I'm pretty sure there is spyware on my friend's phone deployed there by her ex. She asked me to find a proof and detect it. I usually sniff my network card with Wireshark to detect such spyware and check them with GeoIP but in iOS it's not possible. What can I do?
Possible signs there is Spyware present may include:
- Higher battery usage
- Higher than normal data usage
- Strange background noise during phone calls
- Unknown apps installed
- Apple ID login request
Any suspicion of a device being infected, the best course of action in my opinion is to factory reset the device (nuke it from orbit).
If this is not an option, installing a reputable antivirus application from the Apple store may be an alternative course of action.
Turn off mobile data link and connect the device to your own wifi network. Collect data at your access point (wifi router) and analyze it for suspicious communication. If you don't have accessible router, you can place a sniffer device (your laptop with Kali Linux is sufficient) on the uplink wire.
Alternatively you can relay all traffic over your own machine. Just turn your laptop into a hotspot, use the wired network for uplink then connect to it with the phone and start sniffing. (Then try some calls on the phone).
Identifying anything other than blatantly primitive spyware communication will be a hard work however. Smart spyware will certainly use encryption and may try to camouflage it's communication as legitimate transfer (https or dns request, whatever). You may want to look for increased traffic during calls (in case voice is recorded and transmitted).
If your friends ex deployed some malware and is using it to stalk him/her, then your best bets are to turn the malware against him/her and feed it bad data. Find somewhere to leave the phone that nobody goes to and has potential for surveillance, and leave it there for a week, on constant charge... watching... if he/she rocks up looking for it, you know, you have some pretty reasonable proof that it's backdoored and furthermore is being used to stalk. Repeating the proof will yield increased confidence, in that case. Some attackers are so stupid...
SIM cards can also be reprogrammed and backdoored, so while your friend finds a replacement phone to use for a while, he/she might also want to buy a new SIM card and have his/her provider switch her old number over to it.
Another option for obtaining proof is to create an environment where it can no longer communicate with the outside world, and watch its behaviour in a world which simulates the outside world... i.e. a "sandbox" network... run a private LAN that's riddled with honeypots and simulates "the internet", and watch what the phone accesses on that LAN. If it only accesses Android automatic updates and other legitimate websites in its idle time, then it's probably not infected. Keep in mind this won't be invisible to an attacker, though... look at it this way, the phone is on one minute, with certain GPS coordinates... then it goes offline for some days. Stay safe and free of creepy digital stalkers, please. Good luck!