according to the chat logs.
"Those chats not only demonstrate that Spitler and Auernheimer were responsible for the data breach, but also that they conducted the breach to simultaneously damage AT&T and promote themselves and Goatse Security," the U.S. Attorney's office said in a statement.
AT&T has spent about $73,000 as a result of the breach, including contacting all iPad 3G customers to notify them, the complaint says. Among the iPad users who appeared to have been affected were White House Chief of Staff Rahm Emanuel, journalist Diane Sawyer, New York Mayor Michael Bloomberg, movie producer Harvey Weinstein, and New York Times CEO Janet Robinson.
Auernheimer did not return an e-mail seeking comment and Spitler could not be reached. AT&T did not immediately respond to a request for comment.
Auernheimer, a self-described Internet "troll," was arrested last June when authorities found drugs while searching his home for evidence related to the AT&T-iPad investigation. He was later released on bail.
Webmaster Forum | SEO Forum | Coding Forum | Graphics Forum</b>