A Simple Explanation of the GoatSec iPad not-Hack

A Simple Explanation of How the Goatse Security "Account Slurper" Script Worked:

Disclaimer:
     I am not a member of Goatse Security, nor am I a member of their affiliated trolling group GNAA.
     I have never seen the code for the Account Slurper, nor have I ever engaged in a conversation with
     anyone connected to GoatSec or GNAA or Gawker regarding its implementation. This I pieced together just
     from reading the news articles regarding this case, and my own knowledge of computer science.

     Publishing this is perfectly legal because 1) Anyone who knows how to implement this algorithm already
     knows how to do this anyway. 2) It's a very simple algorithm. 3) Educational purposes for developers
     in order to better defend against simple exploits.

     And to be honest, it's pathetic that something this simple was able to be used as an exploit. Seriously.

Definition of terms:
     SIM: Subscriber Identity Module, a chip present in all cellular devices that identifies the device as
          belonging to a particular user, and contains the digital key allowing a device to connect to a
          network.

     ICCID: A unique serial number that identifies a particular SIM card - essentially, it is the unique
            identifier for a particular device. It's easy to find a possible ICCID, but ideally only you,
            your phone and the phone company should be able to find the link between your ICCID and your
            identity.

     URL: A string of characters that identifies a webpage. For example, the URL
          https://www.youtube.com/watch?v=oF5fIHhsHeM points to a YouTube video parodying the Church of
          Scientology, and the 'hacker' group Anonymous.

The Algorithm:

Create text file for email address log.

integer icc = <lowest possible value for ICCID>
integer max = <highest possible value for ICCID>

do {
     URL = "http://fake-example.com/some-page&showID?sim=" + icc
     open URL
     copy email address from page
     paste email address into log file
     icc = icc + 1
} while icc is less than or equal to max

Discussion:
     As you can see, this is a very simple algorithm. All you do is guess an ICCID, and plug it into a URL.
     If it's valid, it gives you an email address, and now you can link a particular device with a particular
     person. No password. No authentication that you are who you say you are.

     If the Chinese Patriotic Hacker Associations, or organized crime happened to get a hold of this link,
     and you happened to be a big enough target for them, you know that they would try to break into your
     device. And the email addresses of several CEOs of large companies, along with high ranking members of
     the Obama Administration were discovered using this script.

     Now, I get that this made users lives easier when they connected to AT&T websites. I get that. And there
     are ways to get the functionality, that IS secure. One way I can think of is to use Digital Signatures,
     which proves that you are exactly who you say you are, and so that nobody can impersonate you. This is
     very easy to code up, and I'm sure there are other methods out there.

     Long story short, AT&T did something very irresponsible, and Goatse Security did a public service by
     informing the media of this security hole.

     The irony is that back in the day, AT&T, which owned Bell Labs, created the C programming language and
     Unix operating system, which was and is still widely praised for its security and stability.
     Microsoft, on the other hand, is frequently criticized by the same people for insecurity and instability.
     Microsoft, unlike AT&T, publicly thanks people who point out security flaws to them.