'Triangulation' Malware- New Tool to Find iPhones & iOS Devices Infection

Kaspersky reported earlier this month that they’ve chanced on a brand new Zero-click iOS exploit for the time being being exploited by menace actors.

The exploitation involves utilizing iMessage as the provide channel to compose root privileges.

Threat actors were utilizing Inform and Retain a watch on (C2) servers to preserve up a watch on and preserve watch over the compromised iOS devices.

Contemporary experiences counsel that a brand new tool named “triangle-test” become launched, which would possibly perhaps scan iTunes backups for traces of IoCs (Indicators of Compromises).

This become launched as a pypi mission, “triangle-test 1.1”.

Triangle Take a look at

This mission is launched as a Python script that can scan iTunes backups of iPhones and test for any traces of compromise.

The script has two Python dependencies, colorama, which is outdated college for pretty printing, and pycryptodome.

For utilizing this equipment, the lisp blueprint of the iTunes backup directory is required, which involves many sub-directories and recordsdata admire “Manifest.db” and “Manifest.plist”.

For decryption, the password outdated college for encryption is required (If the backup is tell up in iTunes). For developed inspire creation, the idevicebackup2 tool would possibly perhaps per chance also furthermore be outdated college, which relies on the initiate-provide equipment named “libimobiledevice”

Scanning

The tool is inch on the iTunes backup directory, which is scanned for suspicious task.

If the tool finds any malicious task, the tool will print the output as SUSPICION. If the tool finds any Indicators of Compromise (IoC), this would possibly perhaps per chance print DETECTED.

Set up and Configure

To set up this mission, the next instructions would possibly perhaps per chance also furthermore be outdated college

python -m pip install triangle_check
python -m pip install -r requirements.txt
python triangle_check.py

For putting in this as a pip equipment,

git clone https://github.com/KasperskyLab/triangle_check
cd triangle_check
python -m build
python -m pip install dist/triangle_check-1.0-py3-none-any.whl

Windows or Linux users are advised to employ the binary builds of this mission.