Scanning your iPhone for Pegasus • Hacker News Board

Re: Scanning your iPhone for Pegasus

#51

Post by newbamboo » Sun, Aug 01, 2021, 9:54 PM UTC

cronix wrote: post #49

newbamboo wrote: post #26

Earlier quoted context omitted.

What’s the best procedure for getting data off a compromised iPhone before wiping? Plugging it into other devices via usb or backing up to iCloud seems sketchy to me but maybe I’m overly paranoid.

> Plugging it into other devices via usb You've never plugged your phone into your computer before? If so, I doubt it could cause more harm to do it again unless you haven't done it since your device was infected. You're just mentally aware of it now, but how long has it been there and how many devices have you plugged your phone into since then, even just to charge? If you never plug your phone into another device,…

Thanks. Wasn’t sure how airdrop worked so wasn’t sure if connecting a compromised device that way was a concern. Unfortunately there is no info out there because the official line is “all apple devices are secure don’t worry!”

Re: Scanning your iPhone for Pegasus

#52

Post by e40 » Sun, Aug 01, 2021, 9:57 PM UTC

For me, on macOS, I had encrypted backups already turned on, using the Finder. So, when I did the "mvt-ios decrypt-backup" I omitted the "-p ..." and gave my login password. I had assumed that the Finder-initiated backups would use it, and it appears to be the case (the decryption data looks good to me).

Re: Scanning your iPhone for Pegasus

#53

Post by dguido » Sun, Aug 01, 2021, 10:28 PM UTC

arkadiyt wrote: post #34

carom wrote: post #18

This is really convoluted. There is a $3 app from the App Store called iVerify that checks. [1] 1. https://www.iverify.io/

Trail of Bits hasn't shared what detections they're looking for with iVerify, but the app has extremely limited access to your device data - the device backup or full filesystem dump approaches will give you better detection.

Trail of Bits here -- while this is mostly correct, there are also parts of the runtime that dead file forensics won't be able to identify. There's no harm in doing both and, in fact, we'd recommend it if you're concerned.

Re: Scanning your iPhone for Pegasus

#54

Post by dguido » Sun, Aug 01, 2021, 10:30 PM UTC

karlshea wrote: post #23

carom wrote: post #18

This is really convoluted. There is a $3 app from the App Store called iVerify that checks. [1] 1. https://www.iverify.io/

"checks"

We're using most of the exact same file-based indicators as MVT. It's really refreshing that Amnesty shared so much of what they found -- it made our own process of testing our checks against their discoveries much easier.

Re: Scanning your iPhone for Pegasus

#55

Post by whynotminot » Sun, Aug 01, 2021, 10:35 PM UTC

cronix wrote: post #50

whynotminot wrote: post #46

Earlier quoted context omitted.

Both can be true at once. It's actually a pretty big security win that I don't have to worry about what my grandma downloaded from the internet for her iPhone for instance, the way I have to worry about her laptop. Apple profits from this, and I really don't mind.

> I don't have to worry about what my grandma downloaded from the internet for her iPhone Yet you're ironically responding about an article telling how to find if your iPhone has been infected with Pegasus, one of the worst most obtrusive security vulnerabilities you can have, period.

Do you think nation states who spent a fortune on Pegasus are going after my grandmother?

I think you're missing the big picture for most normal people.

Re: Scanning your iPhone for Pegasus

#56

Post by ignoramous » Sun, Aug 01, 2021, 11:03 PM UTC

kapnobatairza wrote: post #8

I ran this tool and found a trace that I was infected (malware detected in CrashReporter.plist). Any clue what I should be doing, if anything, to address this?

You'd likely need to do several things, but one mitigation is to set up a network-wide firewall to block everything except IPs and domains you explicitly add to allowlist, and only connect your devices through the firewall.

For iOS, I don't believe a capable on-device firewall exists; but even if it did, NSO likely may have compromised it too.

Also: If it amounts to unlawful tapping where you live [0], you may want to consider a legal recourse (like signing up for a class-action?).

[0] https://en.wikipedia.org/wiki/Telephone_tapping#Legal_status

Re: Scanning your iPhone for Pegasus

#57

Post by ASalazarMX » Sun, Aug 01, 2021, 11:08 PM UTC

TechBro8615 wrote: post #47

NotSammyHagar wrote: post #33

Earlier quoted context omitted.

How about use your phone as only a data modem and do everything on a chrome os device, which have no known malware. Just don't install chrome extensions and you are safe. Also avoid installing apps on your phone This is basically what I wish I had, except back in reality there's no Chrome device that's the size of my cell phone. There are some with cellular modems.

No malware except for the google operating system

And no spyware besides your documents being in Google's storage.

Re: Scanning your iPhone for Pegasus

#58

Post by ASalazarMX » Sun, Aug 01, 2021, 11:19 PM UTC

marderfarker2 wrote: post #35

rsync wrote: post #25

Isn't "Pegasus" transmitted via a well-crafted iMessage ? If only there was a central choke-point, globally, for all iMessage messages that could weed out particularly ill-formed messages such that they never reach your phone ... If only ...

In the Amnesty report there were multiple attack vectors, one of which is via network hijacking which involves data mangling by network operators. Now it begs the question whether the network operators were in cahoots or this Pegasus is also capable of infecting network infrastructure.

> Now it begs the question whether the network operators were in cahoots or this Pegasus is also capable of infecting network infrastructure.

They can use fake cell towers, no need to escalate that far.

Re: Scanning your iPhone for Pegasus

#59

Post by dexter0 » Sun, Aug 01, 2021, 11:23 PM UTC

kapnobatairza wrote: post #8

I ran this tool and found a trace that I was infected (malware detected in CrashReporter.plist). Any clue what I should be doing, if anything, to address this?

Did you intentionally disable Settings > Privacy > Analytics & Improvements > Share iPhone Analytics ?

From https://www.amnesty.org/en/latest/research/2021/07/forensic-...>

"At around the same time the file com.apple.CrashReporter.plist file was written in /private/var/root/Library/Preferences/, likely to disable reporting of crash logs back to Apple."

Re: Scanning your iPhone for Pegasus

#60

Post by g_p » Mon, Aug 02, 2021, 12:15 AM UTC

ignoramous wrote: post #56

kapnobatairza wrote: post #8

I ran this tool and found a trace that I was infected (malware detected in CrashReporter.plist). Any clue what I should be doing, if anything, to address this?

You'd likely need to do several things, but one mitigation is to set up a network-wide firewall to block everything except IPs and domains you explicitly add to allowlist, and only connect your devices through the firewall. For iOS, I don't believe a capable on-device firewall exists; but even if it did, NSO likely may have compromised it too. Also: If it amounts to unlawful tapping where you live [0], you may want t…

I don't believe there are proper application level firewalls. You can however (at least if the entire OS isn't compromised at the time of the network requests) get something which is better than nothing through the private DNS API.

If you configure your own private DNS server over DNS-over-HTTPS, and have your own logging on it, you can review your DNS logs across any devices configured to use it, rapidly.

While keeping a log of your own DNS queries might be a risk for some threat models, if you aren't doing this, chances are you were sending your DNS traffic in the clear to your ISP or mobile operator (or into a VPN provider of questionable trust). You probably aren't a huge amount more exposed by logging it for yourself.

This let me check for any of the IOC domains given in the write-up. While no doubt there will be attacks which could override the provisioning profile that forces this DNS to be used, it would still need to get into the system without making a query that's part of the IOCs. That limits attack vectors a fair bit - the payloads here seemed to do a fair bit of network-based fetching of subsequent payloads. The hostnames of these requests should be logged on your DNS and enable you to rapidly confirm if exposed.

As a bonus you can do host level ad blocking via this DNS server, which should definitely be the minimum you do if you're concerned about skilled attacker threat models - code execution in the browser via a delivered ad isn't something you want to make easy!