In Walled Gardens be Careful of Poisoned Apples

The talk opens with a survey of publicly documented iOS malware campaigns, from Pegasus in 2016 through later zero-click and one-click examples. For each case the speaker outlines the infection path, the exploit chain that was used, and the capabilities the implant gave an operator, such as access to messages, contacts, files, the camera and the location. The aim is to connect the dots across reports that were already analysed in depth.

The middle section separates jailbreaks from malware. Both begin with an exploit and privilege escalation, but a jailbreak then changes the device so users can install tools, while malware wants to stay hidden and typically relies on zero-day exploits. The speaker explains why most mobile defense products look for jailbreak artifacts such as files, remounted partitions and URL handlers, and why that approach misses on-device malware. Options such as crash log review, network analysis and forensic backup inspection are covered along with their practical limits.

To close, the talk proposes changes to detection. Products should flag malicious behaviour instead of a jailbreak label, separate active jailbreak traces from leftovers after a reboot or update, and correlate several artifacts before drawing conclusions. The speaker also asks Apple for richer forensic and endpoint-style access on iOS, and calls for more training in mobile exploitation and detection. The takeaway is that vendor tooling needs better telemetry and that the community has to work on the problem together.