Student hacked into Apple servers and downloaded 90GB of ‘secure files’

"computerised tunnels and online bypassing systems"

Yeah this article is kind of light on technical details. I’d love to see an in depth postmortem and see what Apple’s mitigation plan is.

Sounds like Apple programs macbooks to phone home with serial numbers?

I expect they correlated logs from several sources, maybe the guy connected via ssh to Apple's servers at the same time his mac accessed software update or something. If he sent all traffic down the VPN it'd show the same IP address at Apple.

Bear in mind this is filtered through a prosecutor, so is likely highly garbled:

>"A mobile phone and hard drive were also seized and the IP address ... matched the intrusions into the organisation."

This is clearly nonsense, the IP address as Apple saw it isn't likely to be anything recoverable from the devices - even if they logged past IPs, they are likely NATed.

My guess is the attack involved SSH (the article mentions "authorized keys") and Apple logged the SSH fingerprint of the accessing computer.

And then doesn't disclose the breach to its customers.