Haala Qulfii, AirDrop, fi Bluetooth Basaasa Xiyyeeffate Irratti Cufuu¶

Pirootokoolota wayaa malee fageenya gabaabaa (Apple AirDrop, . NameDrop, . Android Quick Share, . Bluetooth Low Energy / BLE, fi Apple Continuity / AWDL) fi parsaroota ergaa miidiyaa badhaadhaa (iMessage, . WhatsApp, fi WebKit) carraaqqii malee mijannaa zeeroo-qindeessaaf kan qophaa'anidha. Haa ta’u malee, mijachuun sun haalawwan balaa tasaa adda ta’an lama uuma. Tokkoffaa, bakkeewwan uummataa kanneen akka konkolaataa meetroo lafa jalaa, xiyyaara, galma barnootaa, mormii, ykn istaadiyeemii keessatti, namoonni hin beekne suuraawwan giraafikii hin barbaadamne karaa AirDrop / Quick Share ("cyber-flashing") gara iskiriinii keessanitti dhoosuu, akka tasaa jijjiirraa qunnamtii karaa iOS NameDrop kakaasuu, ykn a $170 Flipper Zero / ESP32 Biltuutii Humna Xiqqaa (BLE) Lolaan Beeksisa. Lammaffaa, gaazexeessitoota qorannoo, abukaatota mirga namoomaa, hoji gaggeessitoota, dippilomaatota, mormitoota siyaasaa, ykn namoota qabeenya qulqulluu guddaa qabaniif, meeshaalee basaasaa kiraa sassaabdota daldalaa (Pegasus, . Predator, . Reign, . Graphite) Zero-Click vulnerabilities iMessage, FaceTime, WebKit, ykn cellular basebands keessaa fayyadamuun osoo miidhamaan gonkumaa link tokko hin tuqin callisee smartphone tokko balaadhaaf saaxilu.

Yoo balaa qaamaa hatattamaa keessa jirta ta’e ykn geejjibaa ummataa irratti ykn kutaa xiyyaaraa keessatti miidhaa qaamaan seeraan alaa yoo si mudate, gara naannoo nageenya qabu naannoo hojjettoota geejjibaa ykn hojjettoota balalii jirutti ce’uun lakkoofsa hatattamaa naannoo keessanii ( ) bilbili.911 Ameerikaa fi Kaanaadaa keessatti, . 112 guutuu Gamtaa Awurooppaa keessatti, . 999 Yunaayitid Kingidam keessatti) ykn galmee keenya kan idil-addunyaa ilaalaa lakkoofsa balaa tasaa. Sekondii 5 keessatti kufaatii wayaa malee hin barbaadamne cufuuf, lolaa BLE popup dhaabuuf, fi Apple Lockdown Mode ykn Android Advanced Protection zeero-click exploits irraa activate gochuuf tarkaanfiiwwan armaan gadii hordofaa.

Amma kana godhi¶

1. Yeroo ammaa suuraa AirDrop hin barbaadamne, faayiloota Android Quick Share, ykn baabura, xiyyaara, ykn tuuta irratti kan hin dhaabbanne Bluetooth pairing popups yoo argattan, Control Center / Quick Settings keessan gadi swipe gochuun lamaan isaanii OFF godhaa AirDrop / Quick Share FI Bluetooth keessaa isa guddaa Settings app (mallattoo Giddugala To'annoo qofa miti). Sagalee Biltuutii Giddugala To'annoo iOS Apple keessa jiru tuquun hanga boru ganamaatti meeshaalee amma jiran qofa addaan kuta osoo Biltuutii Annisaa Gadi Aanaa (BLE) too’ataa fi Apple Wireless Direct Link (AWDL) raadiyoo duubaan socho’aa jiru. Chippii raadiyoo Biltuutii lolaa Flipper Zero BLE irraan kan ka'e humna qaamaan gadi buusuuf, ** banuun dirqama.Settings -> Bluetooth -> Toggle OFF**.
2. Gonkumaa hin tuqin Accept ykn Open dabarsuu faayilii AirDrop, Quick Share, ykn Bluetooth hin barbaadamne irratti, akkasumas Fudhadhu osoo hin tuqin dura suuraan xiqqaan durtii AirDrop Apple akka agarsiifamu beeku. AirDrop gara ** 10tti saagi.Receiving Off** (ykn Contacts Only) irratti Settings -> General -> AirDrop, fi Android Quick Share ( ) saagi.Settings -> Connected devices -> Connection preferences -> Quick Share -> Who can share with you) hanga ** .Contacts only** ykn ** .Off** kanaaf thumbnail parser bilbila keessanii gonkumaa faayiloota hin amanamne nama hin beekne irraa hin adeemsisu.
3. Dhowwii Bringing Devices Together (NameDrop) keessatti Settings -> General -> AirDrop yoo iPhone keessan bakka namoonni itti baay'atanitti qabattan ykn minjaala konfiraansii irra kaa'atan. iOS 17+, 2019 keessatti kan dhiyaate. Bringing Devices Together yeroo hunda iPhonen lama keessaa qabaman contact-card ykn SharePlay prompt kakaasa 2 centimeters (0.8 inches) kan walii isaanii. Dhaamsuu Bringing Devices Together proximity-bump triggers guutummaatti dhaaba osoo ammas yeroo barbaaddu AirDrop manual hayyamu.
4. Aanga'aa yoo dhufte Apple Threat Notification ykn Google Threat Analysis Group (TAG) bilbilli keessan State-Sponsored / Mercenary Spyware (ykn yoo gaazexeessaa, ogeessa seeraa, mormituu, ykn hoji gaggeessaa balaa guddaa qabu taate), ON godhaa Lockdown Mode battalumatti. iPhone, iPad, fi Mac irratti gara Settings -> Privacy & Security -> Lockdown Mode -> Turn On Lockdown Mode -> Turn On & Restart. Haalli Qulfii ittisa garmalee, haardwaariin kan deeggaramee fi parsers attachment iMessage zeeroo-click kan dhorku, qindeessaa JIT JavaScript kan dhorku, bilbila FaceTime hin beekamne kan gadi dhiisu, gadi bu'iinsa 2G/3G cellular baseband kan ugguru, fi yeroo bilbilli cufamee jiruu walqabsiisa deetaa USB wired kan dhorkudha.
5. Yoo infekshinii basaasaa yaadannoo zeeroo-cuqaasaa socho'aa ta'e shakkite (Pegasus / . Predator), bilbila keessan ammuma reboot gochuun iOS tokko qabachuu sysdiagnose / duwwaa icciitii ta'e for MVT (Mobile Verification Toolkit) forensic analysis BEFORE factory-resetting. Sababni isaas, spyware kiraa sassaabdotaa ammayyaa mana yaalaa nageenyaatiin akka hin qabamnee fi reverse-engineered hin taaneef waan qophaa'eef, garaagarummaa hedduun cimsee kan jiraatu jijjiirama RAM (Random Access Memory) kutaa sirna hojii mallatteeffame dubbisa qofaaf ta'e fooyyessuu caalaa. Bilbila guutummaatti cufuu fi deebisee ibsuun RAM jijjiiramaa (volatile RAM) ni dhiqa, haleellaan sun akka irra deebi'ee si faaluuf exploit haaraa akka gubu dirqisiisa (innis erga Lockdown Mode banamee booda guutummaatti uggurama).
6. Yaaddoon keessan miidhaa mana keessaa, hiriyaa gaa’elaa duraanii, ykn hiriyaa gaa’elaa hinaaffaa qabdu dhaabbata basaasa mootummaa doolaara miliyoonaan lakkaa’amu osoo hin taane barreeffamoota keessan dubbisuu yoo ta’e, dursa pirootokoolii stalkerware biyya keessaa keenya hordofaa. Basaasa namoota gidduutti raawwatamu keessaa dhibbeentaan 99 ol ta’an ragaa iCloud/Google qooddame, Meeshaalee WhatsApp Linked Devices, ykn Android sideloaded fayyadamu .APK stalkerware caalaa zeeroo-click exploits (qajeelfama keenya guutuu ilaali Bilbiloota irratti stalkerware, spyware, fi dhokataa ta'e adda baasuu).

flowchart TD
    A["Wireless Intrusion ykn Rakkoo Basaasaa Smartphone / Laptop irratti"] --> B{"Yeroo ammaa maaltu ta'aa jira?"}
    B -->|"Suuraa ykn faayilii kan hin barbaadamne AirDrop / Quick Share namoota baay'ee keessatti mul'atu"| C["Hatattamaan 'Decline' tuquun -> Settings banaa -> AirDrop / Quick Share gara 'Receiving Off'tti saagi."]
    B -->|"Dhaabbata hin qabne Apple TV / AirPods popup spam iskiriinii qabbaneessuu (Flipper Zero BLE Flood) ."| D["Appii Sajoo ijoo banaa -> Bluetooth -> Toggle OFF (Toggle Center toggle qofti BLE HIN dhaabu)"]
    B -->|"Akeekkachiisa Basaasaa Apple/Google Mercenary Spyware YKN Target Balaa Ol’aanaa (Gaazexeessaa, Abbaa Seeraa, Hojii Raawwachiiftuu) Fudhate"| E["1. Bilbila battalumatti deebifnee jalqabuun RAM-resident spyware payload flush gochuu"]
    E --> F["2. Haala Qulfii iOS/macOS (Sajoo -> Iccitii fi Nageenya -> Haala Qulfii) ykn Eegumsa Ol'aanaa Android 15/16 dandeessisi"]
    F --> G["3. Yoo haleellaa sochiirra jiru ta'e iMessage & FaceTime dhorkuu, akkasumas Amnesty MVT forensic check encrypted backup irratti hojjedhu"]
    B -->|"Shakkamaan mana keessaa / hiriyaa gaa'elaa barreeffamoota ykn GPS irratti snooping"| H["Meeshaalee WhatsApp Walitti Hidhaman fi Dhaqqabummaa Andirooyidii IOS Safety Check / Audit gochuu (Qajeelfama Stalkerware Ilaali)"]

Maatiriksiin adda baasuu: Doorsisaa Wayilaalasii Uummataa, Ispaam BLE DoS, fi Basaasa Zeeroo-Click adda baasuu¶

Yeroo bilbila keessan irratti popup ajaa'ibaa mul'atu ykn bakka uummanni itti baay'atutti waa'ee wireless hacking yaadda'u, balaa sirrii fi dandeettii isaa isa dhugaa adda baasuuf maatiriksii teeknikaa kana fayyadamaa:

Marsaa 1ffaa: Haleellaa AirDrop, NameDrop, Quick Share, fi Flipper Zero BLE ummata duratti dhaabuu¶

Baaburaan yoo deemtan, konfiraansii irratti hirmaattan, xiyyaara daldalaatiin balali'aa jirtan, ykn mormii keessa deemtan, namni hin beekne kamiyyuu fageenya raadiyoo keessa jiru kamiyyuu popup ykn faayila tokko gara iskiriinii keessanitti akka hin dhiibineef swiichota wayaa malee afran kana qindeessaa.

1. Apple iPhone, iPad, fi Mac (AirDrop, . NameDrop, & . Continuity Jabeessuu) .¶

1. Lock Down jedhu AirDrop fi NameDrop (Settings -> General -> AirDrop):
2. ** filadhu.Receiving Off** (ykn Contacts Only; hubadhu, durtii haaraan Apple illee "Everyone" gara "Everyone for 10 Minutes" tti jijjiira, sana booda ofumaan deebi'a, garuu gara Receiving Off bakka namoonni baay'atanitti dhaabbii nageenya qabudha).
3. Kallattiin sana jalatti iskiriinii walfakkaataa irratti OFF ** jijjiiri.Bringing Devices Together** (kun hojii dhabsiisa NameDrop fi dhiyeenya SharePlay kan kakaasu yeroo namni tokko iPhone isaa kan kee irratti rukutu).
4. Gara jala iskiriinii AirDrop tti gadi bu'uun OFF ** jijjiiri.Use Cellular Data** kanaaf dabarsaan wayaa malee addaan cite erga deemtee booda gonkumaa interneetii irratti itti fufuu hin danda'u.
5. IOS irratti "Control Center Bluetooth Trap" jedhu hubachuu:
6. Yeroo iPhone ykn iPad irratti Control Center gadi swipe gootanii mallattoo Bluetooth ykn Wi-Fi jedhu tuquun adii/halluu diimaa ta'a ("Disconnecting Bluetooth Devices Until Tomorrow" jechuun), raadiyoowwan Bluetooth fi Wi-Fi iPhone keessanii AMMAS ON ON JIRU. Applen akka hojjetaniif haala sana keessatti humna isaanii ibsa AirDrop, . AirPlay, . Apple Pencil, . Apple Watch, . Find My network, fi Continuity Handoff.
7. Raadiyoon ammallee paaketoota Apple Continuity BLE dhaggeeffachaa waan jiruuf, Flipper Zero BLE Spam attack erga Control Center keessatti Bluetooth cuftanii boodas ammallee screen keessan lola'a.
8. Akkaataa Dhuguma Raadiyoo Cufnu: Appii Settings banaa -> Bluetooth tuquun -> Master switch gara OFF (Gray) (ykn iOS Shortcut 1-tuqaa uumuu kan... Set Bluetooth -> Turn Bluetooth Off tarkaanfii, kan dhuguma humna chippii raadiyoo haardwaaraa gadi buusu).
9. Waan Hin Gaafamne Hojii Irraa Hojjechiisuu AirPlay / Handoff & . Auto-Join Hotspot Gaaffilee (Settings -> General -> AirPlay & Continuity):
10. Ofumaan AirPlay gara ** tti saagi.Never** (ykn Ask), OFF ** jijjiiri.Handoff** yeroo naannoo balaa guddaa qabu keessa deemtan, fi Settings -> Wi-Fi -> Ask to Join Networks / Auto-Join Hotspot jalatti, lamaan isaanii gara ** 1 tti saagi.Off** ykn ** .Ask** kanaaf raadiyoowwan dhiyeenyaa rogue harka walqabachuu duubaa kakaasuu hin danda'an.

2. Bilbiloota Ismaartii Andirooyidii (Quick Share / Nearby Share & . Google Fast Pair Jabeessuu) .¶

Google Nearby Share fi Samsung Quick Share walitti makuun sirna Quick Share tokkummaa tokkotti meeshaalee Android hunda irratti: 1. Sajoo -> Meeshaalee walqabatan -> Filannoo walqabsiisaa -> Qoodinsa Saffisaa (ykn Samsung Galaxy irratti: Sajoo -> Meeshaalee walqabatan -> Qoodinsa Saffisaa) banaa. 2. Eenyutu siif qooduu danda'a tuquun Nama hundaa irraa gara ** tti jijjiiri.Contacts only** (fi toggle OFF Namoota hunda daqiiqaa 10f hayyamaa) ykn Quick Share guutummaatti OFF godhaa. 3. Flipper Zero dhaabuu Google Fast Pair Earbud Spam on Android: Namni kaffee ykn galma barnootaa keessa jiru tokko paakeetiiwwan Biltuutii Google Fast Pair kan sobaa ta'an tamsaasaa yoo ta'e (fakkiin headphone sobaa Pixel Buds / JBL screen Android keessan irratti akka mul'atu taasisa), Settings -> Google -> Tajaajila hunda -> Devices & sharing -> Devices banaatii OFF ** .Scan for nearby devices. 4. Duubbee Biltuutii fi Wi-Fi Scanning hojii irraa oolchuu (Settings -> Location -> Location services): Yeroo Bluetooth Android irratti toggled off ta'ellee, background location scanning ammallee raadiyoo BLE pulse gochuu danda'a yoo Settings -> Location -> Location services bantanii OFF ** jijjiirtan malee.Bluetooth scanning fi ** .Wi-Fi scanning**.

3. Laaptooppii Windows 10 & Windows 11 (Nearby Sharing & . Swift Pair Jabeessuu) .¶

1. Settings -> System -> Nearby sharing banuun ** filadhu.Off**.
2. Settings -> Bluetooth & devices -> Devices banaatii ** jedhu irraa hiikaa.Show notifications to connect using Swift Pair** (kan spoofed Bluetooth peripheral popups manneen bunaa fi buufata xiyyaaraa keessatti dhaabu).

Marsaa 2ffaa: Apple waliin hojjechuu fi jiraachuu Lockdown Mode (Gaachana Zeeroo-Click)¶

iOS 16, iPadOS 16, macOS Ventura keessatti kan jalqabame, fi iOS 17/18+ fi watchOS 10+ keessatti kan babal’ate, Apple Lockdown Mode seenaa nageenya saayibarii fayyadamtootaa keessatti bu’aa ba’ii injinariingii ittisaa bu’aa guddaa qabu keessaa isa tokkodha. Mirkaneessi fooransikii walabaa The Citizen Lab (University of Toronto) fi Amnesty International's Security Lab Lockdown Mode dandeessisuun irra deddeebiin active, live akka uggure galmoota addunyaa dhugaa irratti mirkaneessaniiru $1,000,000+ zeeroo-cuqaasaa Pegasus (BLASTPASS / . PWNYOURHOME) yaaliiwwan bosona keessatti raawwataman fayyadamuu, fi illee beeksisa akeekkachiisa kallattiin iskiriinii fayyadamaa irratti akkas jedhee mul'isa: "Lockdown Mode prevented an unknown contact from interacting with your device." **

1. Maal Lockdown Mode Dhugumatti iPhone, iPad, fi Mac Keessatti Jijjiirama¶

Sababni isaas, basaasaa kiraa sassaabdotaa zeeroo-cuqaasuu hidhaa akka cuqaastu si gaafachuu waan hin dandeenyeef, parsaroota koodii walxaxaa, hambaa kanneen ofumaan duubatti hojjetan (kan akka motora qubee agarsiisu, durtii fakkii/PDF iMessage keessatti, WebKit Just-In-Time keessatti fayyadamuu qaba JIT qindeessitoota, ykn 2G seelii beeziibaandii). Lockdown Mode ibsuun baqaqsanii hodhuudhaan guutummaa fuula haleellaa sana 8 hardware fi software subsystems irratti ni balleessa:

2. Akkaataa Itti Itti On Lockdown Mode (Akkaataa Appii ykn Weebsaayitii Amanamaa Tokko Whitelist Itti Dabarsan)¶

1. Iphone ykn iPad irratti: Settings -> Privacy & Security banaa -> Gara baayyee jalaatti Lockdown Mode tuquun -> Turn On Lockdown Mode tuquun -> Cuunfaa dubbisaa Turn On & Restart -> Passscode meeshaa keessanii galchaa.
2. Mac irratti (macOS Ventura / Sonoma / Sequoia+): System Settings -> Privacy & Security banaa -> Gara jalaatti qajeeluun Lockdown Mode cuqaasaa -> Turn On... cuqaasaa -> Turn On & Restart cuqaasaa.
3. Akkaataa Weebsaayitii ykn Appii Amanamaa Tokko Kan JIT JavaScript Barbaachisu (Haala Qulfii Osoo Hin Cufne): Yoo poortaalli weeb hojii murtaa'e (akka Figma ykn daashboordii baankii) Safari keessatti sababa JIT ykn qubeewwan mallattoo amala ugguramaniif:
4. Safari keessatti, Sajoo Fuulaa (AA ykn mallattoo Puzzle/Menu) barruu teessoo keessatti -> Qajeelfama Weebsaayitii -> Toggle OFF ** tuqi.Enable Lockdown Mode** qofa domeenii amanamaa tokkicha sanaaf.
5. Appii iOS addaa fe'ameef: Settings -> Privacy & Security -> Lockdown Mode -> Configure Web Browsing deemuun appii mirkanaa'e tokkicha sana qofa hambisaa.

Marsaa 3ffaa: Andirooyidii Advanced Protection & . 2G Cellular Disable Fayyadamtoota Balaa Ol’aanaa Qabaniif¶

Yoo bilbila ismaartii Andirooyidii fayyadamtan (keessattuu Google Pixel 8 / 9+ ykn Samsung Galaxy S23 / S24 / S25+), ittisa haardwaara fi OS zeeroo-click keessaa ijaarame kana amma dandeessisi:

1. Ajjeesuu kan... 2G / GSM Veektarii Gadi Bu'iinsa Beezbaandii:
2. Settings -> Network & internet -> SIMs -> [Carrier keessan] -> Gara ** tti gadi bu'aa banaa.Allow 2G** fi OFF (Samsung Galaxy irratti: Settings -> Nageenyaa fi iccitii -> Auto Blocker -> Maximum restrictions) jijjiiruun.
3. Kun maaliif barbaachisaa ta'e: Masaraawwan seelii sobaa (Stingrays / IMSI-catchers) fi SMS Blaster vaan bilbiloota dhiyoo jiran 5G/LTE encrypted irraa hanga bara 1990mootaatti akka gadi bu'an dirqisiisu 2G (GSM), kan mutual tower authentication hin qabne, haleellaan koodii SMS akka addaan kutaniifi baseband exploits akka inject godhan kan taasisudha.
4. Samsung On gochuu Auto Blocker & . Maximum Restrictions (UI tokko 6+):
5. Bilbiloota Samsung Galaxy irratti Settings -> Security and privacy -> Auto Blocker banuun ON jennee jijjiiraa. Kunis haleellaa daataa-injection keebilii USB ni uggura, sideloading ni uggura .APK faayiloota, fi Message Guard (sanduuqa cirrachaa zeeroo-click adda baafamee fi faayiloota suuraa hamaa Samsung Messages, Google Messages, fi WhatsApp keessatti osoo isaan system memory hin tuqin dura kiyyootti galchu) hojiitti hiika.
6. Ibsi Memory Tagging Extension (MTE) Google Pixel irratti 8 / 9+:
7. Hardware ARM v9 Eksteenshinii Mallattoo Yaadannoo (MTE) yeroo qabatamaa keessatti sadarkaa silikoonii CPU irratti dhangala'aa buffer fi manca'iinsa mimoorii fayyadama-booda-free ta'e adda baasee, fayyadama cuqaasuu zeeroo maaykiroo sekoondii teessoo yaadannoo itti aanu irra barreessuuf yaalu kuffisa. Sajoo -> Nageenya & iccitii -> Nageenya & iccitii dabalataa -> Mallattoo yaadannoo jalatti dandeessisi (ykn Filannoo Guddistuu / Eegumsa Ol'aanaa keessa).
8. Galmaa'aa Google Advanced Protection Program (APP):
9. Daawwadhaa https://landing.google.com/advancedprotection/ Herrega Google keessan dirqama FIDO2 Hardware Keys/Passkeys tiin cufuuf, appii OAuth qaama sadaffaa hin amanamne hunda ugguruu (ilaali OAuth hayyama phishing fi hayyama appii qaama sadaffaa hamaa haquu), fi deep Play Protect scanning dirqisiisuu.

Marsaa 4ffaa: Akkaataa sakatta’iinsa fooransikii Mercenary Spyware (Amnesty MVT & . iVerify) .¶

Yoo gaazexeessaa, aktiivistii, ogeessa seeraa, ykn hoji gaggeessaa taatee fi email/iMessage Apple Threat Notification ofiisaa yoo argatte (yeroo seentu immoo banner argite) maal ta'a appleid.apple.com ykn account.apple.com), YKN bilbilli keessan mallattoo araarama sadarkaa olaanaa agarsiisa (ofumaan deebi’ee jalqabuu, yeroo qorraa fi hojii malee jiruu baatiriin garmalee dhumuu, ykn itti fayyadamni daataa gara IP hin beekamnetti dabaluu)?

Tarkaanfii Tarkaanfiin Qorannoo Fooreensikii Amnesty International Fayyadamuun MVT (Mobile Verification Toolkit) .¶

Yoo hin salphaatti bilbila dursitee haxaa'uu yoo mirkaneessuu barbaadde Pegasus, . Predator, ykn Triangulation ture, sababiin isaas haxaa’uun meeshaalee fooransikii Citizen Lab ykn Amnesty International barbaachisan waan balleessuuf: 1. Bilbila Al tokko Reboot gochuun On gochuu Lockdown Mode: Kun galmeewwan adda baasuu diskiin irratti osoo eegu active RAM-resident exfiltration dhaaba (Shutdown.log, . DataUsage.sqlite, . DiagnosticPipeline, . WebKit kaachota, fi SMS.db gabateewwan dabalataa). 2. Aministii Intarnaashinaal Bilisaa, Madda Banaa Dhaabuu MVT (Mobile Verification Toolkit) Kompitara Liinux ykn macOS Qulqulluu irratti:

# Install MVT via pipx or Python 3 venv on macOS or Linux:
pip3 install mvt

# Download the latest public Indicators of Compromise (STIX2 IoCs for Pegasus, Predator, Reign, etc.) from Amnesty's repository:
mvt-ios download-iocs

# 1. Create an encrypted local backup of the iPhone using libimobiledevice (or Finder) to a folder:
idevicebackup2 backup --full ~/Desktop/iphone_forensic_backup/

# 2. Decrypt the backup using your backup password and run MVT's full forensic check against known spyware IoCs:
mvt-ios decrypt-backup -p "YourBackupPassword" -d ~/Desktop/decrypted_backup/ ~/Desktop/iphone_forensic_backup/
mvt-ios check-backup --iocs ~/Library/Application\ Support/mvt/indicators/ -o ~/Desktop/mvt_results/ ~/Desktop/decrypted_backup/

Gaaffiiwwan yeroo baay’ee gaafataman¶

Does turning off Bluetooth and Wi-Fi in the iPhone Control Center stop Flipper Zero popups or wireless tracking?¶

No. Swiping down the iOS Control Center and tapping the Wi-Fi or Bluetooth buttons only disconnects your iPhone from your current Wi-Fi router or Bluetooth headphones until 05:00 the next morning, while keeping both the Wi-Fi (`AWDL`) and Bluetooth Low Energy (`BLE`) radio chips physically powered on in the background to support AirDrop, AirPlay, Find My, and Apple Watch communication. Because the BLE radio is still listening, a Flipper Zero BLE advertising flood in the same room will continue popping up fake AirPods/Apple TV pairing cards on your screen. To completely power down the radios, open the main **Settings** app and toggle **Bluetooth** and **Wi-Fi** to **Off**.

If a stranger on a train or plane sends me an unsolicited AirDrop or Quick Share photo and I tap "Decline," could my phone still be infected with a virus?¶

On any modern, updated iPhone or Android smartphone, tapping **Decline** on an AirDrop or Quick Share transfer discards the file before it is saved to your user storage and will not infect your phone with malware. However, because AirDrop renders a preview thumbnail on your screen before you tap Decline (which is how "cyber-flashing" harassment works, and why image parsers are a target for advanced researchers), you should never leave AirDrop set to *Everyone* or Quick Share set to *Everyone*. Keep **AirDrop** set to **`Receiving Off`** (ykn **`Contacts Only`**) so strangers cannot even trigger a preview prompt on your screen.

Should every regular smartphone user turn on Apple Lockdown Mode every day?¶

Most ordinary consumers do not need to run `Lockdown Mode` 24/7 unless they are at elevated risk of targeted espionage (such as journalists, lawyers, executives, political campaign staff, activists, cryptocurrency whales, or domestic violence survivors facing an unusually technical adversary) or are traveling through a high-risk border or jurisdiction. However, Lockdown Mode is surprisingly livable for daily use: your phone calls, regular text messages, WhatsApp/Signal chats, camera, Maps, Apple Pay, and App Store apps all continue working normally; you simply lose automatic iMessage link previews, unknown FaceTime callers, and wired USB charging-port data while locked (and you can easily exclude any specific trusted website that needs fast JIT JavaScript).

Why do security agencies tell you to "Reboot Your Phone Daily" to defend against Pegasus and zero-click spyware?¶

Both the United States National Security Agency (NSA) Mobile Device Best Practices and Amnesty International's Security Lab recommend rebooting smartphones regularly because modern zero-click spyware (`Pegasus`, . `Predator`) costs millions of dollars to develop and avoids writing permanent files to the cryptographically signed `/system` disk partition where boot-time Integrity Verification (`Secure Boot` / . `dm-verity`) would detect it. Instead, the spyware lives strictly inside volatile **RAM** after exploiting a message or browser process. Turning your phone completely off and back on wipes volatile RAM clean, destroying the active implant and forcing the attacker to risk detection by firing another zero-click exploit (which fails completely if you also turn on **Lockdown Mode** or update iOS/Android).

Qajeelfamoota walqabatan¶

• Bilbiloota irratti stalkerware, spyware, fi dhokataa ta'e adda baasuu
• Public Wi-Fi, Evil Twin hotspots, and USB juice-jacking defense
• Zero-day exploit emergency patching and End-of-Life device isolation
• GPS tracker and AirTag stalking detection
• Session cookie hijacking, infostealer malware, and passkey revocation
• Global emergency numbers

Maddoonni sakatta'aniiru¶

• National Security Agency (NSA) & Cybersecurity and Infrastructure Security Agency (CISA) (United States): Mobile Device Best Practices and Mobile Communications Security Guidance for High-Risk Individuals.
• Apple Inc. (International): Apple Platform Security Guide (Lockdown Mode Architecture, iMessage BlastDoor Sandbox, AWDL / AirDrop Cryptographic Identity Handshake, and Threat Notification Protocols).
• The Citizen Lab (Munk School of Global Affairs & Public Policy, University of Toronto) (Canada): Technical Forensic Reports on FORCEDENTRY, . BLASTPASS, . PWNYOURHOME, and Real-World Validation of iOS Lockdown Mode.
• Amnesty International Security Lab (International): Mobile Verification Toolkit (MVT) Documentation and Forensic Methodology for Detecting Pegasus fi Predator Mercenary Spyware.
• Google Threat Analysis Group (TAG) & Android Security Engineering (International): Android Memory Tagging Extension (MTE), 2G Baseband Disablement, and Commercial Surveillance Vendor Threat Reports.