Chapter 16 · 3 min read

Checking your iPhone with MVT

Looking for spyware traces in an iPhone backup, with Amnesty International's tool.

MVT (Mobile Verification Toolkit) is a forensic analysis tool published by Amnesty International's Security Lab, released in July 2021 alongside the Pegasus Project revelations. It examines an iPhone backup and compares what it contains against a list of known indicators of compromise (IOCs).

16.1 Who this is for

Mercenary spyware such as Pegasus or Predator is expensive and aimed at specific targets. For the vast majority of people, the real risk is still the reused password and phishing, covered in the earlier chapters.

This check makes sense if:

  • you are a journalist, lawyer, activist, elected official or researcher working on sensitive topics
  • you received an Apple threat notification
  • you have a concrete reason to believe your phone is being monitored

If you simply want peace of mind, the chapter 14 checklist will do far more for you.

16.2 What you need

  • a Mac or a Linux PC (MVT does not run natively on Windows, you need WSL)
  • Python 3.6 or newer
  • a cable to connect the iPhone
  • disk space for the backup, then for its decrypted copy

16.3 Installing MVT

On macOS, with Homebrew:

brew install python3 pipx libusb sqlite3
pipx ensurepath
pipx install mvt

Close and reopen the terminal after "pipx ensurepath", otherwise the mvt-ios command will not be found.

16.4 Making an encrypted backup

Backup encryption is not optional here: without it, iOS leaves out some of the data (histories, logs) the analysis relies on.

  1. Connect the iPhone to the Mac and open Finder.
  2. Select the iPhone in the sidebar, General tab.
  3. Choose "Back up all the data on your iPhone to this Mac".
  4. Tick "Encrypt local backup" and set a password.
  5. Click "Back Up Now" and wait for it to finish.

Save that password in your password manager. Without it the backup is unusable, including by you.

The backup then sits in a folder named after the device identifier:

~/Library/Application Support/MobileSync/Backup/<UDID>

16.5 Decrypting the backup

MVT_IOS_BACKUP_PASSWORD="your-password" \
  mvt-ios decrypt-backup \
  -d ~/mvt/decrypted \
  "~/Library/Application Support/MobileSync/Backup/<UDID>"

The decrypted copy holds everything your phone holds. Keep it on an encrypted disk and delete it once the analysis is done.

16.6 Fetching the public indicators

MVT only detects what you give it to look for. This command downloads the public list maintained by the project:

mvt-ios download-iocs

16.7 Running the analysis

mvt-ios check-backup --output ~/mvt/results ~/mvt/decrypted

MVT extracts the backup records into ~/mvt/results as JSON, and compares them against the indicators.

16.8 Reading the result

  • no file with a _detected suffix: nothing known was found
  • a file with a _detected suffix: something matches a known indicator, and deserves an expert opinion

A match is not proof on its own, and the absence of a match is not a certificate of cleanliness. MVT implements only part of the STIX2 specification and only knows about publicly documented campaigns.

16.9 If something is detected

  1. Do not reset the phone straight away: you would destroy the evidence.
  2. Keep the backup and the results folder.
  3. Contact the Access Now Digital Security Helpline, free and available 24/7.
  4. Turn on Apple's Lockdown Mode, designed against this kind of attack.

Every recommendation links back to official documentation.