malware-indicators

Any iOS device backup, including older ones, can be scanned for IOCs (Indicators of Compromise) for patched CVEs. If you own a macOS device, your iOS device can be hardened via the free Apple Configurator app for local MDM policy, e.g. disable AirDrop, whitelist WiFi without auto-join, disallow USB devices when locked. If the device is compromised, it can be restored after backup, erase, DFU and iOS reinstall. Mobile Verification Toolkit, https://docs.mvt.re/en/latest/ios/methodology/ Forensic howto, https://www.amnesty.org/en/latest/research/2021/07/forensic-... IOCs: https://github.com/citizenlab/malware-indicators IOC tools and sources: https://github.com/sroberts/awesome-iocs Device Firmware Upgrade (DFU), https://www.theiphonewiki.com/wiki/DFU_Mode For small business, Apple offers MDM for $3/device/month, https://www.apple.com/new

The open-source Mobile Verification Toolkit scans local iPhone/iPad backup images for filesystem IoCs (Indicators of Compromise) cataloged in STIX format, https://docs.mvt.re & https://github.com/mvt-project/mvt > A collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices ... released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus project along with a technical forensic methodology.. STIX IoC format, https://www.oasis-open.org/2021/06/23/stix-v2-1-and-taxii-v2... > The [threat intelligence] work was based initially on three specifications contributed by the US Department of Homeland Security (DHS) for development and standardization under the OASIS open standards process: STIX (Structured Threat Info

Is your iOS device hardened, e.g. Lockdown Mode, locally supervised by Apple Configurator 2 with restrictive policies, whitelisted WiFi without auto-join, disabled AirDrop, etc? You can also look for forensic artifacts in iOS device backups. https://docs.mvt.re/en/latest/ios/methodology/ https://www.amnesty.org/en/latest/research/2021/07/forensic-... https://github.com/citizenlab/malware-indicators https://github.com/sroberts/awesome-iocs