How iOS Exploit Kits Fingerprint Devices Before Deploying Exploits
Summary
Analysis of Coruna and Predator shows how spyware checks device and browser signals to avoid unsuitable targets and research environments. Tests found that Coruna’s IndexedDB probe can indicate private browsing and its checks can detect Lockdown Mode.
Key points
- Coruna’s JavaScript platform-detection module reads the Safari user agent and iOS version to select an exploit chain, and stops if the browser or version does not match.
- The article’s tests on iOS 11.3–18.3.2 found that Coruna’s IndexedDB blob-storage probe failed in private browsing but succeeded in a normal tab.
- Coruna checks for WebRTC, WebGL and MathML rendering; on an iPhone running iOS 17.0.2, the article’s tests found all three signals changed with Lockdown Mode enabled.
- Coruna also checks the browser’s webdriver flag, which can reveal automation tools used in some analysis environments.
- The article describes Predator spyware checks for Developer Mode and analysis tools. A prior Jamf Threat Labs reverse-engineering report found it returned specific error codes to operators before exiting.
- The author advises researchers to use realistic device environments because kits may remain inactive when they detect automation, and recommends keeping devices current and enabling Lockdown Mode for higher-risk users.
Article Details
- Attack Vectors
- Coruna is delivered as a single HTML file hidden in an invisible iframe and runs JavaScript when the page is opened.
- Coruna profiles the device before selecting an exploit, including parsing the Safari User-Agent to determine the iOS version.
- Coruna probes IndexedDB behavior to infer whether an iPhone is in private browsing mode.
- Coruna checks for WebRTC and WebGL features and tests MathML rendering to identify Lockdown Mode or automated analysis environments.
- Coruna reads navigator.webdriver to detect browser automation.
- Predator checks for iOS Developer Mode, analysis tools, instrumentation frameworks, and network-capture utilities; it can report an error code to its operators and exit.
- Defensive Notes
- Keep devices current because the described exploit chains target specific iOS versions.
- Enable Lockdown Mode for higher-risk users; the article reports that some kits may abort when they detect it.
- Use analysis environments that closely resemble real devices, since automated browsers and simulators may be detected.
MITRE ATT&CK
T1497.001 · System ChecksCoruna checks for analysis environments using browser features, rendering behavior, and navigator.webdriver.T1592 · Gather Victim Host InformationCoruna profiles the device and extracts its iOS version from the Safari User-Agent before choosing an exploit.T1622 · Debugger EvasionPredator checks for iOS Developer Mode, analysis tools, instrumentation frameworks, and network-capture utilities before proceeding.
People
Malware
Vendors
Products
CorunaA case study in fingerprinting: CorunaiOSat why fingerprinting matters to attackers and defenders alike, walks through real examples from recent iOS threats and draws out the idea at its core: a lot of what a kit 'knows' about your phone, it's working outLockdown ModeFirst, it looks for WebRTC, the technology behind real-time audio and video calls in the browser. Lockdown Mode disables it, and many automated environments don't include it either, so the absence of its core objectsSafariA typical iOS Safari User-Agent looks like this:
Tools
Playwrightflag the browser sets to true when it's being driven by automation tools such as Selenium, Puppeteer or Playwright. Those tools drive a browser through code, with no human clicking or typing, the kind of setupPuppeteera flag the browser sets to true when it's being driven by automation tools such as Selenium, Puppeteer or Playwright. Those tools drive a browser through code, with no human clicking or typing, the kind ofSeleniumnavigator.webdriver, a flag the browser sets to true when it's being driven by automation tools such as Selenium, Puppeteer or Playwright. Those tools drive a browser through code, with no human clicking or typing,