Current State Of IOS Malware Detection

Current State Of IOS Malware Detection

Speakers: Matthias Frielingsdorf, Security Researcher, Trail of Bits

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=3gnGPfKu7FE

Overview

In "Poisoned Apples: The Current State Of IOS Malware Detection," Matthias Frielingsdorf, a Security Researcher on the iVerify team at Trail of Bits, delivered a critical assessment of the evolving landscape of iOS malware and the challenges defenders face in detecting it. The talk highlighted the increasing sophistication of mercenary spyware targeting iOS devices, often employing zero-click or one-click exploits that require no user interaction. Frielingsdorf underscored the shift in Apple's stance, from initially not acknowledging iOS malware to actively patching actively exploited vulnerabilities across multiple iOS versions and even issuing threat notifications to targeted users.

The core of Frielingsdorf's presentation revolved around a detailed study of recent iOS malware examples, examining their infection vectors, indicators of compromise (IOCs), and the detection capabilities currently available to security professionals. He meticulously dissected the limitations of traditional app-based detection methods and Mobile Device Management (MDM) solutions, contrasting them with the more potent, albeit resource-intensive, methods of forensic analysis and companion applications. The talk culminated in a strong call to action for Apple, security companies, and the broader community to enhance detection capabilities, particularly through the provision of crucial endpoint security frameworks and improved training for skilled analysts.

This topic is profoundly important because iOS devices, often perceived as bastions of security due to Apple's "walled garden" approach, are increasingly becoming targets for highly resourced state-sponsored or commercial spyware. The lack of robust, scalable detection mechanisms leaves individuals, journalists, activists, and corporate executives vulnerable to sophisticated surveillance. Frielingsdorf's work sheds light on the critical gap between the advanced offensive capabilities of threat actors and the defensive tools available, advocating for a paradigm shift in how iOS malware is approached and detected.

Background

▶ Watch: Current iOS vulnerability landscape and Apple's response (0:50)

The journey of iOS malware detection has been a challenging one, marked by Apple's initial reluctance to acknowledge the existence of exploits. Frielingsdorf noted that it wasn't until iOS 14.4 that Apple began to consistently recognize and patch actively exploited vulnerabilities. This shift is crucial, as it signifies an acknowledgment of a growing threat landscape previously downplayed. Despite this, detailed information about who exploits devices, with what methods, and against whom, often remains unavailable to the public, creating significant hurdles for defenders. While Apple now issues threat notifications to targeted users via iMessage and email, these alerts still lack specific details about the attack, necessitating third-party forensic assistance.

Frielingsdorf presented a chronological overview of prominent iOS malware campaigns, highlighting their evolution in sophistication:

• Pegasus (2016): One of the first widely recognized mercenary spyware samples. It used a WebKit infection vector, targeting human rights activists and journalists. Detection relied on a suspicious SMS link. The exploit chain involved three vulnerabilities (WebKit, info leak, kernel-level vulnerability), dropping files, processes, and establishing persistence.
• Uyghurs Campaign (2019): Attributed by Google to potentially Chinese actors, this campaign targeted the Uyghur Muslim community. It involved an infiltration architecture on the web distributing multiple WebKit exploits (12-14 vulnerabilities over three years). Notably, early versions exfiltrated data unencrypted over HTTP, making network traffic analysis a viable detection method.
• Pegasus v2 (2021): A significant leap in sophistication, this version employed zero-click vulnerabilities in iMessage, Voice over Wi-Fi, and ForcedEntry. Discovered by Citizen Lab and Amnesty International, with analysis by Google Project Zero, detection was based on forensic analysis of infected iPhones and monitoring infiltration infrastructure. IOCs included files, URLs, and processes.
• Predator (2021): Attributed to SideRox, Predator used WebKit exploits (CVEs unknown) to target politicians, journalists, and a Meta manager in Greece. A novel aspect was its use of a shortcut as a persistence mechanism to restart the exploit chain after a device reboot. Detection was again through forensic analysis.
• Hermit (2021): This sample, attributed to RCS Labs, represented a different infection vector: a sideloaded app. Targets in Kazakhstan and Italy were tricked into installing an Enterprise-signed application, often by having their internet connection throttled and redirected to a page prompting the download. Installation required explicit user trust in developer settings. IOCs included the app itself, URLs, and a provisioning profile. Google Project Zero and Google TAG analyzed the Android variant, but the iOS implant's full malicious behavior remains largely unknown.
• Rain (2023): Attributed to Quadream, this spyware likely used calendar events as an infection vector, leading Citizen Lab to dub the vulnerability "end of days." Microsoft Threat Intelligence provided a detailed report. IOCs included files, processes, and URLs.
• Pegasus v3 (2023): The latest iteration from NSO, this version exploited three vulnerabilities across iOS 15 and 16.1, impacting Find My, image processing, iMessage, and HomeKit. Intriguingly, the HomeKit vulnerability was detected by Apple's Lockdown Mode, providing the first public proof of its efficacy against such exploits. Detection was through forensic analysis, revealing files, processes, and crash logs.

A concerning trend highlighted by Frielingsdorf is the increasing reluctance of some security companies to disclose IOCs, citing a desire to maintain private detection capabilities and avoid giving threat actors an advantage. While understandable, this practice hinders broader defensive efforts. Frielingsdorf presented a color-coded slide illustrating the vast number of "white" (unknown) actively exploited vulnerabilities, emphasizing that the discovered spyware samples likely represent only a fraction of the true problem. The talk then outlined the crucial target data points for effective detection: application lists, crash logs, files, network access, and processes. These are essential for identifying malicious apps, profiles, known implants, and potentially unknown implants, utilizing capabilities from sandbox apps, companion apps, MDMs, and forensic analysis.

Key Findings

▶ Watch: Crucial distinction: Malware vs. Jailbreaks (22:00)

Matthias Frielingsdorf's talk illuminated several critical findings regarding the current state of iOS malware detection:

• Sophistication of Threats: Modern iOS malware, particularly mercenary spyware like Pegasus, has evolved to employ highly sophisticated zero-click or one-click exploits, requiring minimal to no user interaction. This drastically lowers the bar for successful compromise and makes traditional user-awareness training less effective.
• Apple's "Walled Garden" Dilemma: While Apple's strict control over the iOS ecosystem ("walled garden") provides significant preventative security benefits and makes exploitation harder, it simultaneously limits the visibility and capabilities available to third-party security solutions for detecting malware after compromise.
• Jailbreak Detection is Not Malware Detection: A central tenet of the talk was the crucial distinction between detecting jailbreaks and detecting malware. Frielingsdorf argued that current jailbreak detection mechanisms are often overly broad, prone to false positives (e.g., flagging old files on updated devices), and fail to differentiate between active/inactive jailbreaks or their type (app-based vs. boot-based). More importantly, they do not inherently detect malicious behavior or the presence of stealthy implants.
• Limitations of App-Based Detection: Applications running in the iOS sandbox have severely restricted access, limiting their ability to detect sophisticated malware. They can only check for the existence of specific files (if the path is known), inspect network traffic via VPN/proxy (without decryption unless a root certificate is installed), or detect manipulation of their own app, none of which are typically sufficient for advanced threats.
• MDM and Companion Apps Offer More Visibility: Mobile Device Management (MDM) solutions provide better device-level information, including installed apps, configuration profiles, and certificates, enabling detection of sideloaded apps like Hermit or malicious profiles. Companion apps running on a desktop (macOS/Linux/Windows), leveraging Apple's lockdownd protocol, can access crash logs and application lists, significantly enhancing detection capabilities beyond the device's sandbox.
• Forensic Analysis as the Gold Standard: For detecting advanced, persistent threats and unknown implants, forensic analysis of encrypted iTunes backups and sysdiagnose data is currently the most effective method. Tools like the Mobile Verification Toolkit (MVT) are instrumental in parsing this vast amount of data to identify IOCs such as suspicious processes, file paths, network usage by process, and access to sensitive device features (e.g., microphone, camera) via the TCC database.
• Critical Need for Endpoint Security: A major finding and recommendation was the urgent need for Apple to provide endpoint security capabilities on iOS. Access to a list of running processes, their execution paths, and detailed file system information would, according to Frielingsdorf, "improve the malware detection on iOS like maybe a thousand times," enabling scalable and automatic detection that is currently impossible.
• Skills Gap and Tooling Deficiencies: The talk highlighted a significant lack of skilled personnel capable of performing in-depth iOS malware analysis and a scarcity of user-friendly, scalable tools for data extraction and analysis, particularly for enterprises.

Technical Deep Dive

▶ Watch: Powerful forensic analysis with Mobile Verification Toolkit (MVT) (38:00)

The technical core of Frielingsdorf's presentation meticulously dissected the available methods for iOS malware detection, highlighting their strengths and, more often, their profound limitations.

A foundational distinction was drawn between jailbreak detection and malware detection. Jailbreaks are typically user-oriented, using known exploits to liberate a device and provide more user control, often with open-source code and detectable artifacts. Malware, conversely, is attacker-oriented, leveraging zero-days or N-days, aiming for stealth, data exfiltration, and control, making it inherently harder to detect. Frielingsdorf criticized current jailbreak detection, noting its common flaws: reporting a "jailbreak" based on a single, possibly remnant file (e.g., on an updated, un-jailbroken device like an iPhone XS on iOS 16.4.1), failing to differentiate between active/inactive, or app-based vs. boot-based jailbreaks. Effective jailbreak detection should instead report specific events like file existence, disabled security mechanisms, or protocol handler manipulation.

App-based malware detection on iOS is severely constrained by the operating system's sandbox model. An app can only check for the existence of files (not their content) if the exact file path is known. It can also configure a VPN profile or proxy to inspect network traffic, but cannot decrypt TLS traffic without installing a root certificate, which requires user interaction. While an app can detect if its own process is being injected or debugged, Frielingsdorf noted that most sophisticated malware does not target specific apps in this manner, making this a less effective detection vector.

Mobile Device Management (MDM) solutions offer a more robust set of capabilities, particularly for supervised corporate devices. MDMs can retrieve device information (iOS version, model), providing a baseline for security posture. Crucially, they can list installed configuration profiles, certificates, provisioning profiles, and applications. This allows for the detection of sideloaded apps like Hermit or malicious profiles. For supervised devices, MDMs can also enforce preventative measures, such as blocking the trust of Enterprise app developers, preventing untrusted TLS certificates, or disallowing the installation of configuration profiles, effectively mitigating many common infection vectors.

The use of companion apps running on a desktop (macOS, Linux, Windows) significantly expands detection capabilities. These apps leverage Apple's lockdownd daemon, which handles communication with iOS devices over USB or Wi-Fi. Tools like the free and open-source libimobiledevice (developed by Nikias Bassen and Funky M) enable access to various device services. Key services include the installation_proxy to list installed applications and provisioning profiles, and the com.apple.crashreportcopy service (or crash_reporter_move in older versions) to extract crash logs and sysdiagnose data. While libimobiledevice documentation lists some "unsupported services," Frielingsdorf noted that many, including crash log copying, are now implemented and functional even on recent iOS versions like 16.4.1.

Forensic analysis stands out as the most comprehensive method for detecting sophisticated iOS malware. It primarily relies on two data sources:

1. iTunes Backups: These can be created via commercial forensic tools (Cellebrite, Magnet), iMazing, iTunes/Finder, or libimobiledevice. Encrypted backups are essential as they contain significantly more sensitive and useful data for security analysis. Analyzing these backups is challenging due to the sheer volume of files, plist files, SQLite databases, and NSKeyedArchivers. Commercial tools exist but are often geared towards legal forensics rather than malware detection. Open-source Python tools can help traverse backups, but deep analysis often requires specialized training (e.g., SANS FOR518, FOR585).

• Since 2021, the Mobile Verification Toolkit (MVT), developed by Amnesty International Tech Lab as part of the Pegasus Project, has revolutionized iOS forensic analysis. MVT focuses specifically on spyware detection, parsing iTunes backups and file system dumps. It supports STIX 2 files for IOCs and extracts crucial records:
• applications.json: Lists installed apps.
• Configuration profiles and shortcuts.
• File paths.
• Process data: Critically, MVT extracts data usage, network usage, and the start path of processes. A process originating from /private/var/temp is a strong indicator of compromise. The absence of a bundle identifier for a running process is also a red flag.
• TCC database: Reveals which processes have accessed sensitive permissions like microphone, camera, or location.

1. Crash Logs and sysdiagnose Data: iOS automatically logs app and kernel crashes, viewable in Settings > Privacy & Security > Analytics & Improvements > Analytics Data. A sysdiagnose archive (100-500 MB) can be manually triggered (volume up + volume down + power button for ~0.7 seconds on iPhone X and later). This archive contains a massive amount of system state information, including:

• A comprehensive list of all running processes.
• Mount and partition information.
• App names, updates, and uninstalls.
• Information about iOS backups.
• Various debugging messages and system logs.
• sysdiagnose data, combined with MVT, provides an unparalleled forensic view, allowing detection of malicious apps, profiles, and known/unknown implants by correlating suspicious process activity, unexpected file creations, and abnormal system behavior.

Demo / Proof of Concept

▶ Watch: Key recommendation: Apple's need for endpoint security (48:00)

While Matthias Frielingsdorf's talk did not feature a live, explicit demo in the traditional sense, the entire presentation served as a conceptual proof of concept for the methodologies and tools he advocated. He systematically outlined how various data points, when collected and analyzed using specific tools, could lead to the detection of sophisticated iOS malware.

For instance, Frielingsdorf's discussion of libimobiledevice and its capabilities to extract application lists, provisioning profiles, and crash logs directly illustrates how a companion app functions. By detailing the information available through services like installation_proxy and com.apple.crashreportcopy, he implicitly demonstrated the practical application of these tools for initial reconnaissance and data gathering.

The most compelling "proof of concept" was the in-depth explanation of the Mobile Verification Toolkit (MVT). By enumerating the specific records MVT extracts—such as process data (including start paths like /private/var/temp and network usage), the TCC database for permission access, and file paths—Frielingsdorf demonstrated how MVT transforms raw forensic data into actionable intelligence. He highlighted how these artifacts, when analyzed, directly correspond to the IOCs left by known malware like Pegasus, effectively proving the toolkit's utility in identifying even highly stealthy threats. The mention of MVT's use in the Pegasus Project further solidifies its real-world efficacy.

In essence, Frielingsdorf provided a comprehensive blueprint for performing iOS malware detection, outlining the "how-to" for each stage of analysis, from leveraging MDM capabilities for basic visibility to executing advanced forensic investigations with specialized tools. The talk served as a powerful conceptual demonstration of how combining these disparate data sources and analytical techniques is currently the most viable path to uncovering sophisticated threats on iOS.

Defensive Implications

▶ Watch: Q&A: Using private frameworks for app analysis (54:00)

Matthias Frielingsdorf concluded his talk with a strong call for action, outlining crucial defensive implications for various stakeholders. He observed that most companies currently limit their Mobile Threat Defense (MTD) efforts to automatic solutions like MDM and app-based detection, which he demonstrated are often insufficient for sophisticated iOS malware.

To improve detection, Frielingsdorf advocated for several key changes:

• Elevate Jailbreak Detection: Instead of generic "jailbreak detected" alerts, tools should provide granular information: specific files found, disabled security mechanisms, or manipulated protocol handlers. They must differentiate between active/inactive and app-based/boot-based jailbreaks, and crucially, validate findings to avoid false positives on updated, un-jailbroken devices.
• Apple's Role in Endpoint Security: The most significant recommendation was for Apple to provide endpoint security capabilities on iOS. Access to a list of running processes, their execution paths, and detailed file system information (similar to what sysdiagnose provides but in a more accessible, real-time manner) would dramatically enhance detection. Frielingsdorf estimates this could improve malware detection "a thousand times," enabling automatic and scalable solutions that are currently impossible due to the "walled garden" limitations. This could be achieved via entitlements or the MDM protocol while preserving privacy.
• Companies' Proactive Measures: Enterprises should begin implementing crash log and forensic analysis as a standard practice, rather than relying solely on automatic, superficial checks. This requires using companion apps for data extraction and investing in the development of in-house expertise or leveraging external forensic services. Monitoring network traffic for anomalies also remains a viable first line of defense, especially against less sophisticated exfiltration methods.
• Training and Expertise: There is a critical shortage of skilled iOS malware analysts. Frielingsdorf emphasized the need for specialized training programs focused on iOS malware detection and encouraged security professionals to shift their focus towards this area. He highlighted organizations like Amnesty International Tech Lab as key resources for expertise and potential training opportunities.
• Research Opportunities: Further research is needed to combine Enterprise Mobility Management (EMM) and MTD solutions with in-depth crash log and forensic analysis. Exploring the vast amount of data within iOS backups and syslog streams offers significant untapped potential for new detection methods.

In summary, Frielingsdorf's defensive implications point to a necessary paradigm shift: moving beyond reactive, limited app-based detection to proactive, in-depth forensic analysis and advocating for fundamental platform-level changes from Apple. Without these improvements, the current state of iOS malware detection will continue to allow advanced threat actors to effectively target and monitor populations.

Key Takeaways

• Sophisticated Threats Demand Advanced Detection: Modern iOS malware, particularly mercenary spyware, relies heavily on zero-click and one-click exploits, making it extremely difficult to detect without deep system visibility.
• App-Based Detection is Insufficient: Due to iOS sandbox limitations, applications alone cannot effectively detect sophisticated malware. They are restricted to basic file existence checks (if paths are known) and limited network traffic analysis.
• Forensic Analysis is the Current Gold Standard: For detecting advanced, persistent, and unknown iOS implants, forensic analysis of encrypted iTunes backups, sysdiagnose data, and crash logs, often leveraging tools like the Mobile Verification Toolkit (MVT), is the most effective approach.
• Endpoint Security Capabilities are Crucial: Apple must provide endpoint security capabilities on iOS, including access to running process lists, their execution paths, and more granular file system information. This is the single most impactful change that would enable scalable and automatic malware detection.
• Jailbreak Detection Needs an Overhaul: Current jailbreak detection methods are often flawed, producing false positives and failing to differentiate between specific malicious behaviors. They must evolve to provide granular, validated insights into specific security anomalies rather than generic "jailbreak" alerts.
• Investment in Expertise and Tools is Paramount: There is a significant need for more skilled iOS malware analysts and accessible, user-friendly tools to facilitate data extraction and analysis for enterprises and individual users alike.

About the Speaker(s)

Matthias Frielingsdorf is a Security Researcher at Trail of Bits, where he works on the iVerify team. His expertise lies in mobile security, particularly focusing on iOS. Prior to his role at Trail of Bits, Matthias was a key member of the mobile security team at Deutsche Bahn, where he was responsible for securing approximately 300,000 mobile devices against various threats. He is active on Twitter under the handle @healthydriver.