4chan may have remotely wiped a Clinton official’s iPhone and iPad

For a few days now, WikLeaks has been publishing select emails from Clinton campaign chairman John Podesta — and the leaks are starting to cause serious damage. Most likely obtained from a hacked archive file, the latest dump contains all sorts of sensitive info on Podesta with no obvious news value, including his Social Security number and enough info to compromise his Twitter account.

But the most painful casualty of the latest dump may have been Podesta’s iPhone. The leak contained Podesta’s Apple ID credentials, and a group of 4chan users claim to have used those credential to gain access to Podesta’s iCloud account. From there, they triggered a remote wipe of both an iPhone and iPad belonging to the campaign chief. Before the wipe, they also triggered the "Find My iPhone" function, posting a screenshot of the chief somewhere in Downtown Brooklyn, near the campaign headquarters. (Clinton herself is currently in California.)

---

Apparently some asshole from anonymous compromised Podesta's Apple account using creds in WL dump and remotely wiped his phone. V cruel. http://pic.twitter.com/ZdfWf2NkuY

— Pwn All The Things (@pwnallthethings) October 13, 2016

The users posted various other screenshots as evidence, but — 4chan being 4chan — it’s hard to be sure the screenshots weren’t altered or other information concealed. Still, such a hack is entirely plausible given the information available in the leak. iCloud has long been vulnerable to social engineering attacks, and such an attack would be far easier with the subject's social security number and other financial data available in the leak. If the Apple credentials included in the emails were genuine, such an attack would not even be necessary. Unless Podesta had two-factor authentication turned on, there would be little stopping the attackers from wiping the devices.