Poisoned - How Do We Find Them?

The talk updates the speaker's earlier overview of iOS spyware with the samples reported in 2023, including Operation Triangulation, a third Pegasus version, Quadream Reign and a new Predator sample. For each, it looks at which indicators of compromise were published and how the infections were found. The core point is that an app on the device sees very little, while backups and sysdiagnose archives expose files, network activity and running processes.

The middle section covers a practical workflow. A live demo creates an encrypted local backup in Finder and triggers a sysdiagnose on an iPhone, then copies the archive to a Mac, where its process list can show root-level processes from unexpected sources. The speaker stresses the drawbacks: long runtimes, little feedback on the phone, the need for Python skills, and a shortage of forensic experts. He suggests that targeted people keep their systems updated, back up regularly to storage away from their Mac, and consult specialists when a phone behaves oddly.

The closing section looks at developer mode, which the Predator sample checks before running, and demonstrates on a jailbroken iOS 15 device how privileged access reveals apps and a known Predator-associated file. The conclusion is that iOS spyware is still found mainly through manual forensics, that endpoint visibility on iOS needs work, and that companies should plan for targeted staff.