SectraTEKby Prudential AssociatesThreat research and evidence-type articles from the SectraTEK Research Lab, each with its sources, and short briefs on mobile spyware, stalkerware and exploits: what is happening, what it means for your examinations and where to look first.
Threat Research
At a two-day offensive-security conference in Paris, researchers showed an iPhone restarting into a root shell and a run of Android and boot-level research. Almost none of it has been released, and that gap is the story.
34 articles
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Threat Research
Evidence Type
Evidence Type
Evidence Type
Evidence Type
Evidence Type
Evidence Type
Evidence Type
Threat briefs and release notes describe topics and outcomes, not method.
A match is a lead with context, not a verdict. How to read the family, the campaign and the evidence around a match before you decide what it means.
Profiles are how organizations manage iPhones, and a place an unwanted change can hide. How to tell an expected profile from one that deserves a second look.
A few permissions give an app a great deal of reach. Which to check first on an Android phone, and how to read them against what the app is for.
A match is where a review begins. This brief gives an order of work that keeps the conclusion where it belongs: with the examiner.
An app, a file, a domain, a certificate and an address are different kinds of evidence, and each one raises a different question. Say which kind you have before you ask what it means.
Every indicator keeps its malware family and its campaign, so a match arrives with context. A match shows the family and the campaign it belongs to, so you can see what was found and how much weight it deserves.
Every result carries a clear severity, so the strongest evidence is at the top of your review. Context-only matches are rated low and labeled, so they inform your review without distracting from the evidence that matters.
One match is a reason to look. Two unrelated signals that point the same way are a reason to look harder. Read the match beside what the device is configured to allow: priority tells you where to look first, and sits beside the threat-intelligence result so you can read both side by side.
Could a work profile, a security tool, a shared device or a recent repair explain what you see? The AI-Dossier’s instructions ask the report to separate evidence from inference, weigh benign explanations, keep contradictions and limitations in view, and never treat a result with no findings as proof that a device is clean. Write the ordinary explanation down, even when you rule it out.
A result with no match is reported with the coverage behind it, so you can state exactly what was compared. No findings means no known indicators were found in the evidence provided. It does not mean the device is clean, and a report should not say so.
SectraTEK reports what it compared and what matched, and the examiner draws the conclusion. Every lead is marked for corroboration, and the conclusion stays with the examiner.
Related: the detection engines and findings and reporting.
A profile can be routine administration or the quietest place for an unwanted change. The difference is who installed it, and why.
A configuration profile is a file that tells an iPhone or iPad how to behave. It can set up Wi-Fi, email and VPN accounts, decide which certificates the device trusts and apply restrictions. Organizations use profiles to manage many devices at once, and that is the ordinary case.
Because a profile can change what the device trusts and how its traffic is handled, it is also a sensible place to look when you ask whether a phone has been altered.
A profile from an employer, a school or a carrier, installed through an enrollment the owner remembers, usually carries a clear name and a known organization. If the owner can say who manages the phone, you can ask that organization for its list of profiles and compare.
Look twice at a profile with no owner anyone can name, a vague or misleading name, or a certificate, VPN or proxy setting that nobody asked for. A personal phone that holds a management profile the owner does not recall enrolling in deserves a question. So does a profile installed close to the time of another event in the case.
On a managed device, some profiles cannot be removed by the owner. That is a feature of management, not a sign of compromise, but it means the owner may not know what the profile allows. Record the managing organization and ask what it sees.
SectraTEK reconstructs the device’s recoverable security and privacy configuration: screen lock, updates, developer and debugging options, privacy settings and installed configuration profiles. Only settings the evidence establishes are assessed. Each control is reported with a clear status, and controls the evidence cannot establish are left out of the score.
Security posture shows how the device is configured, beside the threat-intelligence result. A setting to review is a hardening recommendation.
Record the profile name, the organization and the installation order before anything is changed. A profile alone is not evidence of compromise, and removing one before it is preserved removes the evidence of why it was there.
Related: the detection engines.
Monitoring apps rarely need one permission. They need a combination. Start with the access that gives an app the most reach.
Plenty of ordinary apps ask for the camera, the microphone or location. The pattern that deserves attention is an app that can read messages, follow location in the background and stay active with the screen off, all at once, and has no reason to.
Android keeps a short list of special accesses apart from the ordinary permissions: accessibility services, notification access, device administration, permission to install other apps and permission to draw over other apps. Each one lets an app see or do far more than a normal permission. Check them first, and compare each with what the app is for. A notes app that can read every notification has a question to answer.
SectraTEK brings each app together with the sensitive capabilities it can reach, on iOS and Android, and shows how the app was installed. An app that came from outside the usual store, or that arrived shortly before the events you are examining, is worth more of your time than one that came with the phone.
Each app gets a Low, Medium or High review priority that tells you where to look first. Priority follows the access an app can reach, never its name or popularity. Every permission record is tied to its app, so each app’s access is shown as the evidence recorded it.
Each permission is shown with its recorded state, so you can tell what an app was able to reach and decide whether it used it.
When a phone may be monitored by someone close to its owner, the owner’s safety comes before the clean-up. Removing a monitoring app can tell whoever installed it that it was found. Plan the order with the owner: preserve the evidence, decide where the phone is safe to use, then act.
A finding points you to what deserves review. Insight leads are starting points for corroboration, never verdicts.
Related: the detection engines and use cases for legal professionals.
The SectraTEK newsletter brings product releases and threat briefs, about once a month. We send a confirmation link first; it works for 48 hours.