A more user-friendly backup check?

[sr-murthy]

I've successfully created and checked backups of my iPhone using MVT (mvt-ios), but the checks are based on manual inspection of the output files folder that mvt-ios check-backup produces. According to the docs the backup check:

Through the --iocs argument you can specify a STIX2 file defining a list of malicious indicators to check against the records extracted from the backup by mvt. Any matches will be highlighted in the terminal output as well as saved in the output folder using a "_detected" suffix to the JSON file name.

After extracting the backup (via libimobiledevice, not iTunes) and running the check, I checked the output files folder for files with _detected suffixes but could not find any. And when running the backup check command I manually specified the STIX2 files of interest.

It seems to me that there are at least a couple of ways in which this process could be improved via improvements to check-backup:

1. Automate checks for the presence (or absence) of the files showing threat detection. This is really just going one step further, and automating what the user needs to do manually. It would also serve as a direct confirmation from MVT that no threats were detected, which is reassuring.
2. Provide a command option to use all relevant STIX2 files for the device type (iOS, Android) via a single flag: e.g. --all-iocs, where the STIX2 files are stored somewhere centrally in the repo.

Also, the download-iocs subcommand is not present in my version of MVT, which I built from source. I have version 1.3.1, which I built in 2022, and have not updated since.

$ mvt-ios --help
...
Commands:
  check-backup    Extract artifacts from an iTunes backup
  check-fs        Extract artifacts from a full filesystem dump
  check-iocs      Compare stored JSON results to provided indicators
  decrypt-backup  Decrypt an encrypted iTunes backup

Do I need to remove this, and install the Python package instead?

[roaree]

Also, the download-iocs subcommand is not present in my version of MVT, which I built from source. I have version 1.3.1, which I built in 2022, and have not updated since. [..] Do I need to remove this, and install the Python package instead?

Probably not. You can update the source repo and install it in the same manner as you did before (whether that was into a venv, or as a global package etc., it should replace the package).

check-iocs is meant to be a way to check updated iocs without running all of the module extractions again - iocs will be checked as part of check-backup if you supply them.

[sr-murthy]

OK, thanks.