Hacker News Reader

I expect they correlated logs from several sources, maybe the guy connected via ssh to Apple's servers at the same time his mac accessed software update or something. If he sent all traffic down the VPN it'd show the same IP address at Apple.

Yeah this article is kind of light on technical details. I’d love to see an in depth postmortem and see what Apple’s mitigation plan is.

Bear in mind this is filtered through a prosecutor, so is likely highly garbled:

>"A mobile phone and hard drive were also seized and the IP address ... matched the intrusions into the organisation."

This is clearly nonsense, the IP address as Apple saw it isn't likely to be anything recoverable from the devices - even if they logged past IPs, they are likely NATed.

My guess is the attack involved SSH (the article mentions "authorized keys") and Apple logged the SSH fingerprint of the accessing computer.

Sounds like Apple programs macbooks to phone home with serial numbers?

Probably didn't help to hack the company that makes the laptop he was using to hack.