7.9 KiB
| title | date | tags | author | |||||
|---|---|---|---|---|---|---|---|---|
| Mobile Verification Toolkit for Android and iOS | 2022-11-19 |
|
Raja Grewal |
One of the key principle components involved in maintaining both strong privacy and security infrastructure is the detection of existing and previous compromises. On mobile operating systems such as Android and iOS it is difficult for a end-user to execute this type of search given the lock down nature of these devices. While their respective app stores have a plethora of so-call “anti-virus” programs, these are subject to the same pitfalls as their desktop variants.
Building on this, both independent and mainstream media are constantly awash with stories regarding the frequent discoveries of sophisticated malware installed on users phones that have the ability totally compromise a device by giving external parties effectively root access. The most well-known of these variants of spyware target hitherto unknown zero-day exploits as thoroughly discussed by Amnesty International Security Lab and The Citizen Lab.
For example, there is very little any end-user can do to detect intrusions by the infamous Pegasus spyware made by the NSO Group, see [1, 2, 3, 4]. Other high-profile recent examples include Candiru's spyware and Cytrox’s Predator.
It should be recognised that being targeted by complex mercenary spyware is an expensive undertaking and so the overwhelming majority individuals are very unlikely to be affected. The confirmed targets involve politicians, activists, developers of AI-based guidance systems, lawyers, and whistleblowers. See The Citizen Lab's publication list for more references.
Detecting traces of compromise with mvt
Fortunately, Amnesty International Security Lab have made public their Mobile Verification Toolkit (MVT) to facilitate the consensual forensic analysis of Android and iOS/iPadOS devices for the purposes of identifying traces of compromise.
MVT analyses your device for a broad range of indicators of compromise obtained from a wide range of sources including Amnesty Tech and Echap. Note the tool is currently only accessible using the command line interface.
The software can be installed from some of the following sources:
- Arch Linux package
- GitHub repository
- PyPi package
For iOS/iPadOS devices, if you decide to back up data with libimobiledevice instead of iTunes, you may need to install from source using a git clone of the repository as opposed to using the latest release in order for it to be compatible with more recent iOS releases as there can often be a large time delay between libimobiledevice releases.
Next, always ensure either the mvt-android download-iocs or mvt-ios download-iocs command is performed prior to a scan to ensure the latest indicators have been obtained.
The instructions for then using the software are fairly straight-forward to learn when performing both Android or iOS/iPadOS analyses. In both cases it is advised to always analyse encrypted backups as these will incorporate the scanning of more files.
While an even more thorough scan can be performed by rooting Android and jailbreaking iOS/iPadOS due to more internal logs being accessible, this is strictly not recommended. One situation where this might be advised is if your now using another device and desire extended scans of no longer used devices.
Regardless, it should be noted that Android devices currently provide far less diagnostic information that iOS/iPadOS devices and so mvt capabilities are correspondingly diminished.
Overall, it should be clear from the command line outputs if any known compromises are detected. Additional output details at conclusion will also then provided in the format of a timeline CSV and an assortment of JSON files. If any files ending with “_detected.json” are present, this implies your device shows evidence of past and/or present compromise using the currently available list indicators.
Limitations
While mvt is a very handy tool and periodic scans should be performed with a frequency proportional to your threat model, it is once again only a detection tool based on known indicators of compromise. It is also reasonable to assume that once indicators are publicly exposed, sophisticated threat actors will take steps to modify their existing spyware and potentially even temporarily erase it from your device in order to avoid detection. This can be very clearly seen through the time-evolution of NSO Group’s Pegasus infrastructure (Section 9.3) where known malicious domains are quickly replaced. More recently there appears to be shift to using cloud service providers.
Therefore, as with “anti-virus” programs, mvt is simply a detection tool with no explicit preventive capabilities, but unlike them, mvt does not require extensive administrative permissions at runtime and can be used in a purely offline manner with no telemetry.
Advanced extensions
Tools like mvt are powered by the use of Structured Threat Information Expression (STIX) files to identify potential traces of compromise. The existing downloaded indicators can observed on any Linux distribution in the .local/share/mvt/indicators/ directory of the users home directory. While at first glance these files can be bewildering, their structure is relatively simple when analysed in terms of relationships between entries (graph database) and their respective definitions.
The large flexibility of this format combined with ready-made tools like mvt have the capacity to empower any end-user to perform fully customised deep scans of their mobile devices using indicators of their choosing. One application of this incredibly powerful method is to allow anyone (with minimal mvt modifications) to comprehensively detect in the history of their device the presence any user-defined domain, server, or connection deemed to be suspicious.
While this certainly has the potential to cause excessively high amounts of false positives if benign indicators are selected, the feature is much appreciated.
TO BE PUBLISHED:
- Explain STIX 2.0 formatting for simple detection rules.
- Walkthrough example on how to perform a custom scan looking for all references to a particular domain on both Android and iOS/iPadOS.