Unit 3: Local networks · Lesson 7 of 7 · 22 min
Case file: odd traffic from phones
Spot two phones calling domains no other device uses, right after push notifications, and decide what a network team can and cannot do about it.
case file
Operation Triangulation iOS zero-click campaign
Kaspersky (target) and others · 2023
Kaspersky noticed suspicious traffic from employee iPhones on its corporate Wi-Fi and, using offline backups and the Mobile Verification Toolkit, found a zero-click iMessage attack chain with traces back to 2019. The chain used four zero-days (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, CVE-2023-41990), including a bypass of hardware memory protections, and Apple patched them in 2023. The implant ran in memory and did not survive a reboot.
What went wrong
Chained zero-day vulnerabilities reachable through an iMessage attachment with no user interaction.
What would have stopped it
- Apply iOS updates quickly and enforce minimum versions through MDM.
- Enable Lockdown Mode for high-risk staff; Kaspersky commented it likely helps against this chain.
- Reboot devices regularly, since the implant was not persistent.
What defenders could have seen
- Network monitoring of mobile Wi-Fi traffic for connections to unknown C2 domains after iMessage traffic.
- MVT analysis of backups: data usage by a 'BackupAgent' process and modified empty folders in Library/SMS/Attachments.
- Repeated failed iOS updates.
mission
- You are
- The analyst who watches the staff Wi-Fi resolver.
- Situation
- Kaspersky caught Operation Triangulation because its own network monitoring saw phones on the corporate Wi-Fi talking to unknown servers. This lab is modelled on that case. The resolver log is
~/wifi/staff-dns.logand normal domains are listed inbaseline-domains.txt. - Goal
- Find any device calling domains outside the baseline and describe the pattern.
- Hand in
- The devices, the domains and the recommended response.
The pattern on the wire
- iPhone to Wi-Fi resolver: push.apple.example (normal)
- iPhone to Wi-Fi resolver: photo-cdn-sync.example.net (not in baseline)
- iPhone to Unknown server: connects a few seconds after each push
Size the log
Know how much you are reading before you filter.
wc -l staff-dns.log
170 staff-dns.log
Remove everything normal
grep -v -F -f drops every line that contains a baseline domain. What remains is new.
grep -v -F -f baseline-domains.txt staff-dns.log | head -n 3 Oct 14 13:20:06 wifi-dns dnsmasq[402]: query[A] photo-cdn-sync.example.net from 10.30.0.21 Oct 14 13:20:11 wifi-dns dnsmasq[402]: query[A] metrics-gateway.example.org from 10.30.0.21 Oct 14 13:25:20 wifi-dns dnsmasq[402]: query[A] photo-cdn-sync.example.net from 10.30.0.22 grep -v -F -f baseline-domains.txt staff-dns.log | awk '{print $7}' | sort | uniq -c 6 metrics-gateway.example.org 12 photo-cdn-sync.example.net
you should see Two domains nobody else uses.
Find who asked
Count the clients behind those lines, then turn addresses into names with the DHCP leases.
grep -v -F -f baseline-domains.txt staff-dns.log | awk '{print $9}' | sort | uniq -c 9 10.30.0.21 9 10.30.0.22 grep -E '^10.30.0.2(1|2) ' leases.txt 10.30.0.21 iphone-kvoss 10.30.0.22 iphone-dramos
you should see Two iPhones, nine queries each.
Look at the timing
Put the unknown queries back in context.
grep 'from 10.30.0.21$' staff-dns.log | grep -A1 push.apple | head -n 4
Oct 14 13:20:02 wifi-dns dnsmasq[402]: query[A] push.apple.example from 10.30.0.21
Oct 14 13:20:06 wifi-dns dnsmasq[402]: query[A] photo-cdn-sync.example.net from 10.30.0.21
--
Oct 14 13:30:35 wifi-dns dnsmasq[402]: query[A] push.apple.example from 10.30.0.21
you should see Every unknown lookup comes four seconds after a push notification lookup.
defender tip Do not wipe or reset the phones first. Preserve them, and let mobile forensics specialists collect evidence with tools like MVT.
What the network team can do
block the two domains close the ticket
The implant changes domains; the phones stay compromised.
preserve both phones for specialists update iOS on every device (MDM) Lockdown Mode for high-risk staff keep DNS logs, alert on new domains
Contain, patch the fleet and keep watching.
What a defender takes away
- 1A baseline of normal domains makes new ones stand out.
- 2Timing patterns matter as much as names.
- 3Network evidence starts the investigation; phones need specialist forensics.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.