Red Toad, Blue Toad, Hacked Toad?

Towards the end of 2012, it was announced by AntiSec, a small labeled sub-group of an anonymous hacktivists, that they leaked one million UDIDs of Apple users. AntiSec claimed the data were taken from a laptop that belonged to an agent who works for the authorities. However, it was later found that the trustworthy source of the leak was a small digital publishing company called BlueToad. In this paper, we investigate the motivation and methods of AntiSec by analyzing the data. There are many inconsistencies surrounding how the leak happened. As far as we know, there has never been a confirmed statement on how the data were accessed, but there are multiple theories. This paper examines the three main claims behind the data leak. We found that AntiSec was able to exploit the system through the vulnerability CVE-2012-0507. AntiSec could have used the UDIDs to track and collect Apple Users' private data; instead, they published the data to the public and blamed authorities for data collection. We analyzed the ramifications of AntiSec's decision. While it was never explicitly announced by BlueToad how they remedied the vulnerability, we provide the defense solutions they should have taken. We offer general tips for users to protect themselves from future attacks. We also detail some alternatives to using the UDID and which implementation Apple chose for their UDID replacement.