From Theory to Practise - Let's find an iOS Commercial Spyware Sample

The talk continues a series on detecting iOS spyware and asks whether forensic-based detection holds up on a real case. It starts with a customer's device whose crash logs and iTunes backup showed repeated crashes in system processes, which pointed to an exploit sample tied to NSO's BlastPass chain. The sample was delivered through an image attachment, and its hidden payload was built from NSExpression code that could call Objective-C runtime functions and sidestep code-signing controls.

The middle section covers the analysis itself. The staged payloads were compressed, encoded and partly encrypted, so the work involved decoding them and rewriting the NSExpression logic into a readable pseudo-Objective-C form. The analysis showed a configuration check that limited the exploit to certain iOS versions and device models, timing checks that exited when execution looked slow, suppression of logging, and deliberate crashes of helper processes so that other bugs were not exposed. Some stages stayed unrecovered, including the sandbox escape and the command-and-control structure.

The speaker then tested the approach at scale. A consumer feature that accepted uploaded diagnostic data was used to scan about 2,500 devices, producing roughly 2.5 Pegasus detections per 1,000 devices. The closing section argues for better iOS telemetry similar to macOS Endpoint Security, clearer notifications that show attack timing, better access to memory and samples for forensics, and more sharing of samples between defenders. The takeaway is that detection depends on collecting the right forensic data, and that current access limits make that difficult.