Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Scanning your iPhone for Pegasus

arkadiyt.com

Post reply on HN
Print view View original

61–70 of 81 posts

Re: Scanning your iPhone for Pegasus

#61

Post by ignoramous »

g_p wrote: post #60
ignoramous wrote: post #56

Earlier quoted context omitted.

You'd likely need to do several things, but one mitigation is to set up a network-wide firewall to block everything except IPs and domains you explicitly add to allowlist, and only connect your devices through the firewall. For iOS, I don't believe a capable on-device firewall exists; but even if it did, NSO likely may have compromised it too. Also: If it amounts to unlawful tapping where you live [0], you may want t…

I don't believe there are proper application level firewalls. You can however (at least if the entire OS isn't compromised at the time of the network requests) get something which is better than nothing through the private DNS API. If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly. While keep…

> If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly.

Pegasus can always DoH its DNS queries to a server of its choosing bypassing any and all network-wide / os-wide DNS settings. Granted IoCs can be set to flag such behaviour. Besides, DNS and ICMP can be additionally be used to siphon off data too.

When used carefully, IP firewalls make for a good defence.

> ...if you're concerned about skilled attacker threat models - code execution in the browser via a delivered ad isn't something you want to make easy!

True. If NSO group is in your threat-model, it definitely warrants extreme paranoia and caution.

Re: Scanning your iPhone for Pegasus

#62

Post by g_p »

dexter0 wrote: post #59
kapnobatairza wrote: post #8

I ran this tool and found a trace that I was infected (malware detected in CrashReporter.plist). Any clue what I should be doing, if anything, to address this?

Did you intentionally disable Settings > Privacy > Analytics & Improvements > Share iPhone Analytics ? From https://www.amnesty.org/en/latest/research/2021/07/forensic-... > "At around the same time the file com.apple.CrashReporter.plist file was written in /private/var/root/Library/Preferences/, likely to disable reporting of crash logs back to Apple."

This is a very good question and one to check - merely having crash logs disabled (at least for an HN audience) isn't a high information signal.

I've got crash logs and as much analytics and telemetry disabled in a custom provisioning profile just to save having to navigate through menus to turn everything off...

Would need to test this on one of those devices to see if there's a false positive as a result though. But it's possible this is a false alarm if it's just checking for existence of this file. Has anyone checked through the logic the tester uses?

Re: Scanning your iPhone for Pegasus

#63

Post by g_p »

ignoramous wrote: post #61
g_p wrote: post #60

Earlier quoted context omitted.

I don't believe there are proper application level firewalls. You can however (at least if the entire OS isn't compromised at the time of the network requests) get something which is better than nothing through the private DNS API. If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly. While keep…

> If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly. Pegasus can always DoH its DNS queries to a server of its choosing bypassing any and all network-wide / os-wide DNS settings. Granted IoCs can be set to flag such behaviour. Besides, DNS and ICMP can be additionally be used to siphon off da…

Good point - perhaps didn't make the limitations clear enough though - this would only help if the early payload gets delivered through a request made to a remote server (which inherently goes through default system DNS).

That's a fairly common compromise model though in my view - a message might contain a URL, and your phone might locally do a fetch of it to prepare a pretty preview, and that might try to exploit some weakness in the browser engine or whatever.

Given this was delivered via iMessage you're right - once they have code execution, the attacker can evade your DNS. If they can't get enough code in through their initial method to get their own DNS going, they might send a dropper which then pulls more code in from elsewhere, and that may give you an IOC to detect from that first query. If they can front their content on a popular domain though, this won't help.

Definitely favour network level protections before doing this, but if you just want the ability to get a view of your own DNS traffic from your device when it moves across WiFi and mobile data, this will give you a starting point.

Re: Scanning your iPhone for Pegasus

#64

Post by NotSammyHagar »

ASalazarMX wrote: post #57
TechBro8615 wrote: post #47

Earlier quoted context omitted.

No malware except for the google operating system

And no spyware besides your documents being in Google's storage.

Store your files in local files, running on their Linux "crostini". Apple and android have hundreds, probably thousands of documented attacks, plus known companies attacking them with rats and various spyware. There's an article a day. Apple took apps off their app store to satisfy the Chinese govt and hurt Hong Kong democratic resistance. Google has paid hackers for various attempts to break into chrome os, most of them were really chrome attacks but the signed os images have generally brought safety. Linux even has many known su root attacks plus malware and supply chain attacks.

You are just foolish not to consider chrome os.

Re: Scanning your iPhone for Pegasus

#65

Post by fartcannon »

whynotminot wrote: post #55
cronix wrote: post #50

Earlier quoted context omitted.

> I don't have to worry about what my grandma downloaded from the internet for her iPhone Yet you're ironically responding about an article telling how to find if your iPhone has been infected with Pegasus, one of the worst most obtrusive security vulnerabilities you can have, period.

Do you think nation states who spent a fortune on Pegasus are going after my grandmother? I think you're missing the big picture for most normal people.

Worse yet, you can't actually scan your phone without jail breaking it. Without knocking down the financial wall, your phone is insecure.

Re: Scanning your iPhone for Pegasus

#66

Post by [deleted] »

g_p wrote: post #63
ignoramous wrote: post #61

Earlier quoted context omitted.

> If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly. Pegasus can always DoH its DNS queries to a server of its choosing bypassing any and all network-wide / os-wide DNS settings. Granted IoCs can be set to flag such behaviour. Besides, DNS and ICMP can be additionally be used to siphon off da…

Good point - perhaps didn't make the limitations clear enough though - this would only help if the early payload gets delivered through a request made to a remote server (which inherently goes through default system DNS). That's a fairly common compromise model though in my view - a message might contain a URL, and your phone might locally do a fetch of it to prepare a pretty preview, and that might try to exploit so…

[deleted]

Re: Scanning your iPhone for Pegasus

#67

Post by whynotminot »

fartcannon wrote: post #65
whynotminot wrote: post #55

Earlier quoted context omitted.

Do you think nation states who spent a fortune on Pegasus are going after my grandmother? I think you're missing the big picture for most normal people.

Worse yet, you can't actually scan your phone without jail breaking it. Without knocking down the financial wall, your phone is insecure.

still missing the point

Re: Scanning your iPhone for Pegasus

#68

Post by fartcannon »

whynotminot wrote: post #67
fartcannon wrote: post #65

Earlier quoted context omitted.

Worse yet, you can't actually scan your phone without jail breaking it. Without knocking down the financial wall, your phone is insecure.

still missing the point

Nope, the point is that the security is not only not real (tfa) but it's actually worse since you need to root to detect it.

Re: Scanning your iPhone for Pegasus

#70

Post by whynotminot »

marderfarker2 wrote: post #21
whynotminot wrote: post #19

Earlier quoted context omitted.

Walls have never been fool proof, though that doesn't mean building them is a waste of time.

They built it so high up nobody could tell what’s going on until you jailbreak the device.

If you're clamoring for "virus scanners" with root permissions in the App Store, I'll go ahead and say no thank you.
Post reply on HN