Death Profile: Now iOS Has Been Compromised to Suspected Ransomware
summary
Claims a remote iOS ransomware vector that installs malicious configuration/provisioning profiles — dubbed death profile — which deploys many web‑clip icons, triggers SpringBoard watchdog timeouts and persistent crashes, and survives until a factory reset. Attack code and a web template appear on GitHub and automate multiple installs. A detection prototype uses a Frida-based hook server to log Safari/Mail/profiled processes plus a local VPN endpoint and dynamic sandbox to extract profile XML, flag unset removal flags and block or alert; demos show the crash and the detection working.
AI-written summary · about
chapters (6)
- 0:00Introduction and speakers
- 1:05Malicious profile threat
- 6:36Technical background
- 9:31Analysis and exploitation
- 15:26Detection and defense
- 22:56Demonstrations and conclusion
related talks
23mMalicious MDM: Fun with iOS MobileConfigs
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs
37mEnterprise Apps: Bypassing the IOS Gatekeeper
48mMobile Security Attacks: A Glimpse from the Trenches
58mUncovering OWASP’s Mobile Risks in iOS Apps
48mA Practical Attack Against VDI Solutions
40mStealing User's Identity
47mSecurity Threats & Mitigations for iOS Developers