levilutz/cve-2021-30860Scan for evidence of CVE-2021-30860 (FORCEDENTRY) exploit
CVE-2021-30860 (FORCEDENTRY) is a known vulnerability in MacOS, iOS, and WatchOS. It allows arbitrary code execution by sending a victim device a "maliciously crafted PDF".
This vulnerability was patched by Apple on September 13, 2021 with the following versions:
However, it has been exploited in the wild since February 2021 or earlier.
To detect evidence of past exploit on MacOS computers or iPhones (by scanning a local backup to a Mac). This is not meant to defend against future attack or undo effects of prior attack. This is not meant to detect past exploit on Apple Watches or iPads.
Two distinct methods are used here to detect evidence of prior exploit.
The well-known attack vector using this vulnerability is sending malicious PDF or PSD files (falsely labelled as GIFs) via SMS. The scripts here scan a Mac's or iPhone backup's received message attachments for ".gif" files whose file signature does not match a GIF's. It's worth noting that receiving the files doesn't necessarily mean a device was compromised, espeically if the file(s) were received after the security update was installed to the device.
The attacks NSO Group carried out using this vulnerability had at least one bug in their cleanup phase. Evidence is left on an iPhone as an inconsistency in a particular sql database. Citizenlab demonstrated a simple SQL query on this database that can detect the relevant inconsistency.
python3 cve_scan.py to scan using default options, or python3 cve_scan.py -h for help.python3 cve_scan.py --mode macpython3 cve_scan.py --mode iphonepython3 cve_scan.py --mode iphone --method attachmentspython3 cve_scan.py --mode iphone --method datausagedbpython3 cve_scan.py --mode iphone --backups newest