initial commit

Author: KLBot

CHANGELOG.txt

@@ -0,0 +1 @@
+2023-05-15 v1 Initial release

CLA.md

@@ -0,0 +1,23 @@
+# CONTRIBUTOR LICENSE AGREEMENT
+You accept and agree to the following terms and conditions for Your past, present and future Contributions submitted to the AO Kaspersky Lab (“Company”). 
+1. Definitions.
+      "You" (or "Your") shall mean the legal owner of the Contribution that is making this CLA with the Company. For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+      "Contribution" shall mean any original work of authorship, including any derivative works, modifications or additions to an existing work, that is intentionally submitted by You to the Company for inclusion in, or documentation of, any of the products owned or distributed by the Company (the "Work"). You acknowledge that the Company desires to have all contributions made by You under the terms of this CLA and, thus, this CLA will apply to all of your Contributions submitted both before and after the date of signature. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Company or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Company for the purpose of discussing and improving the Work.
+2. Grant of Copyright and Patent Licenses.
+      Subject to the terms and conditions of this Agreement, You hereby grant to the Company and to recipients of software distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license, including a license, to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, distribute, or sell Your Contributions and the Work.
+      Subject to the terms and conditions of this Agreement, You hereby grant to the Company and to recipients of the Work distributed by the Company a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable patent license to make, have made, use, offer to sell, sell, import, distribute, and otherwise transfer Your Contributions and the Work.
+3. Ownership and third party rights.
+      You represent that you are the sole legal owner and are legally entitled to grant the above license for the Contributions. If:
+      o	(A.) your employer(s) has intellectual property or other rights to your Contributions, you represent that you have both (i.) received express, prior, written permission to make Contributions on behalf of that employer; and (ii.) that your employer has waived any of its rights for or claims in your Contributions to the Company, or
+      o	(B.) if another individual or third party has rights to intellectual property to your Contributions – whether as a result of being a co-inventor, assignee, or other right, you represent that you have both (i.) received express, prior, written permission to make Contributions on behalf of that individual or third party; and (ii.) that such individual or third party has waived any of its rights for or claims in your Contributions to the Company.
+      You will submit such written permission to the Company at the time of the submission of your Contribution.
+4. Your original creation.
+      You represent that each of Your Contributions is Your original creation (see section 5 for submissions on behalf of others). You represent that Your Contribution submissions include complete details (including required attributions and details of applicable license restrictions) of any third-party license or public domain licenses, or other restriction (including, but not limited to, related patents and trademarks) of which you are personally aware or should be aware and which are associated with any part of Your Contributions.
+5. Third party owned creation(s).
+      Should You wish to submit work that is not Your original creation, You may submit it to the Company separately from any Contribution, clearly identifying the complete details of its ownership and source, and any applicable license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which you are personally aware, and conspicuously marking the work, for example: "Submitted on behalf of a third-party: [named here].” “Owned by third-party: [named here.]” or “Copyright held by third-party: [named here].”
+6. Notification.
+      You agree to notify the Company of any facts or circumstances of which you become aware that would make these representations inaccurate in any respect, including if you become aware of any third party intellectual property rights that are infringed by your Contributions.
+7. Assignment.
+      Neither party may assign this Agreement without the other party’s consent which will not be unreasonably withheld; however, each party may assign this Agreement without the other party’s consent to an entity or individual that acquires all or substantially all of the business or assets of the assigning party or for an individual acquires all of the intellectual property rights in the Contribution owned by such individual, whether by merger, sale of assets, or otherwise, provided that such entity or individual assumes and agrees in writing to be bound by all of the obligations of the assigning party under this Agreement.
+8. Entire agreement.
+      This Agreement is the entire agreement, both written or oral, with respect to the Contributions between the parties. No amendment, modification or waiver of any provision of this Agreement will be effective unless in writing and signed by both parties. If any provision of this Agreement is held to be invalid or unenforceable, the remaining portions will remain in full force and effect and such provision will be enforced to the maximum extent possible so as to affect the intent of the parties and will be reformed to the extent necessary to make such provision valid and enforceable. All notices and other communications herein permitted or required under this Agreement will be sent by postage prepaid, via registered or certified mail or overnight courier, return receipt requested, or delivered personally to the parties at their respective addresses, or to such other address as either party will give to the other party in the manner provided herein for giving notice. Notice will be considered given upon receipt.

License.txt

@@ -0,0 +1,11 @@
+==
+
+© 2023 AO Kaspersky Lab. All Rights Reserved.
+
+==
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,72 @@
+## Triangle Check: scan iTunes backups for traces of compromise by Operation Triangulation
+
+This script allows to scan iTunes backups for indicator of compromise by Operation Triangulation.
+
+For more information, please read [Securelist](https://securelist.ru/trng-2023/)
+
+Contact: [[email protected]](mailto:[email protected])
+
+## Prerequisites
+
+The script depends on: colorama (for pretty printing), pycryptodome
+
+## Installation
+
+The script can be run as-is (the subdirectory *triangle_check* is required):
+
+```
+python3 triangle_check.py 
+```
+
+It can also be built into a pip package:
+
+```
+python3 -m build
+pip3 install dist/triangle_check-1.0-py3-none-any.whl
+
+```
+
+
+## Usage
+
+```
+Usage: triangle_check.py /path/to/iTunes_backup [backup_password]
+```
+
+### iTunes backup location
+
+Locate the backup directory created by iTunes. The exact location depends on the OS and is described [here](https://support.apple.com/en-us/HT204215).
+The directory you are looking for should contain may subdirectories, and should include 'Manifest.db', 'Manifest.plist'. The backup may be encrypted
+with a password, if set up in iTunes. That password is required to decrypt password-protected backups.
+
+### Advanced: create backup with libimobiledevice
+
+You can use the tool *idevicebackup2* that is a part of the open-source package named [libimobiledevice](https://libimobiledevice.org/). Popular Linux 
+distributions, macports and homebrew allow to install it out of the box, and the package can be built from the source code for Linux or OSX. 
+
+### Scanning the backup
+
+Run the tool against the backup directory. If there are any traces of suspicious activity, the script will print out *SUSPICION* or *DETECTED* lines with
+more information and detected IOCs, and that would mean that the device was *most likely* compromised.
+
+Example output:
+
+```
+==== IDENTIFIED TRACES OF COMPROMISE (Operation Triangulation) ====
+2022-*-* SUSPICION Suspicious combination of events: 
+ * file modification: Library/SMS/Attachments/ab/11
+ * file attribute change: Library/SMS/Attachments/ab/11
+ * location service stopped: com.apple.locationd.bundle-/System/Library/LocationBundles/WRMLinkSelection.bundle
+ * file modification: Library/Preferences/com.apple.ImageIO.plist
+ * file attribute change: Library/Preferences/com.apple.ImageIO.plist
+ * file birth: Library/Preferences/com.apple.ImageIO.plist
+ * file modification: Library/Preferences/com.apple.locationd.StatusBarIconManager.plist
+ * file attribute change: Library/Preferences/com.apple.locationd.StatusBarIconManager.plist
+ * file birth: Library/Preferences/com.apple.locationd.StatusBarIconManager.plist
+2022-*-* DETECTED Exact match by NetUsage : BackupAgent
+2022-*-* DETECTED Exact match by NetTimestamp : BackupAgent
+```
+
+## What's next?
+
+The research on the Operation Triangulation is ongoing. For more updates, please check [Securelist](https://securelist.ru/trng-2023/)