Is my phone hacked

Question

Level 1

8 points

Is my phone hacked

{"bug_type":"288","timestamp":"2021-04-13 02:01:22.30 -0400","os_version":"iPhone OS 14.4.1 (18D61)","incident_id":"0B323EF9-71C8-46FC-AD16-20F2C2E567E6"}

{

"build" : "iPhone OS 14.4.1 (18D61)",

"product" : "iPhone9,1",

"kernel" : "Darwin Kernel Version 20.3.0: Tue Jan 5 18:34:44 PST 2021; root:xnu-7195.80.35~2\/RELEASE_ARM64_T8010",

"tuning" : {

},

"incident" : "0B323EF9-71C8-46FC-AD16-20F2C2E567E6",

"crashReporterKey" : "1410e15591f87124b177348351982385f207f96d",

"date" : "2021-04-13 02:01:22.28 -0400",

"reason" : "sysdiagnose (post-spindump) stackshot",

"frontmostPids" : [

59

],

"exception" : "0xbaaaaaad",

"absoluteTime" : 1511279961193,

"memoryStatus" : {"compressorSize":21460,"compressions":5153337,"decompressions":4082202,"busyBufferCount":2,"pageSize":16384,"memoryPressure":false,"memoryPages":{"active":40197,"throttled":0,"fileBacked":33983,"wired":17043,"purgeable":2056,"inactive":39782,"free":2788,"speculative":507}},

"processByPid" : {

"0" : {

"pid" : 0,

"residentMemoryBytes" : 17072128,

"timesDidThrottle" : 0,

"systemTimeTask" : 0,

"pageIns" : 0,

"pageFaults" : 11112,

"userTimeTask" : 88688.750855125007,

"procname" : "kernel_task",

"copyOnWriteFaults" : 0,

"threadById" : {

"257667" : {

"continuation" : [

0,

68838739632

],

"systemTime" : 0,

"name" : "thread call user #2",

"id" : 257667,

"basePriority" : 31,

"schedFlags" : [

"TH_SFLAG_EAGERPREEMPT"

],

"user_usec" : 1597142,

"schedPriority" : 31,

"system_usec" : 0,

"state" : [

"TH_WAIT"

],

"userTime" : 1.597142166

},

"588" : {

"continuation" : [

0,

68840102072

],

"userTime" : 3.2909999999999999e-06,

"systemTime" : 0,

"id" : 588,

"basePriority" : 81,

"user_usec" : 3,

"system_usec" : 0,

"schedPriority" : 81,

"state" : [

"TH_WAIT",

"TH_UNINT"

],

"waitEvent" : [

0,

68845228432

]

},

"142" : {

"continuation" : [

0,

68844171084

],

"userTime" : 1.1165999999999999e-05,

"systemTime" : 0,

"id" : 142,

"basePriority" : 81,

"name" : "AppleIPDormancyHandler",

"user_usec" : 11,

"schedPriority" : 81,

"system_usec" : 0,

"state" : [

"TH_WAIT",

"TH_UNINT"

],

"waitEvent" : [

1,

4704408780554041103

]

},

"654" : {

"userTime" : 0.24506054099999999,

"systemTime" : 0,

"name" : "AppleHIDTransportDeviceUART",

"id" : 654,

"basePriority" : 81,

"user_usec" : 245060,

"system_usec" : 0,

"schedPriority" : 81,

"kernelFrames" : [

[

0,

68838608376

],

[

0,

68838603028

Posted on Apr 17, 2021 8:28 AM

Reply

Answer 1

Top-ranking reply

MrHoffman

Level 10

153,597 points

Apr 17, 2021 8:41 AM in response to Danield83

There’s nothing in that JSON to indicate an accidental, malicious, software bug, or hardware bug as a trigger.

That dump is of the entire device, per the "0xbaaaaaad" code.

Those dumps can be easily created by a user by errant keypress, too.

Do you have any other indications or symptoms or problems that you are encountering that are concerning?

What to do? Update to 14.4.2. Ponder too that you are concerned about security, yet seemingly not on current software.

And as you’re concerned about security, also look at Settings > Passwords > Password Recommendations, and resolve the higher-priority reports listed there if you’ve not already been working on those.

Reply

Answer 2

MrHoffman

Level 10

153,597 points

Apr 17, 2021 9:00 AM in response to Danield83

Danield83 wrote:

IOSlowAdaptiveClockingDomain

Lots of cryptic and scary messages exist in logs, and are utterly benign.

With this current reading-the-logs-to-find-evidence-of-compromise approach, you’re looking for a needle in infinite haystacks, not knowing if there is a needle, and not even knowing what the needle looks like.

Do you have any specific indications, symptoms, or problems that are concerning you?

If you’re interested in the details of the kernel, acquire these books: http://newosxbook.com

Reply