My first impression is that either a session token or password was intercepted from iCloud either via malware or MITM. But the post mentions that the iCloud pas

My first impression is that either a session token or password was intercepted from iCloud either via malware or MITM. But the post mentions that the iCloud password was reset, which means the account may have been hacked via Apple ID security questions[1] When I just did this for my own account, the first security question is your date of birth, which is easy to find for anybody via Facebook. The second was a generic security question. These are easy to guess or to find out via social media. You could spearfish a user by sending them a free account to a web service and asking them the same security questions on registration. The security isn't adequate, considering the data that is held behind an Apple ID. I also can't believe they have a delete feature that can not be undone. For my own account I have done a few things. First I have a secret email address for online accounts that require higher security. These emails are unique for each service and are not published anywhere. I have also removed all of my personal information from my social accounts, such as date of birth, name of school, etc. and my security answers are always random strings. The other option is that malware was used, or a transparent proxy. If iCloud doesn't verify the server certificate it would be straight forward to proxy the HTTPS requests. iCloud will also always send out connection attempts every x minutes, so if you accidentally connect to a public WiFI hotspot or personal network with an intercepting proxy setup, you can have your password stolen in a matter of minutes. I am also not super-confident about two-factor auth. I noticed that with Google Apps the verification SMS messages can be read using the web interface for my telco provider. A web interface that is protected by nothing more than an email address and password with the same weak security questions. I think it is very feasible to hack around second-factor SMS notifications by first hacking the telco provider web interface and reading then deleting the SMS alerts. You are only as secure as the weakest link in the chain. [1] https://iforgot.apple.com/cgi-bin/WebObjects/DSiForgot.woa/wa/iforgot https://iforgot.apple.com/cgi-bin/WebObjects/DSiForgot.woa/w...