Placeboed Apples: A New Way to Hunt Spyware on iOS

No ratings

Presented at Objective by the Sea 8.0 by

Matthias Frielingsdorf

Detecting iOS malware remains one of the most elusive challenges in Apple security. Only a handful of organizations have succeeded in identifying advanced threats, and for good reason: iOS's security architecture lacks traditional hooks such as the Endpoint Security Framework, leaving forensic acquisition as one of the few viable avenues for investigation. But forensic dumps are massive, containing thousands of files and extensive personal data — making malware detection feel like searching for a needle in not one, but thousands of haystacks. So how do we even begin to narrow the search? This talk introduces a new concept for tackling this problem on iOS: Malware Simulation. We'll walk through the process of building an iOS malware simulator — a tool designed to mimic known spyware behavior in a controlled environment. This simulator allows us to identify forensic indicators, highlight high-value files, and guide real-world investigations more effectively. We'll start by reviewing behaviors from known malware families, including a recently analyzed sample of NoClip. Then, we'll outline the technical challenges and design decisions involved in constructing the simulator. Finally, we'll demonstrate how the simulator can be used to surface key forensic artifacts — turning chaotic data sets into focused investigations. If you’re working with forensic data from iOS devices and wondering where to even begin, this talk will provide you with a practical and innovative path forward.