ChrisPaget writes: I'm somewhat of an authority on GSM security, having given presentations on it at Shmoocon and CCC (I'm also scheduled to talk about GSM at this year's Defcon). This is my take on the iPad ICCID disclosure — the short version is that (thanks to a bad decision by the US cell companies, not just AT&T) ICCIDs can be trivially converted to IMSIs, and the disclosure of IMSIs leads to some very severe consequences such as name and phone number disclosure, global tower-level tracking, and making live interception a whole lot easier. My recommendation? AT&T have 114,000 SIM cards to replace and some nasty architectural problems to fix.
"In the face of entropy and nothingness, you kind of have to pretend it's not
there if you want to keep writing good code." -- Karl Lehenbauer