Placeboed Apples: A New Way to Hunt Spyware on iOS

Matthias Frielingsdorf opens with the core problem of hunting iOS spyware: Apple's platform offers no Endpoint Security-style hooks, so investigators depend on forensic dumps holding thousands of files. He reviews how commercial spyware campaigns have changed over recent years, with published indicators becoming scarcer, and walks through a typical attack chain from infiltration and privilege escalation to implant activity and cleanup, noting which traces each stage can leave behind.

The middle section covers behaviors from several families, including Pegasus, Predator, Triangulation, NoClip and Graphite, such as crash logs, unified log entries, shutdown logs and aggressive deletion routines. The core idea is a malware simulator that reproduces these behaviors on a controlled test device, built on a TrollStore-based approach for privileged helpers. Design constraints like minimizing device-wide changes and keeping runs repeatable shape the build, and simulated runs produce artifacts that can be searched for in a sysdiagnose.

The closing demo shows a simulation running alongside a prototype viewer that flags executables launched from private temp directories. The speaker argues that a limited endpoint-security-style framework could have caught many past samples, and points to the absence of such APIs on iOS and the privacy trade-offs Apple would face. Attendees leave with a method for testing detections and locating high-value artifacts in forensic data.