3 ms·

For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware, https://www.youtube.com/watch?v=fAhTPMmvrB0 https://www.youtube.com/watc

For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware, https://www.youtube.com/watch?v=fAhTPMmvrB0 https://www.youtube.com/watch?v=fAhTPMmvrB0 > For me, there is only lockdown mode. That is the Apple Experience. iOS backups can be scanned for the presence of this CVE-2025-43300 DNG processing vulnerability, via OSS tool for iOS forensics, https://github.com/msuiche/elegant-bouncer https://github.com/msuiche/elegant-bouncer | https://www.msuiche.com/posts/elegantbouncer-when-you-cant-get-the-samples-but-still-need-to-catch-the-threat/ https://www.msuiche.com/posts/elegantbouncer-when-you-cant-g... ELEGANTBOUNCER is a detection tool for file-based mobile exploits. It employs an innovative approach for advanced file-based threat identification, eliminating the need for in-the-wild samples and outperforming traditional methods based on regular expressions or IOCs. At present, it primarily targets the identification of mobile vulnerabilities such as FORCEDENTRY (CVE-2021-30860), BLASTPASS (CVE-2023-4863, CVE-2023-41064), and TRIANGULATION (CVE-2023-41990) [and recently added CVE-2025-43300]. https://x.com/darknavyorg/status/1959271176062251333 https://x.com/darknavyorg/status/1959271176062251333 > While reproducing the iOS ITW CVE-2025-43300 (support.apple.com/en-us/124925), we accidentally triggered another old DNG image parsing vulnerability. The analysis is still ongoing.

ThePowerOfFuet 1y ago
>For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware For non-iOS defense, run GrapheneOS with all the default safeguards enabled.
notepad0x90 1y ago
I would think mvt and related ioc repos would support these newer indicators,but sadly I'm not seeing that: https://docs.mvt.re/en/latest/iocs/ https://docs.mvt.re/en/latest/iocs/
- transpute 1y ago
  It's a different approach: Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when: • You don’t have the actual malicious samples to create signatures from • The attackers use polymorphic techniques that change file hashes • The exploit leverages legitimate file format features in unexpected ways • You need to detect future variants of the same technique The Philosophy: Structure Over Signatures ELEGANTBOUNCER takes a fundamentally different approach to threat detection. Instead of looking for specific byte patterns or known-bad indicators, it analyzes the structural properties of files that make exploits possible.
  - notepad0x90 1y ago
    I'm just thinking, I'd always prefer to run one tool to verify if a phone has been compromised. If mvt used ELEGANTBOUNCER as a plugin/extension/backend that'd be superb. But, not a big deal, I'm glad I found about this tool, thank you. I am interested in finding out more on why Yara can't be used to find structural patterns? it is supposed to do a lot more than simple string and byte-pattern matching. Maybe ELEGANTBOUNCER requires keeping/maintaining a complex state machine to evaluate/analyze content?
saagarjha 1y ago
Assuming someone hasn't removed it from the filesystem

ThePowerOfFuet 1y ago

>For iOS defense, enable Lockdown Mode and reboot daily to evict non-persistent malware For non-iOS defense, run GrapheneOS with all the default safeguards enabled.

notepad0x90 1y ago

I would think mvt and related ioc repos would support these newer indicators,but sadly I'm not seeing that: https://docs.mvt.re/en/latest/iocs/ https://docs.mvt.re/en/latest/iocs/

transpute 1y ago
It's a different approach: Traditional detection approaches like YARA rules, IOC matching, and signature-based systems fall apart when: • You don’t have the actual malicious samples to create signatures from • The attackers use polymorphic techniques that change file hashes • The exploit leverages legitimate file format features in unexpected ways • You need to detect future variants of the same technique The Philosophy: Structure Over Signatures ELEGANTBOUNCER takes a fundamentally different approach to threat detection. Instead of looking for specific byte patterns or known-bad indicators, it analyzes the structural properties of files that make exploits possible.
- notepad0x90 1y ago
  I'm just thinking, I'd always prefer to run one tool to verify if a phone has been compromised. If mvt used ELEGANTBOUNCER as a plugin/extension/backend that'd be superb. But, not a big deal, I'm glad I found about this tool, thank you. I am interested in finding out more on why Yara can't be used to find structural patterns? it is supposed to do a lot more than simple string and byte-pattern matching. Maybe ELEGANTBOUNCER requires keeping/maintaining a complex state machine to evaluate/analyze content?

saagarjha 1y ago

Assuming someone hasn't removed it from the filesystem