ANECompilerService

Yes to your question, in fact all my devices are wrong:

• I am forced to use modified beta apps, in Googles case, old open source versions. I also have beta versions of Apple architecture like SpringBoard. I am not enrolled in any beta programs and I don’t have TestFlight installed.
• My emails are (intermittently) intercepted and replies are spoofed.
• My Apple devices connect to other devices, despite this having been turned off (not just in terms it of looking around to see who is nearby which most mobiles do) but literally connecting directly to it via its IP address.
• My devices are actively sending and receiving iMessages and FaceTime despite it being disabled.
• Siri is recording despite it being disabled.
• My location is monitored despite location being disabled.
• Numerous triggers have been set up (not by me) to activate, for example when in a vehicle and voice triggers.

They’ve been reset by Apple with no change.

[Edited by Moderator]

@Wattermellon

I have some further information, ANECompilerService is apparently a process that runs on Apple products with Adobe Creative Suite installed. ANE stands for Adobe Native Extensions which developers code for Adobe AIR applications. ANE files are libraries of native code, ANECompilerService compiles the code into an executable format. When there is an issue with the ANE compilation it may create a log entry, which is what we have found on our devices.

So, it’s a legitimate process, albeit an executable so worth keeping an eye on, HOWEVER, if you do NOT have Adobe AIR applications installed then it’s highly like either you have malware or an active exploit is using the compiler to execute code.

In my case, it has never had Adobe on the iPad (or my iPhone which it is also on). My compiler was accessing libcommonCrypto.dylib which is a cryptographic function for encryption, decryption etc and this is not something that ANECompilerService should be accessing along with other security processes. At the time of the crash it was using several system libraries and system level components. There was also the issue that the check for a root certificate failed or was invalid.

I also found evidence in other logs of security violations on the iPad. I also have a compromised MacbookPro and Mac mini (which has now been confirmed) which were both interacting with all of our iPads (also confirmed) even though they have different Adobe IDs for some devices.

The bad news is, if your appearance of the log is not for a legitimate reason then it may be impossible to get rid of, for me, Apple Store performed a full reset and it hasn’t gone away. The lastest security update which came out yesterday also did not make a difference. I run the iPad in lockdown mode but that hasn’t made any difference, they have altered the operating system.

I am waiting to hear back what the next steps are.

@zenafromlancaster

From my investigation this has become a very sophisticated operation stemming from an exploit which allows an attacker to gain kernel privileges.

You know it’s bad when your SpringBoard on your iPad is a modified beta version.

Command:          SpringBoard
Path:             /System/Library/CoreServices/SpringBoard.app/SpringBoard
Identifier:       com.apple.springboard
Version:          1.0 (50)
Is First Party:   Yes
Beta Identifier:  XXXXXXXX-XXXX-XXXX-XXXX-4AC737AC4784
Resource Coalition ID: 9
Architecture:     arm64e
Parent:           launchd [1]
PID:              31

Event:            disk writes
Action taken:     none
Writes:           1073.77 MB of file backed memory dirtied over 54242 seconds (19.80 KB per second average), exceeding limit of 12.43 KB per second over 86400 seconds
Writes limit:     1073.74 MB
Limit duration:   86400s
Writes caused:    1073.77 MB
Writes duration:  54242s
Duration:         54241.79s
Duration Sampled: 54232.25s
Steps:            285 (10.49 MB/step)

Just following up for anyone also looking into these logs on their device. I discovered it is exploit CVE-2022-46689 which has been used to gain root privileges to my MacBook Pro, Mac Mini, iPhone and all our iPads (and wifi, security camera access). This exploit will allow someone to silently control your devices whilst sending your data to its servers. Unfortunately the problem persists regardless of patches/updates and re-installs.

Our computers and devices are currently under the control of an unknown attacker, so this information relates to my initial enquiry as to what ANECompilerService was for others seeking information. These are legitimate Apple services being misused. We are not enrolled in an Apple developer or beta program and the devices have always been kept updated and in lockdown mode since purchase.

ANECompilerService appears to be related to developer activities. It has been observed compiling unknown code both on macOS and iOS alongside kernel, triald, Trial, mediaanalysisd and PegasusKit in the forms of aned, _ANEServer, Espresso, ANECompiler, ANEServices, AppleH11ANEInterface and AppleNeuralEngine.

com.apple.aned

555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: dataVaultDirectory=/Library/Caches/com.apple.aned
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: buildSpecificModelStorageDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: modelAssetsCacheDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: inMemoryModelCacheDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: tempDirectory=<private>
555    0    aned: [com.apple.ane:aned] -[_ANEServer initWithDataVaultDirectory:dataVaultStorageClass:buildVersion:tempDirectory:cloneDirectory:]: cloneDirectory=<private>
555    0    aned: [com.apple.ane:aned] Ready to accept restricted and unrestricted XPC connections
555    0    aned: [com.apple.ane:aned] <private>: SecTaskCopyTeamIdentifier() returned teamIdentity=""
555    0    aned: [com.apple.ane:aned] <private>: SecTaskCopySigningIdentifier() returned csIdentity="<private>"
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating context XXXXXXXX04 eng=10008 dev=-1
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Creating plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] espresso_plan_add_network plan=XXXXXXXX20 path=<private> cp=65568
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Loaded network: '<private>' pf=10008 cp=0
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] espresso_plan_add_network plan=XXXXXXXX20 path=<private> cp=65568 Completed
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Destroying plan XXXXXXXX20
557    0    ANECompilerService: (Espresso) [com.apple.espresso:espresso] Destroying context XXXXXXXX04
557    0    ANECompilerService: (ANECompiler) ANEC Compiler Input used legacy key names 'NetworkPlistName' 'NetworkPlistPath' - please update to use 'NetworkSourceFileName' 'NetworkSourcePath'
...
557    0    ANECompilerService: [com.apple.ane:compiler] <private>: SUCCESS: model=<private> : output=<private> : lAttr=<private> : lErr=(nil)
555    0    aned: [com.apple.ane:aned] Compilation success: attr=<private>
555    0    aned: [com.apple.ane:aned] END: <private>: <private> : <private> : <private>

ANEStorageMaintainer is also developer related with an ANEVirtualClient:

com.apple.private.ANEStorageMaintainer

The main signs include iOS logs that have a Beta Indentifier number. This is found at the top of logs where apps installed are referenced.

Beta Identifier:  XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX

Additionally, there will be the mention of titles like "legacyInfo", "trialInfo", "rollouts", "rolloutId", "factorPackIds", "deploymentId". As well as "experiment" information towards the bottom of some logs with some of these titles: "treatmentId", "experimentId", "deploymentId".

On macOS you can capture logs in the Terminal.app (a good time is immediately after startup) using the command:

sudo log show --info --debug  --last 2m

Please don’t bother replying with negativity. Users have a right to enquire when they feel something is not right on their tech, those responses are unhelpful and frankly, tiresome.

Thanks LotusPilot, it updated to 16.4 and I reset again using:

Settings > General > Transfer or Reset iPad > Erase All Content and Settings

Didn't use any backups and didn't install any apps, same logs appeared along with a new one same as above but with iPadOS 16.4

I guess it'll stay a mystery.