Cache Me If You Can: Modern IOS Spyware and the Vanishing Forensic Trail
summary
Commercial spyware like NSO Pegasus and NoClip actively removes forensic traces: agents wipes shutdown log, securely deletes payloads, disables analytics, suppresses logs and burn off within hours after execution. NoClip likely uses a WebKit exploit and an iMessage loader, hijacks legitimate processes to erase crash and unified logs and even contains a potent citizen lab function that deletes telemetry. Current response uses MVT and full file system dumps but the recommended mitigation is automated, frequent telemetry collection and continuous monitoring to catch the occasional leftover IOC.
AI-written summary · about
chapters (6)
- 0:00Modern iOS spyware threats
- 1:46NSO Group’s iOS methods
- 4:35Spyware forensic artifact destruction
- 7:23NoClip hijacks iOS processes
- 8:45Post-compromise forensic challenges
- 10:29Continuous monitoring solutions
related talks
49mEffects of Weaponized Malware on End-to-End Encryption and Exfiltrating Data from Signal Messenger
30mDeath Profile: Now iOS Has Been Compromised to Suspected Ransomware
49mContain Yourself: Building Secure Containers for Mobile Devices
58mUncovering OWASP’s Mobile Risks in iOS Apps
40mJill and the BeenSTALKed
45mKeynote Address: Click Here to Hack Your Target: A Perspective on the Past...
49mLeveraging MacOS's Networking Frameworks to Heuristically Detect Malware
32mUsing Geopolitical Conflicts for Threat Hunting