10 ms·
Scanning your iPhone for Pegasus
- deleted 5y ago[deleted]
- htk 5y agoDoes anyone have any info on how widespread is Pegasus?
- getaclue 5y agoi think wrong question
- frickinLasers 5y agoThere's the list of targets we know about: https://cdn.occrp.org/projects/project-p/#/ https://cdn.occrp.org/projects/project-p/#/ And the Guardian has some in-depth reporting going on. https://www.theguardian.com/news/series/pegasus-project https://www.theguardian.com/news/series/pegasus-project None of this really answer how prevalent the spyware is, though.
- emsy 5y agoSomething like this should be available from Apple. But I guess they only offer privacy and security if it doesn’t require transparency. Well as long as it makes for good marketing.
- marderfarker2 5y agoAnd here I thought iOS with its walled garden approach would make these kinds of attacks impossible.
- whynotminot 5y agoWalls have never been fool proof, though that doesn't mean building them is a waste of time.
- marderfarker2 5y agoThey built it so high up nobody could tell what’s going on until you jailbreak the device.
- whynotminot 5y agoIf you're clamoring for "virus scanners" with root permissions in the App Store, I'll go ahead and say no thank you.
- fartcannon 5y agoThe walls are financial, not security. The security is a lie.
- whynotminot 5y agoBoth can be true at once. It's actually a pretty big security win that I don't have to worry about what my grandma downloaded from the internet for her iPhone for instance, the way I have to worry about her laptop. Apple profits from this, and I really don't mind.
- kapnobatairza 5y agoI ran this tool and found a trace that I was infected (malware detected in CrashReporter.plist). Any clue what I should be doing, if anything, to address this?
- biktor_gj 5y agoI'm no expert, but if you ask me, I would completely erase the phone, upgrade it via DFU, and start fresh. After setting it up again, run another backup and rerun the tool to doublecheck. That or ditch the phone
- makach 5y agoThis is an expert response.
- SheinhardtWigCo 5y agoThe last three words are.
- deleted 5y ago[deleted]
- newbamboo 5y agoWhat’s the best procedure for getting data off a compromised iPhone before wiping? Plugging it into other devices via usb or backing up to iCloud seems sketchy to me but maybe I’m overly paranoid.
- cronix 5y ago> Plugging it into other devices via usb You've never plugged your phone into your computer before? If so, I doubt it could cause more harm to do it again unless you haven't done it since your device was infected. You're just mentally aware of it now, but how long has it been there and how many devices have you plugged your phone into since then, even just to charge? If you never plug your phone into another device, it's moot, but I suspect most people do at sometime or another. "Hey, can I plug my phone in real quick to charge a bit" type stuff. Airdrop is good for quick, small files, but I'm not going to be transferring multiple gigabytes of 4k video via wifi speeds that way.
- josteink 5y agoAny way to check iPhones if you don’t have a Mac?
- deleted 5y ago[deleted]
- mercora 5y agoits in the article, i had overlooked it too though...
- grav 5y agoOn Arch Linux, I installed libimobiledevice from source (https://github.com/libimobiledevice/libimobiledevice https://github.com/libimobiledevice/libimobiledevice), as the newest version in Pacman didn't connect to my iPhone. I also installed usbmuxd via Pacman.
- veerabadhra 5y agoAfter installing it myself, I realized the container already has it. You just need to give the container access to your USB controller
- deleted 5y ago[deleted]
- carom 5y agoThis is really convoluted. There is a $3 app from the App Store called iVerify that checks. [1] 1. https://www.iverify.io/ https://www.iverify.io/
- karlshea 5y ago"checks"
- dguido 5y agoWe're using most of the exact same file-based indicators as MVT. It's really refreshing that Amnesty shared so much of what they found -- it made our own process of testing our checks against their discoveries much easier.
- arkadiyt 5y agoTrail of Bits hasn't shared what detections they're looking for with iVerify, but the app has extremely limited access to your device data - the device backup or full filesystem dump approaches will give you better detection.
- dguido 5y agoTrail of Bits here -- while this is mostly correct, there are also parts of the runtime that dead file forensics won't be able to identify. There's no harm in doing both and, in fact, we'd recommend it if you're concerned.
- rubatuga 5y agoYou need to jailbreak to do a complete file system dump to actually check if you’ve been infected by Pegasus. This is not the most accurate method.
- arkadiyt 5y agoDid you read the "Choosing your options" section of the blog post?
- rsync 5y agoIsn't "Pegasus" transmitted via a well-crafted iMessage ? If only there was a central choke-point, globally, for all iMessage messages that could weed out particularly ill-formed messages such that they never reach your phone ... If only ...
- SheinhardtWigCo 5y agoBecause of E2EE that choke point is necessarily the software update process.
- rsync 5y agoAhh... right. Thank you. Wouldn't a simple block/allow list for sending IDs / phone numbers be trivial to implement on the iCloud (or whatever) side of things such that the end user could allow their known contacts and block (everyone else) ? Forgive me - I am not an iMessage user ...
- SheinhardtWigCo 5y agoApple product marketing would never sign off on that because it would a) confuse their messaging by signaling that iMessage is less safe than email, b) hurt the user experience for the vast majority of customers.
- arkadiyt 5y agoApple doesn't have access to the message content thanks to end-to-end encryption (technically they can have access if you backup your messages to iCloud, but by that point it's already too late). However they are working on better sandboxing to help prevent this class of attacks, and Google Project Zero posted an overview of how that "blastdoor" process works: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...
- marderfarker2 5y agoIn the Amnesty report there were multiple attack vectors, one of which is via network hijacking which involves data mangling by network operators. Now it begs the question whether the network operators were in cahoots or this Pegasus is also capable of infecting network infrastructure.
- darig 5y agoSo... you're curious if your phone has government sponsored malware on it... and the solution is to image the phone and copy everything over to a different computer?? Including the possible GOVERNMENT SPONSORED MALWARE?? Don't be dumb.
- lambda_dn 5y agoWhat if the mobile verification toolkit is Pegasus?
- e40 5y agoFor me, on macOS, I had encrypted backups already turned on, using the Finder. So, when I did the "mvt-ios decrypt-backup" I omitted the "-p ..." and gave my login password. I had assumed that the Finder-initiated backups would use it, and it appears to be the case (the decryption data looks good to me).