Building A Pipeline To Analyse IOS Devices At Scale

The talk starts from reports of spyware targeting civil society and journalists, and from the question of how an organisation could check many phones for signs of compromise. The speakers argue that backup-based tools give little view of operating-system activity, so they turned to the sysdiagnose archive that Apple builds into every iOS device. That archive holds logs, running processes, battery and network statistics, lock data and preferences, which makes it a much richer source for analysis.

The middle of the talk covers the tooling and collection problem. The team built an open-source framework, inspired by memory forensics tooling, that parses the many file formats in a sysdiagnose, aligns the different timestamp formats, and outputs JSON or JSON Lines for analytics platforms. Collection is the harder part. Manual triggering does not scale, so they reviewed options such as iOS shortcuts, MDM-deployed companion apps, remote triggers, and assisted collection through a computer. They described a companion app that guides users through sharing their file and works around sandbox limits to detect when generation has finished.

The closing sections look at what remains unsolved. Local collection holds only short time windows of logs, data volumes are very large, and there are few shared indicators or mobile threat descriptions to search for. The speakers also point out that mobile vendors offer no way to verify device integrity. Their plans include releasing more components as open source, exploring further artifacts, and working with other organisations to share techniques.