8 ms·

Key IOCs for Pegasus and Predator Spyware Removed with iOS 26 Update

245 points by transpute 1y ago

sevg 1y ago
The article doesn’t define “IOC”, so if (like me) you didn’t know the abbreviation: Indicators Of Compromise. (They actually do use the expanded form in the article, just without some parentheses afterwards on the first usage of the phrase.) Maybe everyone but me knows the abbreviation, but in case it helps _someone_ out there!
- dry_soup 1y ago
  Thank you. The only IOC I know of is the International Olympic Committee.
  - bnastic 1y ago
    Or if you work in trading, IOC made it a very confusing title
    - CaptainOfCoit 1y ago
      I'm a programmer, designer and architect, so my mind immediately went to "Inversion of Control"
      - misnome 1y ago
        Or Input/Output Controller (scientific facility control layer tech)
    - Ntrails 1y ago
      It is delightful how acronyms close to you embed deeply and can cause little shocks vs the rest of the world.
- KernalSanders 1y ago
  Thank you for this! Abbreviations and acronyms are highly inefficient if not defined clearly and up front. It also creates a division between those who know and those who don't. I absolutely detested seeing "ISO" suddenly everywhere on Facebook and Nextdoor in place of "in search of". If you didn't know that before, you know it now, but you may also be annoyed by it not being about the international organization for standardization, which also goes by ISO, but not for any reason people would magically guess, without a background in Greek. (ISO explains that, since the acronym would differ in every language, ISO is actually derived from isos, which means "equal". Happy coincidence that it almost matches the name of the organization, but could also become obscure with time and lost history.) For our company, I've been very clear that we don't make up acronyms unless a layperson could reasonably guess what it stands for, and also not confuse it for something else.
  - deleted 1y ago
    [deleted]
  - integralid 1y ago
    I assume this blog post is targeted for the security community, where IoC is universally understood. Of course it is confusing on HN, but authors are free to assume their audience - like we don't define what HTTP, MVC and "btw" mean every time we use it. Or, for a better example, HN and YC are used here all the time, but would be confusing for outsiders (and should be defined outside of HN context).
  - CaptainOfCoit 1y ago
    > It also creates a division between those who know and those who don't. Yeah, it's called "expertise" and it isn't as bad as you seem to think. Blogs for security professionals will use jargon and technical words aimed at other security professionals, and that's OK, not everything on the web is for everyone. Just like how in my game development blog I don't explain what a "loop" is because I'm assuming the audience knows basic programming already, otherwise every article would be balloon out of scope easily.
    - akerl_ 1y ago
- jcgrillo 1y ago
  [flagged]
- Polizeiposaune 1y ago
  The US military also uses IOC = "Initial Operational Capability" (as distinguished from FOC: Full Operational Capability): https://samm.dsca.mil/glossary/initial-operational-capability-ioc https://samm.dsca.mil/glossary/initial-operational-capabilit...
  - halJordan 1y ago
    The us military also uses ioc to mean indicator of compromise; this is another odd non sequitor
- deleted 1y ago
  [deleted]
- DonHopkins 1y ago
  Thank you! I had no idea what IOC stands for in that context either, and appreciate the definition. In other HN discussions there have regularly been divisive gatekeeping trolls who, in response to people asking what acronyms stand for and suggesting articles like this define them after their first use, are inexplicably and vehemently opposed to defining acronyms, and who argue incessantly that acronyms should not be defined because everyone should already know what they are, and criticize people who don't already know, because they are meant to be excluded from the discussion. What possible motivations could they have? I just don't understand that mindset, but I suspect there's a big overlap between them and the trolls who regularly throw tantrums about accessibility, usability, diversity, equity, and inclusion, and see empathy as a weakness, since it's a similar exclusionary mindset. The anti-accessibility trolls are incredibly foolish and short sighted (pun intended) to not realize that unless you are "lucky" enough to die at an early age, EVERYONE is going to need and benefit from accessibility and inclusive interface design. Edit: Oh I see one of them has dropped in and taken their precious time to argue back and forth in several posts, with orders of magnitude more words and off-topic noise than it would have taken to simply define the acronym in the first place and move on, thereby undermining their own circular arguments. What a sowapphtdo (strange obsession with a particularly pointless hill to die on)! I like riehwvfbk suggestion: "expertise theatre". (But what does riehwvfbk stand for? ;)
- trillic 1y ago
  There are only 17,576 unique TLAs (three-letter acronym).
- m463 1y ago
  Help stamp out TLAs. or maybe ASS.md: https://gist.github.com/klaaspieter/12cd68f54bb71a3940eae5cdd4ea1764 https://gist.github.com/klaaspieter/12cd68f54bb71a3940eae5cd...
darkoob12 1y ago
I always suspected someone inside Apple is making sure that these phones stay vulnerable for Israeli hackers or they don't really fix their bugs.
- notepad0x90 1y ago
  it's possible,but iphones are apple's flagship product. it would be disastrous for them. i don't think any government contract is worth the cost. They're not google or Microsoft, they're not that big in the enterprise side of things. I'm sure if such a relationship became public,most Americans will forget about it in few weeks time and half will be surprised what the big deal is. But apple will lose out on Asia and Europe where it has solid competition. Their hardware is their bread-and-butter. It is more plausible for the US government to have planted or extorted an asset working as a developer at apple than apple itself making such a monumentally foolish decision. Google and Microsoft on the other hand, that I am fairly certain of. But... i digress a bit, only because Tim Cook was kissing the proverbial king's ring a lot lately. donations are one thing, giving gold gifts in person and on national tv is another.
  - sschueller 1y ago
    Tim Cook gifted trump a gold base with a glass plate on it like some peasant to a king in front of camers. Apple will bend over backwards to please governments so don't be surprised when it turns out not everything is as secure as claimed in their walled garden.
    - nl 1y ago
      I'm not a particular fan of Apple but the gold thing seemed like a good, cheap way to get on Trump's good side, which led to them somehow magically avoiding tariffs. I don't think I'd read more into it than that.
      - pprotas 1y ago
        Yes, that is exactly the problem. No need to read more into it.
benzible 1y ago
If we didn't already know this, Apple's previous positioning as the privacy company was just branding with zero actual conviction behind it. Now, just as ICE contracts with Paragon for zero-click spyware that bypasses encrypted apps, Apple erases the key forensic artifact for detecting state-sponsored mobile surveillance. Along with Cook's cash-and-gold-for-tariff-exemptions scheme, they're racing to the bottom with the rest of big tech.
- neilv 1y ago
  Can we assume that Apple will continue to fail to secure the iPhone against these spyware companies?
  - Gigachad 1y ago
    Memory integrity enforcement added to the iPhone 17 range is probably going to be huge for preventing future exploits. At risk people should probably also enable lockdown mode.
    - bigyabai 1y ago
      Blastdoor was also supposed to be "huge" for preventing future exploits. Worked great up until NSO Group developed FORCEDENTRY.
      - commandersaki 1y ago
        MIE eliminates a whole class of bugs (memory corruption) and has demonstrated that it stops full chains but also renders them unusable if parts get swapped out. See: https://security.apple.com/blog/memory-integrity-enforcement/ https://security.apple.com/blog/memory-integrity-enforcement... And some interesting excerpts: Both approaches revealed the same conclusion: Memory Integrity Enforcement vastly reduces the exploitation strategies available to attackers. Though memory corruption bugs are usually interchangeable, MIE cut off so many exploit steps at a fundamental level that it was not possible to restore the chains by swapping in new bugs. Even with substantial effort, we could not rebuild any of these chains to work around MIE. The few memory corruption effects that remained are unreliable and don’t give attackers sufficient momentum to successfully exploit these bugs. Notably, attackers confront Memory Integrity Enforcement early in the exploitation process. Although some issues are able to survive MIE — for example, intra-allocation buffer overflows — such issues are extremely rare, and even fewer will lend themselves to a full end-to-end exploit. Inevitably, attackers must face MIE at a stage where their capabilities are still very limited, leaving few viable avenues for exploitation. This leads to fragile chains where breaking just one step is often enough to invalidate the entire exploit strategy. When that happens, most of the chain’s components can’t be reused, and the attackers have to restart exploit development with entirely new bugs.
notepad0x90 1y ago
I just wanna say how ridiculous it is that forensics on iphones is done via backup archives. If apple at least included a full system memory dump along with the backup that'd be better. If only the allowed system-extensions like on macos that run in EL1+ for security monitoring.
- CaptainOfCoit 1y ago
  > If apple at least included a full system memory dump along with the backup that'd be better Wouldn't that make it easier for people to find vulnerabilities and more importantly (for Apple)? Which would allow people to find vulnerabilities for rooting the phone, something Apple really seems hellbent on preventing.
- hulitu 1y ago
  > I just wanna say how ridiculous it is that forensics on iphones is done via backup archives. Why would somedy want to disturb in memory exploits ? /s
- axoltl 1y ago
  I do vulnerability research. Those things would do the exact opposite of what you're aiming for. They'd be received with glee by mercenary spyware companies, _especially_ being able to load things into higher levels of privilege.
  - notepad0x90 1y ago
    that wouldn't be a problem, apple signs extensions. In windows land for example, there are ELAM drivers for security software, they don't just hand them out, you basically have to convince people at Microsoft you're one of the good guys, in person.
    - transpute 1y ago
      Trusted high-privilege components, whether first or third party, are targeted for exploitation.
deleted 1y ago
[deleted]
nl 1y ago
It seems like the author's don't believe this was a deliberate attempt by Apple to hide Spyware: > Consider holding off on updating to iOS 26 until Apple addresses this issue, ideally by releasing a bug fix that prevents the overwriting of the shutdown.log on boot.
- ectospheno 1y ago
  Holding off on an update containing numerous fixes you are far more likely to run into just to keep an IOC for a thing that you never will because you simply aren't that important seems silly.
  - transpute 1y ago
    Article written by iVerify for their customers, who pay a monthly fee for automated forensic analysis of iOS logs.
darkamaul 1y ago
I’d assume that erasing the shutdown log is also a security measure from Apple, attackers could use it to better understand crash conditions or device behavior. That said, if we take Apple’s stance on privacy seriously, users should also have deep inspection capabilities on their own devices. After all, they’re supposed to own them.
- sim7c00 1y ago
  what privs u need to read shutdown log vs what privs u need to see running programs? apple always trying to hide things and lock people more out of how the device works. they use privacy as an excuse and even sue and jail ppl who try to look at things properly.
  - frontfor 1y ago
    When did Apple “sue and jail ppl” for “try to look at things properly”? I’m pretty sure Apple isn’t legally allowed to jail people.
- charcircuit 1y ago
  >After all, they’re supposed to own them. Just because you own a device, that doesn't mean the manufacturer is obligated to add features you want.
  - user2722 1y ago
    I think he/she was being ironic. You either own it or Apple owns it. Since there is no sideload and the criptographic keys belong to Apple, then the device belongs effectively to Apple and you just rent it for a fixed fee. You can't both own it and not own it depending on the situation, thus exposing Apple's hypocrisy as a well-intended parentified gatekeeper just protecting the users/childified adult users.
    - charcircuit 1y ago
      Goods for the mass consumer all work like this. The manufacturer creates a product and consumers by it if those features provide them value. If a device doesn't have a feature such as online diagnostics they are free to buy a different product instead. If people really want to add their own features they are free to modify the device. It's more economical to just buy another device which is why you don't see people replacing the parts needed to develop your own software on an iPhone. Easy user modification of the OS is not a feature of iPhone and if added could hurt the quality of the product. Another way to think of this is imagine if Apple burned the OS into a ROM chip. That doesn't make them the owner of the device because the user can't write to the ROM chip. By that logic no one would own the device because no one can update it, but that can't really be true.
transpute 1y ago
This change was not present in iOS26 betas, hopefully Apple will fix soon, https://www.youtube.com/watch?v=PHijS6jLPxI&t=304s https://www.youtube.com/watch?v=PHijS6jLPxI&t=304s > If you care about your iOS device security.. reboot every day.. writes a list of running processes to this shutdown.log file.. If you have processes that shouldn't be running, they will get written to this shutdown.log file.. allows you to go back in time and check for IOCs.
londons_explore 1y ago
This is dumb - now that this is known, attackers will make sure that they edit the shutdown.log file to be perfectly byte for byte identical to an uninfected device. So the log has no value
- zimpenfish 1y ago
  They already did: > Researchers have noted instances where devices known to be active had their shutdown.log cleared, alongside other IOCs for Pegasus infections. This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices. Which is why the article is pointing out that a cleared `shutdown.log` is no longer an indicator of Pegasus infections (because it now happens every boot.)
saagarjha 1y ago
I guess at scale every minor fix is a spacebar heater for someone else. I assume Apple is probably going to bring this back to pacify the iVerify people but long term they are going to keep making these changes and mercenary spyware is going to learn how to hide itself better. I really think it’s time to start thinking about strategies that go beyond forensic artifacts…
- isodev 1y ago
  > I assume Apple is probably going to bring this back to pacify Pegasus and Predator were VERY widely publicised exploits in iOS, I find it shortsighted for Apple not to have control over how these get identified in the first place. It's also frustrating that the entire "your iPhone is safe and private" assumption is a black box and we only have Fruitcorp's assurances that they're doing the right thing. So imagine, people finding all kinds of bugs on iOS26 ... how is one to believe these bugs and glitches don't extend into security features as well?
  - saagarjha 1y ago
    Obviously they do, hence the market for exploits. I'm not sure what you are suggesting they do differently, though.
    - isodev 1y ago
      The opposite of what the blogpost informs us they did? Provide more tools and systems to discover and diagnose vulnerabilities, make components open source/open audit, etc. There is non perfect system, but a closed imperfect system is worst.
      - saagarjha 1y ago
        I agree but the blog post is completely orthogonal to that
      - commandersaki 1y ago
        One of the iVerify people (which this blog post comes from) spoke at CCC about what Apple could do to improve detection of IOCs: https://www.youtube.com/watch?v=YG_6N0DSFRE https://www.youtube.com/watch?v=YG_6N0DSFRE The relevant bits I was talking about starts at 41:15.
OhioMan2943 1y ago
Deliberate?
- bigyabai 1y ago
  If it was then HN would never live it down, but let's look at the timeline: 13 months ago: Apple drops NSO Group lawsuit: https://nquiringminds.com/cybernews/apple-drops-lawsuit-against-nso-group-over-pegasus-spyware-concerns/ 2 weeks ago: NSO Group confirms it was bought by US interests: https://techcrunch.com/2025/10/10/spyware-maker-nso-group-confirms-acquisition-by-us-investors/ Now: IOCs for Pegasus and Predator are removed from iOS in an OTA update.
notmyjob 1y ago
I’ve been told repeatedly by high ranking members of the apple support forum to never look at logs. Only schizos and idiots look at the logs they said. Even experienced apple developers don’t look at the logs I was told. This makes me question everything about apple support, especially the “geniuses” that work at the Apple Store.
- jeroenhd 1y ago
  My experience with the Apple support forum is that everyone that bothers to write an answer will tell you that you're using the product wrong, you're wrong for trying to use a product the way you want, or that your problem is actually a feature that you're misunderstanding. It's as useless as Microsoft's forum except it's run by people who want to defend the company's honour more than they want to tell you to do a clean install of your OS. Of course, neither is an official support channel. They're just users offering support to other users. Many of them don't seem to have all that technical a background, they've just used products they're suggesting solutions for for a long time and have gathered some useful tricks, which may end up causing some cargo culty suggestions.
devJdeed 1y ago
Can someone confirm if this update does fix the zero-click exploit from Pegasus ?
- Retr0id 1y ago
  Nobody is in a position to confirm that. You can reasonably assume there are multiple viable 0click vectors at any given time, regardless of patch level.
- fulafel 1y ago
  Terminology nit: An exploit is a technique or automation to take advantage of ("exploit") a vulnerability. So fixing a vulnerability breaks an exploit.
- commandersaki 1y ago
  Is there a confirmed zero-click pegasus exploit for ios 26?
  - bigyabai 1y ago
    Apparently not even Apple can authoritatively confirm that: https://9to5mac.com/2025/02/20/apple-currently-only-able-to-detect-pegasus-spyware-in-half-of-infected-iphones/ https://9to5mac.com/2025/02/20/apple-currently-only-able-to-...
krackers 1y ago
>Consider holding off on updating to iOS 26 Wait what? Surely if you're concerned about nation-state spyware, upgrading to the latest version is safer than staying on a vulnerable version.
- SoKamil 1y ago
  Apple still releases security patches to recent versions of iOS, especially critical ones.
mikeiz404 1y ago
- The IOC is a cleared shutdown log. - The update now clears the shutdown log each boot. > This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices. > With iOS 26 Apple introduced a change—either an intentional design decision or an unforeseen bug—that causes the shutdown.log to be overwritten on every device reboot instead of appended with a new entry every time, preserving each as its own snapshot. This means that any user who updates to iOS 26 and subsequently restarts their device will inadvertently erase all evidence of older Pegasus and Predator detections that might have been present in their shutdown.log.
user205738 1y ago
A good article provides a list of terms and abbreviations used before starting. If there is no such thing, the article is not worth the time spent on it.

245 points by transpute 1y ago

sevg 1y ago

The article doesn’t define “IOC”, so if (like me) you didn’t know the abbreviation: Indicators Of Compromise. (They actually do use the expanded form in the article, just without some parentheses afterwards on the first usage of the phrase.) Maybe everyone but me knows the abbreviation, but in case it helps _someone_ out there!

dry_soup 1y ago
Thank you. The only IOC I know of is the International Olympic Committee.
- bnastic 1y ago
  Or if you work in trading, IOC made it a very confusing title
  - CaptainOfCoit 1y ago
    I'm a programmer, designer and architect, so my mind immediately went to "Inversion of Control"
    - misnome 1y ago
      Or Input/Output Controller (scientific facility control layer tech)
  - Ntrails 1y ago
    It is delightful how acronyms close to you embed deeply and can cause little shocks vs the rest of the world.
KernalSanders 1y ago
Thank you for this! Abbreviations and acronyms are highly inefficient if not defined clearly and up front. It also creates a division between those who know and those who don't. I absolutely detested seeing "ISO" suddenly everywhere on Facebook and Nextdoor in place of "in search of". If you didn't know that before, you know it now, but you may also be annoyed by it not being about the international organization for standardization, which also goes by ISO, but not for any reason people would magically guess, without a background in Greek. (ISO explains that, since the acronym would differ in every language, ISO is actually derived from isos, which means "equal". Happy coincidence that it almost matches the name of the organization, but could also become obscure with time and lost history.) For our company, I've been very clear that we don't make up acronyms unless a layperson could reasonably guess what it stands for, and also not confuse it for something else.
- deleted 1y ago
  [deleted]
- integralid 1y ago
  I assume this blog post is targeted for the security community, where IoC is universally understood. Of course it is confusing on HN, but authors are free to assume their audience - like we don't define what HTTP, MVC and "btw" mean every time we use it. Or, for a better example, HN and YC are used here all the time, but would be confusing for outsiders (and should be defined outside of HN context).
- CaptainOfCoit 1y ago
  > It also creates a division between those who know and those who don't. Yeah, it's called "expertise" and it isn't as bad as you seem to think. Blogs for security professionals will use jargon and technical words aimed at other security professionals, and that's OK, not everything on the web is for everyone. Just like how in my game development blog I don't explain what a "loop" is because I'm assuming the audience knows basic programming already, otherwise every article would be balloon out of scope easily.
  - akerl_ 1y ago
jcgrillo 1y ago
[flagged]
Polizeiposaune 1y ago
The US military also uses IOC = "Initial Operational Capability" (as distinguished from FOC: Full Operational Capability): https://samm.dsca.mil/glossary/initial-operational-capability-ioc https://samm.dsca.mil/glossary/initial-operational-capabilit...
- halJordan 1y ago
  The us military also uses ioc to mean indicator of compromise; this is another odd non sequitor
deleted 1y ago
[deleted]
DonHopkins 1y ago
Thank you! I had no idea what IOC stands for in that context either, and appreciate the definition. In other HN discussions there have regularly been divisive gatekeeping trolls who, in response to people asking what acronyms stand for and suggesting articles like this define them after their first use, are inexplicably and vehemently opposed to defining acronyms, and who argue incessantly that acronyms should not be defined because everyone should already know what they are, and criticize people who don't already know, because they are meant to be excluded from the discussion. What possible motivations could they have? I just don't understand that mindset, but I suspect there's a big overlap between them and the trolls who regularly throw tantrums about accessibility, usability, diversity, equity, and inclusion, and see empathy as a weakness, since it's a similar exclusionary mindset. The anti-accessibility trolls are incredibly foolish and short sighted (pun intended) to not realize that unless you are "lucky" enough to die at an early age, EVERYONE is going to need and benefit from accessibility and inclusive interface design. Edit: Oh I see one of them has dropped in and taken their precious time to argue back and forth in several posts, with orders of magnitude more words and off-topic noise than it would have taken to simply define the acronym in the first place and move on, thereby undermining their own circular arguments. What a sowapphtdo (strange obsession with a particularly pointless hill to die on)! I like riehwvfbk suggestion: "expertise theatre". (But what does riehwvfbk stand for? ;)
trillic 1y ago
There are only 17,576 unique TLAs (three-letter acronym).
m463 1y ago
Help stamp out TLAs. or maybe ASS.md: https://gist.github.com/klaaspieter/12cd68f54bb71a3940eae5cdd4ea1764 https://gist.github.com/klaaspieter/12cd68f54bb71a3940eae5cd...

darkoob12 1y ago

I always suspected someone inside Apple is making sure that these phones stay vulnerable for Israeli hackers or they don't really fix their bugs.

notepad0x90 1y ago
it's possible,but iphones are apple's flagship product. it would be disastrous for them. i don't think any government contract is worth the cost. They're not google or Microsoft, they're not that big in the enterprise side of things. I'm sure if such a relationship became public,most Americans will forget about it in few weeks time and half will be surprised what the big deal is. But apple will lose out on Asia and Europe where it has solid competition. Their hardware is their bread-and-butter. It is more plausible for the US government to have planted or extorted an asset working as a developer at apple than apple itself making such a monumentally foolish decision. Google and Microsoft on the other hand, that I am fairly certain of. But... i digress a bit, only because Tim Cook was kissing the proverbial king's ring a lot lately. donations are one thing, giving gold gifts in person and on national tv is another.
- sschueller 1y ago
  Tim Cook gifted trump a gold base with a glass plate on it like some peasant to a king in front of camers. Apple will bend over backwards to please governments so don't be surprised when it turns out not everything is as secure as claimed in their walled garden.
  - nl 1y ago
    I'm not a particular fan of Apple but the gold thing seemed like a good, cheap way to get on Trump's good side, which led to them somehow magically avoiding tariffs. I don't think I'd read more into it than that.
    - pprotas 1y ago
      Yes, that is exactly the problem. No need to read more into it.

benzible 1y ago

If we didn't already know this, Apple's previous positioning as the privacy company was just branding with zero actual conviction behind it. Now, just as ICE contracts with Paragon for zero-click spyware that bypasses encrypted apps, Apple erases the key forensic artifact for detecting state-sponsored mobile surveillance. Along with Cook's cash-and-gold-for-tariff-exemptions scheme, they're racing to the bottom with the rest of big tech.

neilv 1y ago
Can we assume that Apple will continue to fail to secure the iPhone against these spyware companies?
- Gigachad 1y ago
  Memory integrity enforcement added to the iPhone 17 range is probably going to be huge for preventing future exploits. At risk people should probably also enable lockdown mode.
  - bigyabai 1y ago
    Blastdoor was also supposed to be "huge" for preventing future exploits. Worked great up until NSO Group developed FORCEDENTRY.
    - commandersaki 1y ago
      MIE eliminates a whole class of bugs (memory corruption) and has demonstrated that it stops full chains but also renders them unusable if parts get swapped out. See: https://security.apple.com/blog/memory-integrity-enforcement/ https://security.apple.com/blog/memory-integrity-enforcement... And some interesting excerpts: Both approaches revealed the same conclusion: Memory Integrity Enforcement vastly reduces the exploitation strategies available to attackers. Though memory corruption bugs are usually interchangeable, MIE cut off so many exploit steps at a fundamental level that it was not possible to restore the chains by swapping in new bugs. Even with substantial effort, we could not rebuild any of these chains to work around MIE. The few memory corruption effects that remained are unreliable and don’t give attackers sufficient momentum to successfully exploit these bugs. Notably, attackers confront Memory Integrity Enforcement early in the exploitation process. Although some issues are able to survive MIE — for example, intra-allocation buffer overflows — such issues are extremely rare, and even fewer will lend themselves to a full end-to-end exploit. Inevitably, attackers must face MIE at a stage where their capabilities are still very limited, leaving few viable avenues for exploitation. This leads to fragile chains where breaking just one step is often enough to invalidate the entire exploit strategy. When that happens, most of the chain’s components can’t be reused, and the attackers have to restart exploit development with entirely new bugs.

notepad0x90 1y ago

I just wanna say how ridiculous it is that forensics on iphones is done via backup archives. If apple at least included a full system memory dump along with the backup that'd be better. If only the allowed system-extensions like on macos that run in EL1+ for security monitoring.

CaptainOfCoit 1y ago
> If apple at least included a full system memory dump along with the backup that'd be better Wouldn't that make it easier for people to find vulnerabilities and more importantly (for Apple)? Which would allow people to find vulnerabilities for rooting the phone, something Apple really seems hellbent on preventing.
hulitu 1y ago
> I just wanna say how ridiculous it is that forensics on iphones is done via backup archives. Why would somedy want to disturb in memory exploits ? /s
axoltl 1y ago
I do vulnerability research. Those things would do the exact opposite of what you're aiming for. They'd be received with glee by mercenary spyware companies, _especially_ being able to load things into higher levels of privilege.
- notepad0x90 1y ago
  that wouldn't be a problem, apple signs extensions. In windows land for example, there are ELAM drivers for security software, they don't just hand them out, you basically have to convince people at Microsoft you're one of the good guys, in person.
  - transpute 1y ago
    Trusted high-privilege components, whether first or third party, are targeted for exploitation.

deleted 1y ago

[deleted]

nl 1y ago

It seems like the author's don't believe this was a deliberate attempt by Apple to hide Spyware: > Consider holding off on updating to iOS 26 until Apple addresses this issue, ideally by releasing a bug fix that prevents the overwriting of the shutdown.log on boot.

ectospheno 1y ago
Holding off on an update containing numerous fixes you are far more likely to run into just to keep an IOC for a thing that you never will because you simply aren't that important seems silly.
- transpute 1y ago
  Article written by iVerify for their customers, who pay a monthly fee for automated forensic analysis of iOS logs.

darkamaul 1y ago

I’d assume that erasing the shutdown log is also a security measure from Apple, attackers could use it to better understand crash conditions or device behavior. That said, if we take Apple’s stance on privacy seriously, users should also have deep inspection capabilities on their own devices. After all, they’re supposed to own them.

sim7c00 1y ago
what privs u need to read shutdown log vs what privs u need to see running programs? apple always trying to hide things and lock people more out of how the device works. they use privacy as an excuse and even sue and jail ppl who try to look at things properly.
- frontfor 1y ago
  When did Apple “sue and jail ppl” for “try to look at things properly”? I’m pretty sure Apple isn’t legally allowed to jail people.
charcircuit 1y ago
>After all, they’re supposed to own them. Just because you own a device, that doesn't mean the manufacturer is obligated to add features you want.
- user2722 1y ago
  I think he/she was being ironic. You either own it or Apple owns it. Since there is no sideload and the criptographic keys belong to Apple, then the device belongs effectively to Apple and you just rent it for a fixed fee. You can't both own it and not own it depending on the situation, thus exposing Apple's hypocrisy as a well-intended parentified gatekeeper just protecting the users/childified adult users.
  - charcircuit 1y ago
    Goods for the mass consumer all work like this. The manufacturer creates a product and consumers by it if those features provide them value. If a device doesn't have a feature such as online diagnostics they are free to buy a different product instead. If people really want to add their own features they are free to modify the device. It's more economical to just buy another device which is why you don't see people replacing the parts needed to develop your own software on an iPhone. Easy user modification of the OS is not a feature of iPhone and if added could hurt the quality of the product. Another way to think of this is imagine if Apple burned the OS into a ROM chip. That doesn't make them the owner of the device because the user can't write to the ROM chip. By that logic no one would own the device because no one can update it, but that can't really be true.

transpute 1y ago

This change was not present in iOS26 betas, hopefully Apple will fix soon, https://www.youtube.com/watch?v=PHijS6jLPxI&t=304s https://www.youtube.com/watch?v=PHijS6jLPxI&t=304s > If you care about your iOS device security.. reboot every day.. writes a list of running processes to this shutdown.log file.. If you have processes that shouldn't be running, they will get written to this shutdown.log file.. allows you to go back in time and check for IOCs.

londons_explore 1y ago

This is dumb - now that this is known, attackers will make sure that they edit the shutdown.log file to be perfectly byte for byte identical to an uninfected device. So the log has no value

zimpenfish 1y ago
They already did: > Researchers have noted instances where devices known to be active had their shutdown.log cleared, alongside other IOCs for Pegasus infections. This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices. Which is why the article is pointing out that a cleared `shutdown.log` is no longer an indicator of Pegasus infections (because it now happens every boot.)

saagarjha 1y ago

I guess at scale every minor fix is a spacebar heater for someone else. I assume Apple is probably going to bring this back to pacify the iVerify people but long term they are going to keep making these changes and mercenary spyware is going to learn how to hide itself better. I really think it’s time to start thinking about strategies that go beyond forensic artifacts…

isodev 1y ago
> I assume Apple is probably going to bring this back to pacify Pegasus and Predator were VERY widely publicised exploits in iOS, I find it shortsighted for Apple not to have control over how these get identified in the first place. It's also frustrating that the entire "your iPhone is safe and private" assumption is a black box and we only have Fruitcorp's assurances that they're doing the right thing. So imagine, people finding all kinds of bugs on iOS26 ... how is one to believe these bugs and glitches don't extend into security features as well?
- saagarjha 1y ago
  Obviously they do, hence the market for exploits. I'm not sure what you are suggesting they do differently, though.
  - isodev 1y ago
    The opposite of what the blogpost informs us they did? Provide more tools and systems to discover and diagnose vulnerabilities, make components open source/open audit, etc. There is non perfect system, but a closed imperfect system is worst.
    - saagarjha 1y ago
      I agree but the blog post is completely orthogonal to that
    - commandersaki 1y ago
      One of the iVerify people (which this blog post comes from) spoke at CCC about what Apple could do to improve detection of IOCs: https://www.youtube.com/watch?v=YG_6N0DSFRE https://www.youtube.com/watch?v=YG_6N0DSFRE The relevant bits I was talking about starts at 41:15.

OhioMan2943 1y ago

Deliberate?

bigyabai 1y ago
If it was then HN would never live it down, but let's look at the timeline: 13 months ago: Apple drops NSO Group lawsuit: https://nquiringminds.com/cybernews/apple-drops-lawsuit-against-nso-group-over-pegasus-spyware-concerns/ 2 weeks ago: NSO Group confirms it was bought by US interests: https://techcrunch.com/2025/10/10/spyware-maker-nso-group-confirms-acquisition-by-us-investors/ Now: IOCs for Pegasus and Predator are removed from iOS in an OTA update.

notmyjob 1y ago

I’ve been told repeatedly by high ranking members of the apple support forum to never look at logs. Only schizos and idiots look at the logs they said. Even experienced apple developers don’t look at the logs I was told. This makes me question everything about apple support, especially the “geniuses” that work at the Apple Store.

jeroenhd 1y ago
My experience with the Apple support forum is that everyone that bothers to write an answer will tell you that you're using the product wrong, you're wrong for trying to use a product the way you want, or that your problem is actually a feature that you're misunderstanding. It's as useless as Microsoft's forum except it's run by people who want to defend the company's honour more than they want to tell you to do a clean install of your OS. Of course, neither is an official support channel. They're just users offering support to other users. Many of them don't seem to have all that technical a background, they've just used products they're suggesting solutions for for a long time and have gathered some useful tricks, which may end up causing some cargo culty suggestions.

devJdeed 1y ago

Can someone confirm if this update does fix the zero-click exploit from Pegasus ?

Retr0id 1y ago
Nobody is in a position to confirm that. You can reasonably assume there are multiple viable 0click vectors at any given time, regardless of patch level.
fulafel 1y ago
Terminology nit: An exploit is a technique or automation to take advantage of ("exploit") a vulnerability. So fixing a vulnerability breaks an exploit.
commandersaki 1y ago
Is there a confirmed zero-click pegasus exploit for ios 26?
- bigyabai 1y ago
  Apparently not even Apple can authoritatively confirm that: https://9to5mac.com/2025/02/20/apple-currently-only-able-to-detect-pegasus-spyware-in-half-of-infected-iphones/ https://9to5mac.com/2025/02/20/apple-currently-only-able-to-...

krackers 1y ago

>Consider holding off on updating to iOS 26 Wait what? Surely if you're concerned about nation-state spyware, upgrading to the latest version is safer than staying on a vulnerable version.

SoKamil 1y ago
Apple still releases security patches to recent versions of iOS, especially critical ones.

mikeiz404 1y ago

- The IOC is a cleared shutdown log. - The update now clears the shutdown log each boot. > This led to the conclusion that a cleared shutdown.log could serve as a good heuristic for identifying suspicious devices. > With iOS 26 Apple introduced a change—either an intentional design decision or an unforeseen bug—that causes the shutdown.log to be overwritten on every device reboot instead of appended with a new entry every time, preserving each as its own snapshot. This means that any user who updates to iOS 26 and subsequently restarts their device will inadvertently erase all evidence of older Pegasus and Predator detections that might have been present in their shutdown.log.

user205738 1y ago

A good article provides a list of terms and abbreviations used before starting. If there is no such thing, the article is not worth the time spent on it.