Your glimpse of malware.
Malware is coming in the second portion of Section 4.
The first thing to consider is, is the device jailbroken?
You do not need to have a jailbroken
iPhone to get malware, but it does make it more susceptible.
There is a big piece of malware called XcodeGhost that happened
in 2015 that still exists.
It lingers out there in the wild.
We're going to talk about that in Section 4.
But consider XcodeGhost versions of apps that were malicious.
Google them compared to the apps that
are installed on the device.
Always go to TCC.DB.
Look for Liverpool, microphone, and camera.
And then think outside of the box.
Malware is an application.
What's killing the battery?
What does knowledgeC see?
What does any app usage or data usage SQLite--
all of those things will assist you
in these malware investigations.