ZeroDayRAT and iOS

The iOS Security Model

Sandboxing and application isolation

Every iOS application runs inside a sandbox that constrains its filesystem and inter-process reach. An application cannot simply read another application’s data, enumerate arbitrary installed software or observe the screen of another app. This design means that the Android techniques most commonly reported for commodity spyware — accessibility abuse, overlay prompts, broad package enumeration — have no direct iOS equivalent.

Code signing and entitlements

iOS requires that executable code be signed and that privileged functionality be authorised by entitlements issued through Apple’s process. Capabilities are therefore not simply requestable at runtime; they must be granted at build and distribution time. This is why commodity malware on iOS is rare compared with Android, and why credible iOS compromise usually implies either exploitation or an abuse of enterprise or configuration-based distribution.

Permission model and indicators

User-facing permissions still gate location, camera, microphone, contacts and local network access, and the system displays in-use indicators for camera and microphone. These indicators are among the most useful signals available to a non-technical user who suspects surveillance.

Configuration Profiles and MDM Considerations

Configuration profiles legitimately configure devices for enterprises, but they are also a recurring abuse path in social-engineering attacks: a user is persuaded to install a profile that changes trust settings or enrols the device in unwanted management. Reviewing installed profiles is a fast, high-value check.

• Enumerate installed configuration profiles; anything unrecognised should be treated as suspicious.
• Verify which MDM, if any, the device is enrolled in, and whether that enrolment is expected.
• Review installed enterprise-distributed applications and their trust status.
• Confirm iOS version currency; update discipline remains the strongest baseline control.

Lockdown Mode

Lockdown Mode is an optional hardened configuration that reduces attack surface by restricting features historically abused in targeted attacks — certain message attachment types, some web technologies, wired connections and unsolicited invitations. It is designed for individuals at elevated risk and trades convenience for a materially smaller exposure surface. For executives, journalists and officials, it is one of the few controls that meaningfully addresses exploitation-based threats rather than only malicious apps.

Claimed Capability vs Demonstrated Exploit

This distinction is the core of responsible iOS threat analysis. A feature list is a marketing artefact. A demonstrated exploit is a reproducible technical result with a described target version, an observed effect and, ideally, independent verification.

Mobile Forensic Investigation on iOS

• Preserve first: capture diagnostics and, where policy allows, an encrypted backup before changing the device.
• Review installed profiles, enterprise apps, MDM enrolment and trusted certificates.
• Correlate with identity telemetry — sign-ins, MFA prompts, token issuance — which is often more conclusive than the handset.
• Engage specialist mobile forensic support for high-value individuals rather than resetting immediately.
• Record what you could not determine; explicit gaps are part of a credible finding.