7 ms·
How can you tell that you were breached?
by drakenot 7mo ago
How can you tell that you were breached?
- walterbell 7mo agoPresence of one or more: unexpected outbound traffic observed via Ethernet, increased battery consumption, interactive response glitching, display anomalies ... and their absence after hard reset key sequence to evict non-persistent malware. Then log review.
- avazhi 7mo ago[flagged]
- nickburns 7mo agoTo where?
- walterbell 7mo agoUsually a generic cloud provider, not unique, identifying or stable.
- Someone1234 7mo agoSo how did you identify this as a breach? I'm struggling to find this credible, and you've yet to provide specifics. Right now it comes across as "just enough knowledge to be dangerous"-levels, meaning: you've seen things, don't understand those things, and draw an unfounded conclusion. Feel free to provide specifics, like log entry lines, that show this breach.
- walterbell 7mo agoPlease feel free to ignore this sub-thread. I'm merely happy that Apple finally shipped an iPad that would last (for me! no claims about anyone else!) more than a few weeks without falling over. To learn iOS forensics, try Corellium iPhone emulated VMs that are available to security researchers, the open-source QEMU emulation of iPhone 11 [1] where iOS behavior can be observed directly, paid training [2] on iOS forensics, or enter keywords from that course outline into web search/LLM for a crash course. [1] https://news.ycombinator.com/item?id=44258670 https://news.ycombinator.com/item?id=44258670 [2] https://ringzer0.training/countermeasure25-apple-ios-forensics/ https://ringzer0.training/countermeasure25-apple-ios-forensi...
- Someone1234 7mo agoI think this just further highlights my credibility point.
- walterbell 7mo agoWith the link I provided, a hacker can use iOS emulated in QEMU for: • Restore / Boot • Software rendering • Kernel and userspace debugging • Pairing with the host • Serial / SSH access • Multitouch • Network • Install and run any arbitrary IPA Unlike a locked-down physical Apple device. It's a good starting point.
- nickburns 7mo agoI'm much more convinced that you're competent in the field of forensics. But I still don't think suspicious network traffic can be categorically defined as a 'device breach.' For all you know, the traffic you've observed and deem malicious could just as well have been destined for Apple servers.
- philsnow 7mo agoThey said upthread that they had blocked 17.0.0.0/8 ("Apple"), but maybe there are teams inside Apple that are somehow operating services outside of Apple's /8 in the name of Velocity? I kind of doubt it, though, because they don't seem like the kind of company that would allow for that kind of cowboying.
- nickburns 7mo agoI don't doubt it in the slightest. Every corporate surveillance firm—I mean, third-party CDN in existence ostensibly operates in the name of 'velocity'.
- acdha 7mo agoApple has used AWS and Cloudflare in the past, too, so it’s not like seeing that traffic is a reliable indicator of compromise.
- acdha 7mo agoHow did you link that traffic to malicious activity?
- walterbell 7mo agoBy minimizing apps on device, blocking all traffic to Apple 17.x, using Charles Proxy (and NetGuard on Android) to allowlist IP/port for the remaining apps at the router level, and then manually inspecting all other network activity from the device. Also the disappearance of said traffic after hard-reset. Sometimes there were anomalies in app logs (iOS Settings - Analytics) or sysdiagnose logs. Sadly iOS 26 started deleting logs that have been used in the past to look for IOCs.
- Melatonic 7mo agoAre you sure whatever you have configured in the MDM profile or one of these apps like Charles Proxy is not the source of the traffic? Are you using a simple config profile on iOS to redirect DNS and if so how are you generating it ? Full MDM or what are you adding to the profile ?
- walterbell 7mo agoTraffic was monitored on a physical ethernet cable via USB ethernet adapter to iOS device. Charles Proxy was only used to time-associate manual application launch with attempts to reach destination hostnames and ports, to allowlist those on the separate physical router. If there was an open question about an app being a potential source of unexpected packets, the app was offloaded (data stayed on device, but app cannot be started). MDM was not used to redirect DNS, only toggling features off in Apple Configurator.
- universenz 7mo agoSurely you used several USB Ethernet adapters to rule them out as being the source as well right? Those types of dongles are well known for calling home.
- meindnoch 7mo agoLOL. Aren't you a little paranoid?
- walterbell 7mo agoJust trying to use expensive tablets in peace. Eventually stopped buying new models due to breaches. After a few years, bought the 2025 iPad Pro to see if MTE/eMTE would help, and it did.
- alt227 7mo agoLol 'breaches'. I agree with other posters that you seem to be capable of network level forensics, but you have said nothing to back up what you consider a device breach other than 'some cloud destined network traffic which disapears after a hard reset'. In my experience of forensic reports, this link is tenuous at best and would not be considered evidence or even suspected breach based on that alone.
- radicaldreamer 7mo agoThere’s no hard evidence that you’ve put forward that you’ve been breached. Not understanding every bit of traffic from your device with hundreds of services and dozens of apps running is not evidence of a breach. Have you found unsigned/unauthorized software? Have you traced traffic to a known malware collection endpoint? Have you recovered artifacts from malware? Strong claims require strong evidence imo and this isn’t it.
- walterbell 7mo agoAs mentioned elsewhere in this thread, traffic from each iOS app was traced via Charles Proxy, the endpoints allowlisted for normal behavior, and finally the app was offloaded so it could not generate any traffic from the device. Over time, this provided a baseline of known outbound traffic from the device, e.g. after provisioning a new device with a small number of trusted apps. Apple traffic was isolated separately, https://news.ycombinator.com/item?id=46994394 https://news.ycombinator.com/item?id=46994394 Traffic outside that baseline could then be reviewed closely.
- amazingman 7mo agoWhat are examples of logs that you're considering IOCs? The picture you are painting is basically that most everyone is already compromised most of the time, which is ... hard to swallow.
- walterbell 7mo agoI reported the experience on my devices, which said nothing about "everyone".
- deleted 7mo ago[deleted]