In the last couple of years iOS has became an interesting target for malware developers. iPhones generally have a lot of security measures built-in, and because of that they are an interesting target for malware developers. Additionally, a lot of high value individuals are using iPhones so it makes sense from the malware developers point of view to target them. Just like any other device, iPhones are not without flaws and it has been shown again and again that threat actors can indeed compromise the device and get what they want whether it is just for the purpose of stealing user information, surveillance or something else.
Some of the iOS malware types are:
Adware – abusing the device to get ads revenue
RAT – Remote Access Trojan allows the threat actors to remotely control the device
Filesystem dump
As usual with forensics, we need to do the filesystem dump or to create an image for it. We can do the same with iOS device, but the device needs to be jailbroken so in a lot of times, this can’t be accomplished and we need to obtain information using other methods.
iTunes Backup
idevicebackup2 to create one. When we are crating the backup with the idevicebackup2
Sysdiagnose
Some useful information from sysdiagnose includes:
Processes
Network Info
Accounts info
AirDrop logs
To dump the sysdiagnose logs, on macOS we can just execute sysdiagnose
After extracting the archive, we can examine the files inside of there and search for forensics artifacts.
Each of these three methods have their own pros and cons. For example, we can use filesystem dump when we have an access to the jailbroken device, but we could distort some evidences in the process. Backups provide only subset of files from the device which can sometimes be enough to detect some artifacts. Sysdiagnose is the easiest and quickest to get but it provides a smaller amount of files from device than the backup or filesystem dump.
Indicators of Compromise (IOCs)
They can be things such as:
File traces
Suspicious processes and URLs
Binary Hashes
Network Traffic
Provisioning profiles
Trusted certifications
IOCs enable professionals to detect intrusion attempts or other malicious activities. They are also useful when shared with the community so that they can improve their incident response.
To assist and generalise the idea of IOCs,
STIX Framework and TAXII
STIX Framework
(STIX) is a structured language for describing cyber threat information so it can be shared, stored, and analyzed in a consistent manner. STIX framework enhances the capabilities of organisation do defend against cyberattacks.
STIX framework is based on the indicators and the objects such as hash, IP addresses, malware, etc.
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--71312c48-925d-44b7-b10e-c11086995358",
"created": "2017-02-06T09:13:07.243000Z",
"modified": "2017-02-06T09:13:07.243000Z",
"name": "CryptoLocker Hash",
"description": "This file is a part of CryptoLocker",
"pattern": "[file:hashes.'SHA-256' = '46afeb295883a5efd6639d4197eb18bcba3bff49125b810ca4b9509b9ce4dfbf']",
"pattern_type": "stix",
"indicator_types": ["malicious-activity"],
"valid_from": "2017-01-01T09:00:00.000000Z"
}
{
"type": "malware",
"id": "malware--81be4588-96a8-4de2-9938-9e16130ce7e6",
"spec_version": "2.1",
"created": "2017-02-06T09:26:21.647000Z",
"modified": "2017-02-06T09:26:21.647000Z",
"name": "CryptoLocker",
"description": "CryptoLocker is known to hold files hostage for ransom.",
"malware_types": ["ransomware"]
}
name, description, pattern and indicator_types. Name and description are self-explanatory, pattern tells what is the pattern to match it, such as hash in the example above, while the indicator_types describe this pattern of SHA256 of the file as malicious activity.
Malware object contains information about the file which has a SHA256 identified as CryptoLocker such as name, description and malware type.
Following is an excerpt from the
"objects": [
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64",
"created": "2023-10-23T15:49:48.089255Z",
"modified": "2023-10-23T15:49:48.089255Z",
"name": "OperationTriangulation",
"description": "IOCs related to Operation Triangulation iOS spyware documented by Kaspersky Labs.",
"is_family": false
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c5788b5b-128f-43f2-b5f5-02f8055d4700",
"created": "2023-10-23T15:49:48.089417Z",
"modified": "2023-10-23T15:49:48.089417Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='senlin83.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-10-23T15:49:48.089417Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--52da4e9a-3a22-4681-94db-e7ce3ec5b6d5",
"created": "2023-10-23T15:49:48.09267Z",
"modified": "2023-10-23T15:49:48.09267Z",
"relationship_type": "indicates",
"source_ref": "indicator--c5788b5b-128f-43f2-b5f5-02f8055d4700",
"target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--90a3e899-c7b8-480f-842f-86baf929a3b8",
"created": "2023-10-23T15:49:48.093005Z",
"modified": "2023-10-23T15:49:48.093005Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='backuprabbit.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-10-23T15:49:48.093005Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--824ac4a8-9fd3-4909-94ea-5f25a2665829",
"created": "2023-10-23T15:49:48.093516Z",
"modified": "2023-10-23T15:49:48.093516Z",
"relationship_type": "indicates",
"source_ref": "indicator--90a3e899-c7b8-480f-842f-86baf929a3b8",
"target_ref": "malware--01e5af02-75fd-44f4-890a-d3b6efee9c64"
}
...
malware which contains the name and description which marks it as OperationTriangulation malware. The second object is indicator which is marked as malware-activities and the pattern for it is that the domain name is senlin83.com. The third object is a relationship object which binds together these two (malware and indicator), meaning that the indicator with domain name snlin83.com indicates the malware OperationTriangulation. Following that, we can see another indicator which just like the first indicator contains the domain name backuprabbit.com. Finally, we have another relationship which combines together the previous indicator and the malware and indicates that the indicator with domain name backuprabbit.com indicates OperationTriangulation malware.
TAXII
Main two concepts in TAXII are the collection and the channel. A collection is a set of STIX packages organised and managed by the single entity, such as a security vendor or a government agency. A channel allows organizations to access a specific collection, such as through API, file exchange, or threat intelligence platform. A channel allows user to push data to multiple consumers.
Using STIX and TAXII can improve the threat intelligence sharing as it provides the common language for the organizations to share and exchange threat intelligence and because the data is in the standard format it can improve threat detection and response. Additionally, using STIX/TAXII ensures that the intelligence data is consistent and accurate.
Indicators Of Compromise Repositories
We have a couple option from where we can download and view IOCs, such as:
– indicators from mvt
https://github.com/AssoEchap/stalkerware-indicators – indicators of different Stalkerwares
https://github.com/AmnestyTech/investigations – indicators from Amnesty International which has created
Analysing backup or a filesystem dump
created by the or analysing files manually by using tools such as the ones provided inside of libimobiledevice.
Mobile Verification Toolkit allows us to extract artifacts from either filesystem dump or iTunes backup, decrypting backup or checking Indicators Of Compromise (IOC).
Mobile Verification Toolkit is a collection of utilities designed for the purpose of identifying any signs of compromise.
Key features of the mvt are:
Decrypting encrypted backups
Processing and parsing records from numerous iOS system and apps databases, logs and system analytics
Compare extracted records to malicious indicators in STIX2 format
Generating JSON logs of extracted records and JSON logs of all detected malicious traces
Interesting files on iOS
databases in
/private/var/Keychains/Analytics/– data about networking, certificate pinning, TLS, etcCalendar.sqlitedbmay contain interesting mail addressesCallHistory.storedatacontains information of incoming and outgoing calls, including messaging applications such as WhatsAppcom.apple.identityservices.idstatuscache.plist– contains cache of Apple user ID authentications which may be useful to get information when apps such as iMessage first established contacts with other registered Apple IDsAddressBook.sqlitedb– contains information about the phone’s address bookShortcuts.sqlite– contains records about the Shortcuts application; can be useful because app may be abused by spyware to obtain persistencecom.apple.osanalytics.addaily.plist– contains history of data usage by processes which is useful to gain traces of malicious process executions and relevant timeframesDataUsage.sqlite– contains information about the network usage by processes. This database does not log WiFi connectionsnetusage.sqlite– like the previous two instances, this one also contains data usage by processesBrowserState.db– contains record of opened tabs in Safari/private/var/mobile/Library/Image Cache/Favicons/Favicons.dbor/private/var/mobile/Containers/Data/Application/*/Library/Image Cache/Favicons/Favicons.db– contains mapping between Favicons URLs and the URLs which loaded them/private/var/mobile/Library/Safari/History.dbor/private/var/mobile/Containers/Data/Application/*/Library/Safari/History.db– contains history of visited URL by Safarisms.db– contains SMS messagesTCC.db
History
Uygures campaign
Pegasus V2
FORCEDENTRY (CVE-2021-30860) vulnerability was used to exploit the device and deliver Pegasus. Pegasus is a spyware developed by the NSO. The FORCEDENTRY was zero-click exploit against iMessage. The vulnerability was present in parsing of GIF images. More information is available in the post of Citizen Lab (https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/) and analysis on the Google Project Zero (
Hermit
Reign
ENDOFDAYS exploit which was used to deliver QuaDream’s spyware known as Reign. QuaDreams is an Israeli company which is similar to NSO company in the way they operate. The entry point was obtained by abusing XML parsing of data inside of database for iCloud calendar. More information about this is available
Pegasus V3
PWNYOURHOME exploit. PWNYOURHOME exploit was two-step zero-click exploit which targets HomeKit in the first step and iMessage in the second step. This exploit was used against iOS 15 and 16. Additionally, they have identified FINDMYPWN exploit which was deployed against iOS 15 in which the first step targets Find My feature, while the second one targets iMessage like PWNYOURHOME. More information about PWNYOURHOME and FINDMYPWN can be seen on the Citizen Lab post (https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/
Operation Triangulation
Pegasus V4
BLASTPASS exploit which was targeting latest iOS at time (16.6) without any user interaction. The exploit was abusing parsing attachments inside of PassKit. BLASTPASS is described in Citizen Lab post (https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
Attack surfaces
Find My
Looking to elevate your expertise in iOS Security?
Offensive iOS Internals Training
365 Days of Access | Hands-On Learning | Self-Paced Training
Downloading samples
ENDOFDAYS malware deletes the events from the calendar which was the entry point to the system. We can download malware samples to learn and analyze malware from places such as and
Conclusion
In the next blog post we will practically inject malware into the device and analyze it.
GET IN TOUCH
Visit our training page if you’re interested in learning more about these techniques and developing your abilities further. Additionally, you may look through our Events page and sign up for our upcoming Public trainings.
Check out our Certifications Program and get Certified today.
Please don’t hesitate to reach out to us through out Contact Us page or through the Button below if you have any questions or need assistance with Penetration Testing or any other Security-related Services. We will answer in a timely manner within 1 business day.
We are always looking for talented people to join our team. Visit out Careers page to look at the available roles. We would love to hear from you.
