Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Aggregated disk writes

i have found the text below in iPhone analytics data. What does it mean please?

{"app_name":"aggregated","app_version":"","bug_type":"145","timestamp":"2020-02-06 08:20:33.14 +0300","os_version":"iPhone OS 13.3.1 (17D50)","incident_id":"34880E87-9A67-4A16-A17A-94D0369275CF","slice_uuid":"B722CBE6-961A-3300-80E4-2CC18CCFC143","build_version":"","is_first_party":true,"share_with_app_devs":true,"name":"aggregated"}

Date/Time: 2020-02-05 21:01:20 +0300

End time: 2020-02-06 08:20:32 +0300

OS Version: iPhone OS 13.3.1 (Build 17D50)

Architecture: arm64e

Report Version: 29

Incident Identifier: 34880E87-9A67-4A16-A17A-94D0369275CF


Data Source: Microstackshots

Shared Cache: 0x1a4e8000 A77981DC-1632-354B-978B-380DC657D1E6

Shared Cache: 0x24988000 A77981DC-1632-354B-978B-380DC657D1E6


Command: aggregated

Path: /System/Library/PrivateFrameworks/AggregateDictionary.framework/Support/aggregated

Version: ??? (???)

PID: 1811


Event: disk writes

Action taken: none

Writes: 1073.75 MB of file backed memory dirtied over 40752 seconds (26.35 KB per second average), exceeding limit of 12.43 KB per second over 86400 seconds

Writes limit: 1073.74 MB

Limit duration: 86400s

Writes caused: 1073.75 MB

Writes duration: 40752s

Duration: 40752.35s

Duration Sampled: 40679.60s

Steps: 263 ( (10.49 MB/step))


Hardware model: iPhone12,1

Active cpus: 6

iPhone 11, iOS 13

Posted on Feb 7, 2020 5:50 PM

Reply
Question marked as Best reply

Posted on May 1, 2020 3:27 AM

Let me preface all of this by saying something I've wanted to say for over a year. You people on these forums who give snide, sarcastic responses to others who come here for help (as if they're paranoid or wanting a problem) should be ashamed of yourselves. This stuff is REAL. Yes, there are some paranoid people out there, but when you've had your entire electronic world taken over and you discover that people have been doing things you didn't even know was possible it tends to make you a little paranoid. 

Your situation sounds exactly like my scenario-except I know who is behind my issue. The capabilities that can be enabled by a malicious developer are insane. And the lack of regulation with enterprise software is maddening. When the wrong people get a hold of it (like the culprit behind my issue, who works in IT and used a copy from his work)...they have complete, hidden control over your devices. It doesn't matter how many times you wipe your devices-it is designed to persist. The person "helping" me installed enterprise software on my laptop without my knowledge. He created a hidden administrator profile and my entire system was a remote desktop controlled by him. There are menu items I am blocked from seeing, some settings I'm unable to change and even though my phone wasn't paired with the laptop (I didn't even have itunes on the computer) everything was syncing to it. He has been able to control my home network, despite my purchasing a new router. I spent MULTIPLE hours/days getting help from Microsoft and Apple- but I never got help from anyone skilled enough to fully (and permanently) remove the management tools. Microsoft remoted into my system and uncovered and deleted the files and secret administrator profile but they didn't go far enough. The stalker actually remoted into my system and brought up some sort of chat window and taunted me, saying it would always come back because it was in the registry. I've been told by an IT person at my work that I'll have to get new devices (laptop and phone) and abandon my Microsoft and Apple ID's to be free of it. The software companies make most of their money from enterprise/group policy clients. Every business out there uses management software-which I understand. But it is infuriating to have lost control of my entire electronic existence on my personal devices that I paid good money for. Software I purchased and basically my whole life.  All pictures of my children, documents, the email address I've always used (for every account, including my banking and utilities) are no longer in my control. I never would have believed it would be so difficult to get help for something like this. I now realize I never will. I never gave anyone my passwords and have always been hypervigilant about protecting my network. I've always kept my software and security up to date.

Similar questions

95 replies
Question marked as Best reply

May 1, 2020 3:27 AM in response to Community User

Let me preface all of this by saying something I've wanted to say for over a year. You people on these forums who give snide, sarcastic responses to others who come here for help (as if they're paranoid or wanting a problem) should be ashamed of yourselves. This stuff is REAL. Yes, there are some paranoid people out there, but when you've had your entire electronic world taken over and you discover that people have been doing things you didn't even know was possible it tends to make you a little paranoid. 

Your situation sounds exactly like my scenario-except I know who is behind my issue. The capabilities that can be enabled by a malicious developer are insane. And the lack of regulation with enterprise software is maddening. When the wrong people get a hold of it (like the culprit behind my issue, who works in IT and used a copy from his work)...they have complete, hidden control over your devices. It doesn't matter how many times you wipe your devices-it is designed to persist. The person "helping" me installed enterprise software on my laptop without my knowledge. He created a hidden administrator profile and my entire system was a remote desktop controlled by him. There are menu items I am blocked from seeing, some settings I'm unable to change and even though my phone wasn't paired with the laptop (I didn't even have itunes on the computer) everything was syncing to it. He has been able to control my home network, despite my purchasing a new router. I spent MULTIPLE hours/days getting help from Microsoft and Apple- but I never got help from anyone skilled enough to fully (and permanently) remove the management tools. Microsoft remoted into my system and uncovered and deleted the files and secret administrator profile but they didn't go far enough. The stalker actually remoted into my system and brought up some sort of chat window and taunted me, saying it would always come back because it was in the registry. I've been told by an IT person at my work that I'll have to get new devices (laptop and phone) and abandon my Microsoft and Apple ID's to be free of it. The software companies make most of their money from enterprise/group policy clients. Every business out there uses management software-which I understand. But it is infuriating to have lost control of my entire electronic existence on my personal devices that I paid good money for. Software I purchased and basically my whole life.  All pictures of my children, documents, the email address I've always used (for every account, including my banking and utilities) are no longer in my control. I never would have believed it would be so difficult to get help for something like this. I now realize I never will. I never gave anyone my passwords and have always been hypervigilant about protecting my network. I've always kept my software and security up to date.

Apr 28, 2020 9:19 PM in response to Cr21h

He’s write anytime a signal superceeds factory specs of a kernel or hardware spec it crashes and opens up for attack, and the attacker can then take control of your phone. How this is possible is through man in the middle attacks like the one you will see criminals as well as law enforcement have that capability, and to be honest Apple App Store has man in the middle software as well as developer software ready to be downloaded, trust me I’ve spent hours researching this. More then likely your trust certificates are compromised and when you go online no matter what security precautions you take that certificate if now invalid or partially invalid leaves you open to more attacks and control of your device no longer is yours or your networks. If your data is increasing more then likely your now in a unique situation so look into it. They can have access to everything, iPhone is built for remote connections so your camera could be recording you, etc. Unfortunately if there good you won’t catc them these hacking programs do not leave traces, and can’t be seen by the networks so what ever there doing will be done by the USER check your analytics for USER any other program or phone the user is the one operating that would be you. It could be your phone that’s responsible for criminal activity done by others, if they have access to your device info then they can clone your phone and use it maliciously and you could be held accountable. If that be the case then god help you. A new phone isn’t going to help you.

May 1, 2020 3:36 AM in response to Jagcresmur

My iphone looks like regular, public software and there is no "profile" showing. There was a very short period, after an update, where "profile" would show up in my settings menu after I restarted the phone. If I tapped it to further investigate nothing would show up. If I hadn't been paying attention (like someone paranoid) I never would have seen it. Other issues became apparent during the short period of time. Glitches the hacker hadn't had time to fix yet. I made a phone call and Facetime, with access to my cameras, popped up. I had Facetime DISABLED/turned off in my settings and I never use it. I could go on and on.

I've gone years with a managed configuration without knowing it. From what I've discovered, I have a "hybrid" system. Most of my apps are managed and are part of software bundles. My app store is restricted to what the stalker allows me to download. Apple allows developers to pay $100 and build systems with software development kits. They are allowed to take stock Apple apps and configure them to their liking. There's nothing that informs a victim that the phone is developer software or that apps in your app store are really from "app store connect." Most big companies offer open source software, allowing people who like to tweak things to use their brand, (including logos and icons) and create malicious application. One recent discovery I made was the app I use for the new router I bought. Guess what Linksys allows people to do with their smart wifi app? Yup. Some functions/options don't show up for me. When it looks like I'm connecting to my network it turns out there is some sort of hidden network within mine (security, passwords and setting the router up as new doesn't matter). If I do a traceroute to any website from my network my traffic passes through a bunch of ip addresses before reaching the destination. Research of the ip addresses end up showing servers/domains that...wait for it... big trusted companies allow people to buy. Among them are GoDaddy and Amazon (AWS). All enterprise or tracker services. It turns out my Google/Safari is managed. Google let's these people do it, too. I've had to learn all of this slowly, and on my own, because none of the companies practice the "transparency" they preach. There's not a single company out there that won't provide a "service" if people will pay for it.  The bottom line is all of the tracker tools/management software is hidden and there is no simple way to find out all of the functions or what is being used against you. I still don't know everything that is implemented on my devices, and I probably never will. I'd, honestly, rather be as blissfully ignorant as I was before. Knowing that all of my information, location, texts, network settings, email, etc is being accessed feels so violating. And I can't do anything about it. And every one of the big company names I trusted is behind it. If you feel like something is "off" with your phone then it probably is. But finding answers to your concerns will be next to impossible. I'm not tech savvy. I spent a lot of time looking at analytics data and looking up terms I found. There were a lot I was sure would be something bad that ended up being normal processes. The others typically linked to github or other sites where hackers go to share code. And there's still no "definition" that pops up and explains what bug your phone is suffering. Some things are rather straightforward, though. "Managed configuration" and "MDM" have reared their ugly heads, after a lot of weeding through masses of other words. Also "shared utilities" and network/Wifi manager with something about shared network. None of it is easy to find, though. 

Oct 16, 2020 12:15 AM in response to chennessy1383

sweetheart I wish I could help you. I wish someone would help you. Then I could get help also. No one. NO ONE will step up to the plate and offer any type of assistance. It’s like no one wants to let the cat out of the bag. Bad part is I kNow who my attacker is. She’s been f’ing with me all day. Especially in maps. When your phone screams proceed to the root over and over while you sitting at a red light or that GD low battery warning pops up every time to try to text someone and you look up and learn you haven’t text **** cause you have to hit ok again. The list goes on and on. You open up your text app and you are in a text to someone you haven’t spoke to in years. Try to take required pictures of the equipment I repair and have to take at least 5 of each shot you want because camera won’t focus. When looking through the camera view “screen” it appears as though you are looking through a different camera that just happens to be pointed and what you are seeing. Instead of the keyboard learning repeated words and phrases it unlearns. You have to type the same **** constantly like your own email address, notes, etc. changing words that you normally type into **** may not even heard of causing you to take 3-5 times longer to compose an email or text.

making the font so small you can’t read it even though it’s set as big as it will get.

blurring the screen. Today Siri decided she will no longer look up anything for me until I turn my location. On.

no matter if it’s just a number of a contact that’s in my phone already. Funny thing is I didn’t turn it off. I use maps many times a day while working. Screen blacks out asleep just after you start typing forcing you to unlock again.


my iPhone 6 Plus with At&T says I’m not connected to the internet every time I try to log into my account.

6 phones and 2 tablets are not turned into USB cameras streaming video and to my raspberry pi where it uploads it to god knows where but it uses one or more of my devices as a modem to dial out with since I don’t have internet. Actually found the modem commands for At&T the other day embedded somewhere in my pi. I have root access and there lots more exposure to the file system than with an iPhone or android.

this is nothing new or a recent discovery. She’s been doing this to me since I got my first iPhone 12 years ago. I’ll include a few pics of the pi kernel and some of my old windows 7 or xp that she first started this nonsense on.

May 7, 2020 6:42 AM in response to Jagcresmur

You're right. There will never be much help in these situations. The people who continually negate what others post about this don't seem to give legit answers to really help issues. They either have too much time on their hands, and love to dispute what anyone says or they have some sort of secondary gain behind their incessant rebuttals. It's really frustrating when you're experiencing issues. It sheds a negative light on these "help" forums.

May 11, 2020 5:28 PM in response to DARKG8R

Your Safari browser uses various versions of software/code web kits.Apl And these features/ functions can be changed based on the website you visit depending on the type of website it is. HTML XHTML etc. This feature gives you a better experience surfing the internet. Cookies/hijacks etc could also alter these functions. Many different level of attacks are capable of altering any device or phone. Don’t pay attention to people like Deggie he probably works for the CIA zombie task force for the city of nowhere. Problems your having could be just related to various cookies/hijacks/ etc. If that’s the case download iVerify. it will help you secure your phone to the max as far as your device.

first do full reset. First then you download download Iverify then follow exactly to a tee. $ is needed if I remember. Then get something like Norton LifeLock or similar. Again money.

Follow instructions to the letter.

before reset get a certificate checking app like TSL and learn to use it. This checks your internet security certs. Type I’m google in the app and if you see red ex’s your device more then likely make a good coaster, or mirror. If that’s the case new phone, new number, new provider might help you, that’s if you never connect it to any other service or account, WiFi, etc. More then likely if hijacked that bad it’s targeted and new devices won’t help you. TLS inspector.

Jun 4, 2020 4:51 PM in response to Community User

My hand off gets turned on quite a bit also.

my new phone was taken over before I even added an Apple ID or an email.


check your Safari UA (user agent)


this is mine.

this UA (Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; GTB6; Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; InfoPath.2; .NET CLR 3.5.21022; .NET CLR 1.1.4322; .NET CLR 3.5.30729; OfficeLiveConnector.1.3; OfficeLivePatch.0.0;) tells us that the visitor is using Internet Explorer 8, Windows Vista, has Media Center PC 5.0 installed, Office Live Connector, etc. So if we had a special section for Vista users, we could redirect this person based on the Windows NT 6.0 string to a sub section in our site related strictly to Vista. This User Agent on the other hand, Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.1.3) Gecko/20090824 Firefox/3.5.3 tells us the visitor is using FireFox 3.5.3 and Windows Vista. Not much else.


when I first signed in to yandex in Russia I said my IP address was x and my location was Alabama and ask for confirmation. I definitely agreed seeing how my sociopath ex (the one that brought about all this devastation and destruction for 12 years now) just happens to live in Alabama.

I tracked that IP address for a while. It was a Verizon wireless static ip that is now in Knoxville tn. Red herring no doubt. It drove through Alabama and made its way to Knoxville after a week and that’s where it is now.


to get the report of your ua


iptools.com I think is where I found that.


if you have gmail you can also find it listed on the web/desktop version of gmail and you can also see any ip addresses recently in your account.


it amazes me that someone can ssh into my ****. Destroy my devices. Take all my online accounts. Cause so much chaos stress and havoc in my life and nothing ever happens to this oxygen thief. My children 8/9 years old can’t have a working computer to do schoolwork or anything else with for that matter.

the last week of school they used my work phone. This phone. This monster can look the kids in the eye and swear to the kids that I’m crazy and she knows nothing about all that stuff. And goes merrily on her way knowing that I witnessed this first hand. Seen her notes. Seen all her wiki how screen shots on her google account. Kali Linux meterpreter sessions. Metasploit. Reverse tcp lhost etc etc. Had a photo copy of my phones screen showing she was in it on morning about 7 years ago had sha256

smtp

ftp

samba

mmwiley913@gmail

had another folder with “keys” to everything in it. I took this to the authorities and they did nothing. No one does nothing. No one will help you. No one gives a **** that you’ve spent a fortune replacing everything and it does no good. I have reached my limit.

the 2 iPhones I bought the other day was my had enough moment. It is time to switch tactics and reframe from my defensive approach and position and become amphibious and offensive. look out sourceforge

im gong incognito for real

Sep 20, 2020 4:23 PM in response to Fearless1978

I have since found that all 3 of my iPhone are broadcasting video and audio. Somehow the sociopath has set up websockets on my iMac and on a couple raspberry pi’s and some how they are my phones are usb web cams? Connected to the websockets and sending everything I do and say from microphone and fromt n rear cameras on 3 freaking phones.

whomever said I phones must be jail broke to compromise really don’t know what nodejs python3 Perl xml is capable of. the sociopath has never even seen or touched any of my phones. Or TVs but yet somehow she manages to do what she wants with them. with Android she had them hymmed up Along with any and every email I would try to make in a rogue version of gsuite. Once she gets the uuid of the device it’s over. You can’t stop Bluetooth BLE

most idiots don’t even know it’s there but it’s been around and utilized as a mesh network for hacking and spying a long time.

Apr 26, 2020 10:18 PM in response to Alfahn

app_name":"aggregated","app_version":"","bug_type":"145","timestamp":"2020-03-29 21:04:58.75 -0400","os_version":"iPhone OS 13.3.1 (17D50)","incident_id":"87A6F462-EE26-432B-8E9A-10BB84B12C44","slice_uuid":"B722CBE6-961A-3300-80E4-2CC18CCFC143","build_version":"","is_first_party":true,"share_with_app_devs":false,"name":"aggregated"}

Date/Time: 2020-03-29 05:03:42 -0400

End time: 2020-03-29 21:04:58 -0400

OS Version: iPhone OS 13.3.1 (Build 17D50)

Architecture: arm64e

Report Version: 29

Incident Identifier: 87A6F462-EE26-432B-8E9A-10BB84B12C44


Data Source: Microstackshots

Shared Cache: 0x57ac000 A77981DC-1632-354B-978B-380DC657D1E6

Shared Cache: 0x31084000 A77981DC-1632-354B-978B-380DC657D1E6


Command: aggregated

Path: /System/Library/PrivateFrameworks/AggregateDictionary.framework/Support/aggregated

Version: ??? (???)

PID: 727


Event: disk writes

Action taken: none

Writes: 1073.75 MB of file backed memory dirtied over 57676 seconds (18.62 KB per second average), exceeding limit of 12.43 KB per second over 86400 seconds

Writes limit: 1073.74 MB

Limit duration: 86400s

Writes caused: 1073.75 MB

Writes duration: 57676s

Duration: 57675.78s

Duration Sampled: 57551.57s

Steps: 288 ( (10.49 MB/step))


Hardware


Apr 29, 2020 12:25 AM in response to Community User

I don’t have any option of encryption for my Apple email or for signing. The Authentication is set for “Apple Token”. “No valid Certificates” I can’t manually set mail up for password protection or anything else.

I also don’t show “Profile” in “General” settings but something fishy is going on with this piece of....


iPhone 11. I believe that it is a former employer, in cahoots with my provider and Apple won’t comment other than to say “Well that is something” but they refuse to tell me what “that something” is.


so frustrating. I’m just a nobody who wants to have fun with my iPhone but I cannot Trust it. Anyone else have this situation? I also have zero control over my “System Settings” - no buttons or anything to toggle.


Jun 1, 2020 10:19 AM in response to Cr21h

THANK YOU SO VERY MUCH FOR POSITIVELY CONFIRMING AND CLEARLY EXPLAINING MDM PROFILES AND TRUSTED CERTS I HAVE EXPERIENCED AND RECORDED COPIED SCREENSHOT FOR 19 mos I HAVE SPENT 3hrs on A NUMBER OF DIFFERENT OCCASIONS WITH THE F. B. I. FOR ME IT INITIALLY STARTED WITH LETTING SOMEONE IUSE MY IPHONE. NEXT THING I KNOW HOMELAND SECURITY IS TELLING ME I WAS COMPROMISED THROUGH MY ISP AND THEY HAVE TRACED IT TO SPRINT SERVERS IN THE PHILIPPINES! GHOSTING AND CLONING MY PHONE! EVEN 1100.00 ON A UNLOCKED I 11 PRO ,NEW EMAIL, APPLE ID SETTING UP AS A NEW IPHONE ONLY TO HAVE THE DEVICE TELL ME THAT I UNTIL I ENTER MY OLD PHONE PASSCODE SO THAT ALL MY SAVED PASSWORDS AND CODE STORED IN ICLOUD KEYCHAIN CAN BE DOWNLOADED TO THIS DEVICE ICLOUD, APPSTORE CAN NOT BE USED!

AND APPLE IS NO HELP AT ALL AS YOU SAY THEY ARE VAGUE AND HESITANT ABOUT THIS

May 1, 2020 2:32 PM in response to deggie

Apparently the only way anything can be done is within the framework of your knowledge base. Thanks for imparting your wisdom in such a kind, non-judgmental way. I've gotten confirmation of my issue from a professional. This phone is connected to a server with a cloud configuration that is set to reload and sync the configuration settings despite even a secure restore in DFU mode. The same thing happens with my laptop.

A few indicators that are just the tip of the iceberg: 

  • I was contacted by someone I've never met before to inform me that the "helper" had been bragging about having access to the security cameras in my house.
  •  One day my phone was going crazy processing something (little wheel was spinning for no reason).I put my phone in airplane mode and watched it be taken out of airplane mode right in front of me. Multiple times in a row. I, then, physically unplugged my router and he, somehow, made a paused video I'd been streaming on my TV start playing again. That is also when he pulled up a chat window on MY desktop and taunted me, informing me that the settings are in my registry and will come back evert time. I had loaded a fresh installation of windows onto my laptop that very day. He also teased me about the connection and said things were controlled via bluetooth. The day before the bluetooth in my car started speaking Chinese to me. The list goes on and on. 

I'm just glad I never bought the "smart" thermostat I was eyeing, because the *** would probably turn off my air conditioning when it turns 115 outside. These things, unfortunately, really happen to people. I don't think they are widespread, but they can happen. A very motivated person can create the perfect storm. I've seen it myself. 

May 11, 2020 5:30 AM in response to Cr21h

Update: Much has happened in the last week. But currently, one problem has to do with my Apple account. i signed out of my account and signed in again in an attempt -again - to reset end-to-end encryption. Have a strong inkling something in there, should not be. Well, it wont let me reset encryption. It will not provide that option. See photo.


Another situation - call were made that I did not make. What's more, one of the numbers checked comes up with a name I recall some time back when checking unknown numbers on my device. Additionally, calls came in that I did not know about and lasted 35 seconds. There's more to it that I figured about but to keep it plain and simple, they are from locations(towns) that I never go to. These in/out calls coincide with cuanging my location to differant to a differant state. It also creates counties that don't exist or uses areas with levels of new migration. In resetting network, I got 'connection not allowed' and it reconnected me to another state. Logins elsewhere showed I was not in my state. So doesn't Safari. These calls mentioned above, occurred over the last numbers of weeks. As a recent example there was a related call to a state then Thursday my location changes, then Friday around 7:16pm EST, it changes again and puts me into the state related to that unknown call. I also received a message 'that last line no longer available. Do you want to use your remaining line? WHATTT is that? This is too much BS for me now. What does it take for help?? And not people who just want to screw my situation more. i've been through way too much with this.

Aggregated disk writes

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.