Most likely the malware is using SSL so packet sniffing from an external device isn't gonna work. And it's apple, so at best you might find a firewall among their tightly locked down app store. Don't worry, apple knows what's good for you far better than you ever could ::eye roll::

A lot of the teams inside Apple who create first-party apps like iMessage are understaffed compared to their competitors.

They should really hire more security folks. A lot of Apple's product security work seems to be outsourced to Google Project Zero.

Yet they somehow roll out some crazy new memoji or drawing feature every year

Their priorities are just in the wrong place

Of course, the people writing the Memoji code and the people doing security work on the app are frequently different people…

And water is wet. Apples priorities are still misplaced.

The point being argued is that apple is not giving enough attention to important security issues while also preventing others from doing so themselves.

Any developer must take care security at some level.

Maybe apple doesn't have the funds to hire more people..

Poor Apple, they are so busy protecting our privacy and telling us about it they forgot to hire people.

> Is anyone aware of any (FOSS) software (presumably intrusion detectors or indicators of compromise) for mobile phones that might help flag or even prevent such attacks?

Assuming such applications existed, how would you install them on the "suspect" iPhone?

Assuming you were able to install such applications, you'd still not have any access to or control over the baseband (which I strongly suspect has plenty of issues of its own).

Assuming the malicious software avoided using Wi-Fi and used only the the cellular data connection for command and control, exfiltration, etc., it'd be damn near impossible to monitor the ("plain-text") data being sent and received (assuming such software would make use of private certificates -- or asymmetric encryption, in general -- to avoid being MITM'd itself, which seems like a reasonable assumption).

--

EDIT: This got me thinking, "what would be the most secure way to keep and use a mobile phone?" (assuming one could not simply avoid doing so).

My first thought is to use a mobile phone with the baseband radio(s) (verifiably) disabled/removed (if that is even possible?) or -- even better -- a Wi-Fi only device (similar in function as the old iPod Touch, for example) on which one used only SIP applications for calling (ideally via an "internal PBX" shared by all of one's correspondents) along with one's preferred E2E-encrypted messaging applications (e.g., Matrix, Signal, WhatsApp, etc.), all of which are used (importantly!) exclusively over an always-on VPN connection.

In instances where Wi-Fi was unavailable and/or one had no other options, a "mobile hotspot" or another ("real") mobile phone acting as one could potentially be used.

I'm interested in hearing thoughts on this idea (including any reasons why this is a bad idea that didn't occur to me during my two minute thought experiment), any other similar ideas that others have had, or any actual practices that are actually being used.

>> what would be the most secure way to keep and use a mobile phone?

My opinion: there is no secure way. My initial solution: build a home phone based on a Raspberry Pi 3B+ (with touch screen).

I already built this home phone for myself. It does only voice and SMS/MMS. It only works over Ethernet or Wi-Fi.It uses mains electricity. I wrote the software -it's Python3 and C.

I've been using this phone as my daily driver for the last year. It is very reliable.

I plan to start making it available in Jan 2021. Look for more posts here.

Are these apps similar to Blockada?

https://blokada.org/

Blokada isn't a serious security app. It leaks DNS connections over TCP (only handles UDP) and uses covert techniques to track users (generates a unique ID for every install and sends it tagged with the phone model every time one visits a blokada webpage from within the app).

Yeah, no where close.

Disclaimer: I work on privacy enhancing tech on Android.

As a user of Blokada myself I'd like to ask, is there any system-wide ad blocker for Android you would recommend?

Apart from usual suspects like AdGuard [0] and other anti-virus products:

Intra [1] with any adblocking DNS of your choice.

Nebulo: [2] A no-gimmicks alternative to DNS based blocking (their latest beta supports DNS over HTTP3 (QUIC)).

I use both: Intra has no DNS leaks but is IPv4 only right now and laced with analytics (the fork I developed/use is stripped off all analytics). Nebulo is lighter on RAM and battery and supports custom on-device blocklists (non PlayStore version).

[0] https://adguard.com/en/adguard-android/overview.html

[1] https://getintra.org/

[2] https://git.frostnerd.com/PublicAndroidApps/smokescreen#inst...