TCC.DB is a file that you should examine on every single iOS
device you work.
This file is captured even with an iTunes backup.
It stands for transparency, consent, and control.
And what it is tracking is every single permission
and if the app has access to it.
So let's take a look at this.
Here, we can see we have a service.
And this is telling you if it's camera, face ID, photos.
Ubiquity and Liverpool.
I'm going to talk about those in a second,
because that's a weird name compared to everything else.
And then we see the client.
That's the app.
And then we see this auth_value.
So when we look at client, if we start looking at this
and we see Ubiquity, and we're like, zoom--
what does Ubiquity mean?
It looks like Telegram, Apple Shortcuts, Apple Slideshow,
something called tinyspeck.chatlyio.
Ubiquity is iCloud.
So if it has permission to sync to iCloud,
that word is Ubiquity.
If you see the word Liverpool under service--
right here, we see Liverpool for Telegram.
If you scroll up and you see Liverpool for something else,
Liverpool is location.
Make sure you know that.
Because it's encoded-- or it's worded in a way
that may not make sense.
If you're working malware investigations,
three things you care about--
microphone, camera, Liverpool.
Those are the three primary services
that are concerning that are more dangerous permissions,
because everything's listening.