Show HN: First iOS app to use technique that finds latest variants of spyware

{
  "by": "screwNSO",
  "descendants": 1,
  "id": 40240197,
  "kids": [
    40240490
  ],
  "score": 1,
  "text": "Background\nIn 2021, my iPhone was exploited with spyware (Pegasus) by a client of the NSO Group due to my employment at the time (i.e. I worked for a target organization). From there I began helping other at risk users identify when their iPhones were compromised via manual forensic analysis of their devices. Wanted to scale this manual forensic analysis to a wider audience to make it widely available to find more victims of spyware companies like NSO Group (Pegasus) and Cytrox (Predator) so created an app to do it called Am I Secure? that is on the App Store now. It is able to detect the latest variants of spyware (including those deployed against victims in April 2024). The app also performs a number of other security checks, more than any other iOS app.<p>Key Differentiator\nAll iOS apps operate within an &quot;app sandbox&quot;, a restricted space within iOS that limits an app to accessing only its own data and specific data a user has provided permission to, such as contacts or location data. This is to ensure security and privacy. Due to these restrictions, no iOS apps, including security focussed ones, are able to directly access the operating system and other data necessary to perform an analysis of the operating system for spyware or malware. While some iOS apps market themselves as antivirus solutions, unlike real antivirus solutions that run on Windows or macOS, they are not actually able to perform any traditional antivirus functions on iOS and these apps add little, if any, security value. Usually they just provide sketchy VPN and “identity protection” services while making it appear that they protect your device but with no actual device security at all and the web sites they block, if you do use their VPN, are all malicious sites targeting Windows, irrelevant to iOS security.<p>Am I Secure? bypasses the limitations of the app sandbox by having users of the app share iOS system diagnostic data with the app so access can be obtained. Without access to this data, no app can perform a proper analysis for spyware. Via the app, this data is then uploaded to our servers where it is analyzed and the results are reported back to the user within the app and, if spyware is found, to the email address tied to their account. No private user data such as messages or photos are contained within the system diagnostic data so user privacy is preserved. No other app is using this technique or analyzing actual system data.<p>Beyond detecting previously discovered and publicly known Indicators of Compromise (IoCs), the automated AI&#x2F;ML augmented analysis on our servers goes deeper. It looks for any anomalies in the submitted data versus what is expected from a &quot;known good&quot; iOS device as well as comparing against other submissions from across the user base. Any anomalies are then manually analyzed to detect new previously unknown IoCs. Looking for publicly known IoCs only finds yesterday&#x27;s spyware, spyware vendors rapidly change their spyware after public disclosure occurs to ensure prior IoCs are ineffective. Our analysis techniques though will continue to find spyware as the anomalies they leave change but continue to stand out.",
  "time": 1714676636,
  "title": "Show HN: First iOS app to use technique that finds latest variants of spyware",
  "type": "story",
  "url": "https://apps.apple.com/us/app/am-i-secure/id6468312814"
}

{
  "author": "Numbers Station Inc",
  "date": "2025-04-04T04:00:13.000Z",
  "description": "Download Am I Secure? Forensic Scan by Numbers Station Inc on the App Store. See screenshots, ratings and reviews, user tips, and more apps like Am I Secure?",
  "image": "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource211/v4/4c/12/07/4c12075e-969c-65f3-c6e1-39d69f35d38a/Placeholder.mill/1200x630wa.jpg",
  "logo": null,
  "publisher": "Apple",
  "title": "Am I Secure? Forensic Scan App - App Store",
  "url": "https://apps.apple.com/us/app/am-i-secure-forensic-scan/id6468312814"
}

{
  "url": "https://apps.apple.com/us/app/am-i-secure-forensic-scan/id6468312814",
  "title": "Am I Secure? Forensic Scan App - App Store",
  "description": "iOS device forensic analysis  Free · In‑App Purchases         Am I Secure? performs forensic analysis of your iPhone or iPad to find signs of compromise. If you are a journalist, activist, executive, lawyer,...",
  "links": [
    "https://apps.apple.com/us/app/am-i-secure-forensic-scan/id6468312814",
    "https://apps.apple.com/us/app/am-i-secure/id6468312814"
  ],
  "image": "https://is1-ssl.mzstatic.com/image/thumb/PurpleSource211/v4/4c/12/07/4c12075e-969c-65f3-c6e1-39d69f35d38a/Placeholder.mill/1200x630wa.jpg",
  "content": "<div>     <div>    <section>  <p>iOS device forensic analysis</p>  <p>Free · In‑App Purchases</p> </section>       <section> <p><span><span>Am I Secure? performs forensic analysis of your iPhone or iPad to find signs of compromise. If you are a journalist, activist, executive, lawyer, government official or anyone with reason to think you may be of interest to a sophisticated adversary, this app is built for you. The same applies if you hold digital assets in self-custody. The device holding your keys is the target, and that device is what Am I Secure? examines.\nWHAT A COMPROMISED DEVICE MEANS\nYour whole life is on your phone. Private messages, email, photos, contacts, financial information. If you can read it, so can someone who has compromised the device. Encryption protects your messages in transit; it does not protect anything once the device itself is under someone else's control. An attacker in that position can read your messages before they are encrypted and after they are decrypted, see your location, take your stored credentials, and reach any account you are signed in to. They can listen through the microphone to conversations in the room, record through the camera, and follow your movements. There is generally no way to tell from using the device.\nWHY THIS REQUIRES A DIFFERENT APPROACH\niOS is among the most secure consumer platforms available. iOS does not let any app, including security apps, look outside its own container or \"sandbox\". No security app on your device can inspect the processes, the filesystem, or the behavior of the rest of the system. That is a deliberate security property of the platform, and it is why an app running on your phone can only report on your settings, not on what is actually running.\nAm I Secure? works differently. You generate a system diagnostic \"sysdiagnose\" file using the tool built into iOS. That file is produced by the operating system itself, not by us, and it contains a detailed record of processes, logs, and system state. You share that file with the app, which uploads it to our servers. We analyze it and report what we find.\nThe diagnostic file is end-to-end encrypted on your device before it is uploaded and stays encrypted until it reaches hardware we own and operate in our own facilities in Canada and the European Union (EU). It is not decrypted or accessible by any third party, including intermediary data center and network operators. Once analysis is complete the file is deleted.\nA HUMAN REVIEWS ANYTHING UNUSUAL\nWhere our automated analysis flags something, our team examines the results by hand before anything is reported to you. The same automated analysis pipeline is used by our government clients via our on-premises Private Protection suite.\nWE LOOK FOR ANOMALIES, NOT JUST KNOWN INDICATORS\nMost detection tools match against published indicators of compromise. The moment those indicators become public, the operators behind commercial surveillance tools change their software to avoid them, and signature matching stops working against the new version. We compare your device against a baseline of expected iOS behavior instead. That can surface anomalies that do not match public indicators.\nMEDIA COVERAGE\nReviewed by Forbes cybersecurity contributor Davey Winder in December 2024, who wrote he was \"very impressed with the capabilities of this app.\"\nWHAT ELSE THE APP CHECKS, FOR EVERYONE\n• Whether your iOS version is current, overall and for your specific device\n• Lockdown Mode status \n• Lock screen, passcode, and biometric configuration\n• iCloud Private Relay and VPN status\n• Whether connections to well-known sites are being intercepted or inspected\n• Third-party keyboards installed on the device\n• Device integrity \n• Your processor's security features, network details, and diagnostic information\nSUBSCRIPTION\nThe Advanced Security Scan requires a subscription, available as an in-app purchase (monthly or annual).\nFor the Government &amp; Enterprise Edition, search for Am I Secure? Endpoint Security here on the App Store.\nTerms of Use: https://www.apple.com/legal/internet-services/itunes/dev/stdeula/\n</span></span> </p>  </section> <section>      <ul><li> </li> </ul> </section>  <div><p><span>  <span>- support for iOS 27\n- support for iPhone 18 Pro &amp; Pro Max series\n- new device details section showing processor security features\n- no limit on the number of scans with a subscription, i.e. prior once a day limit removed\n- improved sysdiagnose sharing process for first time users, sign in directly from the upload screen rather than going to app settings\n- minor tweaks and fixes </span></span> </p>  <p><span>Version 1.9.3</span> Sep 16</p></div>  <section>   <ul><li><div><h3>Data Linked to You</h3> <p>The following data may be collected and linked to your identity:</p> <ul><li> Diagnostics </li></ul>  </div> </li> </ul> </section>   <section>  <div>  <p></p><h2>Information</h2> <p></p></div>  <dl><div>Seller <dd><ul><li>Numbers Station Inc </li> </ul></dd> </div><div>Compatibility <dd><details><summary>Requires iOS 16.6 or later.  <svg></svg></summary> <ul><li><strong>iPhone</strong><br />Requires iOS 16.6 or later. </li><li> </li><li><strong>iPad</strong><br />Requires iPadOS 16.6 or later. </li> </ul> </details></dd> </div><div>Languages <dd><details><summary>English and 8 more  <svg></svg></summary> <ul><li>English, French, German, Italian, Japanese, Korean, Portuguese, Simplified Chinese, Spanish </li> </ul> </details></dd> </div><div>In-App Purchases <dd><details><summary>Yes  <svg></svg></summary> <ul><li><p><span>Advanced Threat Detection</span> <span>$9.99</span> </p> </li><li><p><span>Advanced Threat Detection</span> <span>$49.99</span> </p> </li><li><p><span>Advanced Threat Detection</span> <span>$24.99</span> </p> </li><li><p><span>Advanced Threat Detection</span> <span>$34.99</span> </p> </li><li> </li> </ul> </details></dd> </div><div>Copyright <dd><ul><li>© 2026 Numbers Station Inc. </li> </ul></dd> </div> </dl> </section>    </div>    </div>",
  "author": "",
  "favicon": "https://apps.apple.com/assets/favicon/favicon-16.png",
  "source": "apps.apple.com",
  "published": "",
  "ttr": 159,
  "type": ""
}