MVT on Qubes - Pegasus checking tool

[smlt]

we have seen recently about pegasus and there is a tools that it says can detect Pegasus, available on GitHub but it is difficult to use—especially if you aren’t very technical(im one), and to run it on qubes gets a little bit more hard, so does anyone here had successfully run this tool, if so, can describe here how did it?

[Plexus]

I have not yet but I would postulate that the easiest route to success would be to generate a dump of the phone filesystem and put that in the Qube. Then install docker in the Qube and run the tools from the docker image

If you cannot dump the phone filesystem (eg, no root access) then using USB may help, but Qubes passthrough is a little flakey when it comes to debugging phones. You may want to look into https://www.qubes-os.org/doc/how-to-use-usb-devices/, paying attention to “finding the right usb controller”

[Plexus]

As an aside, if you have a genuine concern that your phone may be targeted by remote 0days by orgs such as NSO then you may want to look into some of the benefits of TheStingers GrapheneOS.

[smlt]

i already use graphene, and this is for a close friend. but thanks for your answer.

[noob_aid]

Here is a helpful guide:

Guide: Running MVT against an iOS or Android phone, under Qubes

I had some time to experiment with the Mobile Verification Toolkit that was mentioned in an Amnesty International forensic analysis of phones that had been found to have spyware installed. Mobile Verification Toolkit (MVT) is a collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices. On iOS, the process is to perform an iTunes backup of the phone, decrypt the backup, then analyze the data …

[catacombs]

In USA. If one takes an Iphone to the Best Buy, “Geek Squard,” they will, without my paying money, refresh the firmware on the phone. Not just do a factory reset of software, but the firmware itself.

If you trust them. ???

Local ATT guy (he has been in cell phone business for over a decade) that the local police could clone a phone, to break the clone one would need to change the SIM number (maybe card or E-Sim) and the number as well as do all the rewrite firmware, reset to factory state.

Then again, in his business he has a iPhone that allows Apple the diagnostic App on his cell. So in theory, Apple could be watching him as well.

But he had not heard of Graphene phone. But he was willing to give me a new additional contract for a new Pixel, when I explained it to him.