7 ms·

iOS, https://docs.mvt.re/en/latest/ios/methodology/ https://docs.mvt.re/en/latest/ios/methodology/ > You will need to decide whether to attempt to jailbreak th

iOS, https://docs.mvt.re/en/latest/ios/methodology/ https://docs.mvt.re/en/latest/ios/methodology/ > You will need to decide whether to attempt to jailbreak the device and obtain a full filesystem dump, or not. Since Apple won't allow iDevice owners to access an unredacted raw disk image for forensics, iOS malware detection tools are hamstrung. The inability to fully backup devices means that post-intrusion device restore is literally impossible. Only a new OS version can be installed, then a subset of the original data can be restored, then every app/service needs to re-establish trust with this newly "untrusted" (but more trustworthy than the previously trusted-but-compromised) device. In theory, Apple could provide their own malware analysis toolset, or provide optional remote attestation to verify OS and baseband integrity. In the absence of persistent disk artifacts, the next best option is behavioral analysis, e.g. usage anomalies ("dog that did not bark") in CPU, battery, storage or network. Outbound network traffic can be inspected by a router and compared against expected application and system traffic. This requires an outbound firewall where rules can specify traffic by wildcard domain names, which are widely used by CDNs. Apple helpfully provides a list of domains and port numbers for all Apple services.

that_lurker 2y ago
Unless I remember incorrectly doesn’t iOS do an integrity verification at system boot.
- transpute 2y ago
  Has anyone seen an iOS device fail to boot due to an integrity violation? Whatever it's verifying is insufficient to stop persistent iOS malware, hence the existence of the MVT toolkit, which itself can only identify a small subset of real-world attacks. For evidence, look no further than the endless stream of zero-day CVEs in Apple Security Updates for iOS. Recovery from iOS malware often requires DFU (Device Firmware Update) mode reinstallation from a separate device running macOS. Non-persistent iOS malware can be flushed by a device hot-key reboot which prevents malware from simulating the appearance of a reboot.
  - saagarjha 2y ago
    Persistent iOS malware is quite rare these days.
    - transpute 2y ago
      Rare, expensive and extant.
  - FirmwareBurner 2y ago
    >Non-persistent iOS malware can be flushed by a device hot-key reboot which prevents malware from simulating the appearance of a reboot. The question is how often do users usually reboot their phone these days?
    - transpute 2y ago
      Regularly, if using iOS Lockdown Mode to increase resilience to malware.
      - FirmwareBurner 2y ago
        And how many users do that regualrly?
        transpute 2y ago
        Before or after their device, data and communication is compromised?
        FirmwareBurner 2y ago
        How many users know when their data is compromised?
        transpute 2y ago
        We're approaching "if a tree falls in a forest" territory.. the cryptocurrency community has a few stories.
- Joel_Mckay 2y ago
  Most modern malware is not disk resident, as it has a higher probability of persisting by re-infection with an undocumented zero-day. For example, people that play games that bind the GPS location services will find interruptions magically stop for awhile after a cold power-off, and power-on restart. Or the battery performance suddenly stops quickly losing power in standby, as recording/image capture was burning power and data budgets. Ultimately, a smartphone is impossible to fully secure, as the complexity has a million holes in it regardless of the brand. And Gemini is a whole can of worms I'd rather not discuss without my lawyer present. =3
- saagarjha 2y ago
  Integrity verification of what? The OS definitely has its signature/hash checked.
  - numpad0 2y ago
    # if [ 'beefcafebeef' != $(dd if=/dev/mtdblock3 | sha256sum) ]; then
- bri3d 2y ago
  Starting in iPadOS and iOS 15, iOS and macOS use a similar Signed System Volume concept and the System volume's integrity is verified.
heavymetalpoizn 2y ago
[dead]
mschuster91 2y ago
> Since Apple won't allow iDevice owners to access an unredacted raw disk image for forensics, iOS malware detection tools are hamstrung. And it's not just Apple. Android is just as bad, and even worse for the user because while iOS backups are consistent in backing up everything sans stuff in the Secure Enclave (i.e. credit card and eSIM keys), in Android support for backup is optional for apps and there are many games who just outright don't do any kind of backup.
- fc417fc802 2y ago
  This is true and I resent it. However, at least you have the option of installing a ROM that supports toggling adb root out of the box. That alone solves 99% of the issues I have with Android in practice.
  - mschuster91 2y ago
    > However, at least you have the option of installing a ROM that supports toggling adb root out of the box. That's not valid for all devices, all Samsungs need a cooldown of one week (Knox lock, presumably to thwart people from rooting stolen devices to bypass antitheft), all modern Androids require a full wipe of the device as part of rooting so it's useless for forensics, and a shitload of apps will flat out refuse to work on rooted devices - forget many games, forget anything with streaming, forget banking apps.
    - fc417fc802 2y ago
      It works for forensics if you already had the OS installed. The fact that the process of flashing a new OS wipes the device is a good thing (consider what the alternatives are). Obviously I feel the user should always have had root. Switching the OS is a fix for that. Not choosing to do that is the same as the choice to purchase a locked device. > shitload of apps will flat out refuse to work on rooted devices People say this but so far most stuff has worked for me on lineage with microg. The adb root toggle isn't detectable as far as I know. Their only realistic option is to require SafetyNet.
pogue 2y ago
Would DNS logs suffice? You could use service that offers logs of DNS like NextDNS or a Pi-Hole to watch DNS traffic from the device, but you wouldn't know which app sent it and for what purpose.
- transpute 2y ago
  It might be useful in some cases. Charles Proxy on iOS uses a local VPN profile to associate network traffic with applications.
matheusmoreira 2y ago
> provide optional remote attestation to verify OS and baseband integrity And lock us out of our computing freedom while they're at it. Remote attestation enables discrimination against free computers owned by users rather than corporations. They could theoretically allow users to set their own keys but it's not like apps and services are gonna trust people's personal attestation keys, they're only gonna trust Apple's and Google's. This is among the most dangerous developments in cryptography to date and it's gonna end free computing as we know it today. Before this, cryptography used to empower people like us. Now it's the tool that will destroy our freedom and everything the word "hacker" ever stood for. Malware is a small price to pay to avoid such a fate. It's not going to be "optional" either. Every major service is going to use it. Guaranteed.
- fc417fc802 2y ago
  IIRC wasn't it Librem that wanted to have the device attest itself to the user (ie a second device)? Agreed though. Any major vendor deploying this globally and making it available to developers without restriction would be an affront to our freedom.
  - matheusmoreira 2y ago
    > Any major vendor deploying this globally and making it available to developers without restriction would be an affront to our freedom. Google and Apple have already done it. And one day it'll show up in desktops too.
- transpute 2y ago
  > Remote attestation enables discrimination against free computers owned by users rather than corporations. Not when my mobile device is attesting to my home server with OSS attestation software, or my USB Armory with OSS firmware for local "remote" attestation. GrapheneOS can attest to a 2nd mobile device running GrapheneOS, or a web verifier. This is not rocket science. Provide a mobile setting for attestation server URL. > Every major service is going to use it. Guaranteed. Hence there must be a mandatory option to define your attestation server. Advocating for the right to specify and/or host your arbiter of device trust (including firmware RoT) will do infinitely more for freedom than arguing against cryptography.
rvnx 2y ago
The fact that iPhones are hard to dump is actually the main protection against threats when your phone is stolen or taken away from you (from a more or less legitimate-looking organization or person). It's a pretty good thing overall.
- deleted 2y ago
  [deleted]
- transpute 2y ago
  Why must that prevent backup from an Apple Configurator MDM-supervised device that is paired to an admin Macbook, with MDM policy to prevent mobile pairing with any other Macbook? There is a full cryptographic chain to verify the supervising device, which already has full MDM policy control of the mobile device. What security is being added by preventing that authorized supervisor from doing a forensic backup?

that_lurker 2y ago

Unless I remember incorrectly doesn’t iOS do an integrity verification at system boot.

transpute 2y ago
Has anyone seen an iOS device fail to boot due to an integrity violation? Whatever it's verifying is insufficient to stop persistent iOS malware, hence the existence of the MVT toolkit, which itself can only identify a small subset of real-world attacks. For evidence, look no further than the endless stream of zero-day CVEs in Apple Security Updates for iOS. Recovery from iOS malware often requires DFU (Device Firmware Update) mode reinstallation from a separate device running macOS. Non-persistent iOS malware can be flushed by a device hot-key reboot which prevents malware from simulating the appearance of a reboot.
- saagarjha 2y ago
  Persistent iOS malware is quite rare these days.
  - transpute 2y ago
    Rare, expensive and extant.
- FirmwareBurner 2y ago
  >Non-persistent iOS malware can be flushed by a device hot-key reboot which prevents malware from simulating the appearance of a reboot. The question is how often do users usually reboot their phone these days?
  - transpute 2y ago
    Regularly, if using iOS Lockdown Mode to increase resilience to malware.
    - FirmwareBurner 2y ago
      And how many users do that regualrly?
      - transpute 2y ago
        Before or after their device, data and communication is compromised?
        FirmwareBurner 2y ago
        How many users know when their data is compromised?
        transpute 2y ago
        We're approaching "if a tree falls in a forest" territory.. the cryptocurrency community has a few stories.
Joel_Mckay 2y ago
Most modern malware is not disk resident, as it has a higher probability of persisting by re-infection with an undocumented zero-day. For example, people that play games that bind the GPS location services will find interruptions magically stop for awhile after a cold power-off, and power-on restart. Or the battery performance suddenly stops quickly losing power in standby, as recording/image capture was burning power and data budgets. Ultimately, a smartphone is impossible to fully secure, as the complexity has a million holes in it regardless of the brand. And Gemini is a whole can of worms I'd rather not discuss without my lawyer present. =3
saagarjha 2y ago
Integrity verification of what? The OS definitely has its signature/hash checked.
- numpad0 2y ago
  # if [ 'beefcafebeef' != $(dd if=/dev/mtdblock3 | sha256sum) ]; then
bri3d 2y ago
Starting in iPadOS and iOS 15, iOS and macOS use a similar Signed System Volume concept and the System volume's integrity is verified.

heavymetalpoizn 2y ago

[dead]

mschuster91 2y ago

> Since Apple won't allow iDevice owners to access an unredacted raw disk image for forensics, iOS malware detection tools are hamstrung. And it's not just Apple. Android is just as bad, and even worse for the user because while iOS backups are consistent in backing up everything sans stuff in the Secure Enclave (i.e. credit card and eSIM keys), in Android support for backup is optional for apps and there are many games who just outright don't do any kind of backup.

fc417fc802 2y ago
This is true and I resent it. However, at least you have the option of installing a ROM that supports toggling adb root out of the box. That alone solves 99% of the issues I have with Android in practice.
- mschuster91 2y ago
  > However, at least you have the option of installing a ROM that supports toggling adb root out of the box. That's not valid for all devices, all Samsungs need a cooldown of one week (Knox lock, presumably to thwart people from rooting stolen devices to bypass antitheft), all modern Androids require a full wipe of the device as part of rooting so it's useless for forensics, and a shitload of apps will flat out refuse to work on rooted devices - forget many games, forget anything with streaming, forget banking apps.
  - fc417fc802 2y ago
    It works for forensics if you already had the OS installed. The fact that the process of flashing a new OS wipes the device is a good thing (consider what the alternatives are). Obviously I feel the user should always have had root. Switching the OS is a fix for that. Not choosing to do that is the same as the choice to purchase a locked device. > shitload of apps will flat out refuse to work on rooted devices People say this but so far most stuff has worked for me on lineage with microg. The adb root toggle isn't detectable as far as I know. Their only realistic option is to require SafetyNet.

pogue 2y ago

Would DNS logs suffice? You could use service that offers logs of DNS like NextDNS or a Pi-Hole to watch DNS traffic from the device, but you wouldn't know which app sent it and for what purpose.

transpute 2y ago
It might be useful in some cases. Charles Proxy on iOS uses a local VPN profile to associate network traffic with applications.

matheusmoreira 2y ago

> provide optional remote attestation to verify OS and baseband integrity And lock us out of our computing freedom while they're at it. Remote attestation enables discrimination against free computers owned by users rather than corporations. They could theoretically allow users to set their own keys but it's not like apps and services are gonna trust people's personal attestation keys, they're only gonna trust Apple's and Google's. This is among the most dangerous developments in cryptography to date and it's gonna end free computing as we know it today. Before this, cryptography used to empower people like us. Now it's the tool that will destroy our freedom and everything the word "hacker" ever stood for. Malware is a small price to pay to avoid such a fate. It's not going to be "optional" either. Every major service is going to use it. Guaranteed.

fc417fc802 2y ago
IIRC wasn't it Librem that wanted to have the device attest itself to the user (ie a second device)? Agreed though. Any major vendor deploying this globally and making it available to developers without restriction would be an affront to our freedom.
- matheusmoreira 2y ago
  > Any major vendor deploying this globally and making it available to developers without restriction would be an affront to our freedom. Google and Apple have already done it. And one day it'll show up in desktops too.
transpute 2y ago
> Remote attestation enables discrimination against free computers owned by users rather than corporations. Not when my mobile device is attesting to my home server with OSS attestation software, or my USB Armory with OSS firmware for local "remote" attestation. GrapheneOS can attest to a 2nd mobile device running GrapheneOS, or a web verifier. This is not rocket science. Provide a mobile setting for attestation server URL. > Every major service is going to use it. Guaranteed. Hence there must be a mandatory option to define your attestation server. Advocating for the right to specify and/or host your arbiter of device trust (including firmware RoT) will do infinitely more for freedom than arguing against cryptography.

rvnx 2y ago

The fact that iPhones are hard to dump is actually the main protection against threats when your phone is stolen or taken away from you (from a more or less legitimate-looking organization or person). It's a pretty good thing overall.

deleted 2y ago
[deleted]
transpute 2y ago
Why must that prevent backup from an Apple Configurator MDM-supervised device that is paired to an admin Macbook, with MDM policy to prevent mobile pairing with any other Macbook? There is a full cryptographic chain to verify the supervising device, which already has full MDM policy control of the mobile device. What security is being added by preventing that authorized supervisor from doing a forensic backup?