MDM on personal iPhone - Businesses, unauthorized developer activity HELP!

I am a personal 'User' I have cycled through many hours and days with support. No one knows what is going on. Most likely because I am never able to speak with someone that understands the Enterprise platform. I feel this is happening via my carrier- but Fraud sent me to Tech support. Tech support told me my phone is hacked and to file a police report.

In combination I suspect that MDM is a gateway for an external developer to access my phone via various methods: webkit, Xcode, Apple Store Connect, SDK

I am about 99.99% sure I know why, but that is something that I will not disclose because most likely all of my activity is monitored; despite the very strict privacy settings I try to maintain.


Symptoms:

  1. My apps will sometimes tell me they did not come from the App Store (Maps, FindMyiPhone, etc..)
  2. When I make an attempt to chat with Apple support I receive a message to Use Messages to Connect with Business. When I have my iPhone in LOCKDOWN mode I receive a message that I cannot use Messages for Business when my device is locked down.
  3. I only have one device. However, I am sharing across devices- many times or I have the option to. The choice is not grayed out.
  4. I am unable to perform an Emergency Reset because I am usually sharing something - Notes, Home, Health, Books....
  5. I do not use iCloud Drive due to multiple security concerns. Almost every time that I double check those settings apps show that they are using iCloud Drive. (Game Center, Health or Fitness, Notes, Books, Apple Support, Wallet) While clicking to turn OFF syncing I have had a battle with it changing right back before my eyes. (I have screen recordings)
  6. Game Center will come on even though I have strict Screen Time settings.
  7. I am generally either sharing, or my phone is gathering data from Health; even though that privacy option is supposed to keep that from happening.
  8. Sometimes I am unable to even sign out of my phone due to 'restrictions'.
  9. I have 'Share with Family' sometimes

*Those are only a few symptoms. That is minus the horror I see from the extraction of information I backed up into Kali Linux

As I have mentioned I have spent many many many hours with Support. One Senior Director did spend time Googling the services that show up in my Analytics. I have even uploaded screen shots and documents, but I never heard back.

I REALLY REALLY need help here.

I will add attachments. They won't be nearly the amount I have. I am begging!!!



iPhone 13, iOS 16

Posted on Apr 2, 2023 2:32 PM

Reply
Question marked as Top-ranking reply

Posted on Jul 24, 2023 11:49 AM

Part 3, they have also done Siri searches on community! I was not aware Siri could do such things. My scenarios like health data is just like yours! Same with all, Game Center, iCloud (which I never used before), also frequent views of calendar, photos, notes and more. Plus many scripts under shortcuts. Beware of running these scripts. You can view them by clicking on the ellipse or “…” note that some words may sound innocent, but the actual full coding is usually stored in a cloud (not iCloud). Some of these scripts also allow full remote control. SSH over port 22 was used to access the network, I gather to expand beyond what the MDM could do, such as installation of a hidden key-logger, found in registry of a windows PC.


I would not openly identify who you suspect, it is perfectly legal (from what I understand, but I’m not an attorney) to identify a suspect, but you might be wrong, and you don’t want to damage someone’s reputation (or I don’t). Especially if you once cared for this person. It’s likely someone you were very close to at some point, and they could have had a key to your home.


So read, study, beg for help, hire pros, new equipment and you will be wasting time and money! Although I’ve learned more than I ever wanted to know about Apple security.


Oh, another “hacking event” with Apple seemed to show up as a 44 page document on my iPhone (were they helping me? Not sure. But it was a guy named Hinchy (I think) vs NYC, this guy was selling Spyware under the guise of Parental Control Software, a 44 page document. He was fined $440k in court. And I should add that I can’t delete notes anymore, the options are removed.


Anyway, with so many issues it’s hard to stay focused. The point of the summarized and difficult to find hacking incidents is to provide absolute proof to authorities in hope of getting this to stop.


So, collect data, document, locate hidden apps, (many are free and impossible to remove). Try to provide brief summarized readable by anyone information (you can add details behind that data) by category (email, apps, settings, rogue connections, unwanted changes, if applicable fraud, credit card applications (freeze credit) and so on. Most people don’t read more than the first page! Keep in mind that everything is monitored. Apple must keep data for 10 years, some for 20 even though most reps deny that fact. After you have a reasonable amount of data, provide this info to local authorities. But first find out if the local Sheriffs Department will help, I’ve read they are more likely to help with a subpoena than police. The subpoena will not be accusatory or cause the attacker to get charged, but you could request a restraining order.


And, scan house for active devices, almost all IoT contain no security or very little, my Rokus were compromised! The data was viewable on the router. Check out Wi-Fi connections listed under Wi-Fi. There is a way to view the password on devices that have previously connected, look that up I don’t want to post here! Look for rogue managed hotspot, include that with documentation. Anything that has been brought into your home is likely compromised, even things that were not set up. Smart TVs and sound bars for TVs can be compromised. Go to a public network and look at your email and accounts, view source, I’ve found many pages of creation of a fake email “pass through” page that restricts the view source function on MDM. Keep in mind that public Wi-Fi is generally not safe. But at this point you are already compromised. The MDM uses “web clips” you may have noticed this being used under certain apps, some are valid, some are not. But the MDM does not use Safari to browse, it uses web clips! This enables site blocking, removal of tool bars, and fake pages.


On email, in Apple and other mail, there are automatic deletes, password resets, security vender emails, monitoring alerts, much more! Especially if a premium support option has been added. Look at shortcuts, fake emails can be sent from shortcuts with your email address. Under shortcuts, go to the bottom, type in email or message, one will say send email or message, try sending yourself one, see results. Beware of executing any script, many do much more than what’s stated, search on bottom for ssh, if it’s been used, it will show up. Apple apps provides programs that allow the user to create scripts using several different programming languages. Search on App Store to see this app. It’s not the library, but the one that specifically provides the ability of SSH, CMD, and others.


And realize even if you harden your firewall this can be circumvented with the hotspot, bypassing rules.



Similar questions

160 replies

Nov 18, 2023 5:28 PM in response to AgentDragonfly

I’ve been dealing with similar since 2019. However I had a group of high tech hackers move in next door.


I’ve called in/went into the provider store too many times to count regarding this “MDM” issue and many of the things you’re dealing with and have been told that yep I can’t be hacked but if you search online with words “hacker placed men on my iPhone”, or “iPhone hacked”, you’ll find legitimate tech sites showing that apple knew about the problem back even as far as 2015.

There is also the issue of some using Microsoft Azure to do some control but if you go onto your Apple ID and search for system status then look for developer status, you’ll see if you’ve been linked to Apple’s business software or schooltime etc. you may get lucky and be able to click and see exactly the developer that is connected to them. That may help.

Dec 6, 2023 11:30 AM in response to EllieDolanStl

EllieDolanStl wrote:

Any advice? I can’t trust anything.

This sounds quite serious so here's my 2 cents.. It's not possible to know what's going on with just the info you provided and anything's possible, but for starters, I do have a question about your statement "They are constantly in my iCloud account doing things like disconnecting my eSim, leaving creepy photos of me". Leaving creepy photos is a fairly uncommon thing to report in these type situations and such an occurrence would no doubt be very creepy. Can you give any other info on this? Are you absolutely positive that you aren't taking the pictures on accident, or moving a file to another location and not realizing it? Have you considered the possibility of medical illness which may make you forget certain actions that you yourself are actually responsible for? Remember it'd be impossible to know unless you do something like set up a camera to record everything for later review. Do you have any reason to believe the government keeping tabs on you? Have you ever done anything that may have been perceived as a potential marker for terrorist activity? Visiting extremist websites, participating in discussions, or share a home network with anyone who may have done something to that effect? Regardless of your own personal beliefs or reason for viewing such content. For example did you have some school assignment related to terrorism and visited a few too many websites in your studies? Consider your value as a target to a state-sponsored actor or any individual..why would they want to do something like this to you? If you can't find a reason like for example you're a high net worth individual, an activist, a potential extremist, you had lots of jilted lovers, etc., then the alternative may very well be that you are mistaken and your brain is understandably misinterpreting things that may be fairly ordinary events as a response to some legitimate things you witnessed that evidence some network intrusion you've suffered.


Take for example the other part of "they are constantly in my iCloud account doing things like disconnecting my eSim". There may very well be a problem with your eSim it could even be hacking related but your eSim and your iCloud account are not of much relation to each other. You may be observing certain events and misunderstanding what is actually happening. It's not going to be possible to know from the info you can provide via this forum but I am fairly certain you are misunderstanding some things and are describing others that are clear evidence of a problem. Knowing the difference can be difficult and is nearly impossible when you yourself are the victim.



Now what can you really do about it? Change all of your passwords to everything and write down your updates on a piece of paper. Then sign out of all your accounts everywhere. You need to take all of your bluetooth and internet capable electronic devices and all files you own and disconnect them from their power source then safely store them for some distant date for possible data recovery or investigation. Contact your mobile phone company somehow like in-person at the store and cancel your phone service and store your phone as well with the rest of the hardware. Physically disconnect all batteries. Be sure you've purged everything for a period of time like a few days to make sure. Move away from any compromised devices outside your control. Purchase new devices once safely away from all other potentially compromised devices and set up new accounts including email. Do not use cloud services to store data. Do not use suggested passwords, eydfcrare too quickly cracked and only provide the illusion of a secure password. Passwords don't need to be extremely complex or overly long, just slightly more complex than the typical suggestions. Minimize exposure to networks and networked devices as much as possible.


This will probably help you but for most people it's nearly impossible. One important thing is that once a device has been compromised there is often nothing that can be done. Maybe this is why you've encountered such little help bout all this. After all, what do you want them to do..give you new iPhones and MacBook Pros?


But really at the end of the day what are these people getting from you? Have they stolen your money? If not, well then your privacy was never really promised anyway. It's the internet, it's inherently insecure. Security is often times severely lacking and falsely claimed so unless you have invested the time and resources to create it and are aware of limitations, it doesn't exist. The lies companies will tell you about the superiority of their products are only lies if know the truth, which few people do and when they learn it it can be shocking and disillusioning. Panicked responses typically makes someone stand out from the crowd and then victim to ostracization.

Feb 18, 2024 11:07 AM in response to EllieDolanStl

I’ve had many similar issues. Look up very technical precise description from JMurphyCO and responses. Like yourself, I’ve learned that replacing all devices does not help. Search for “MDM” with wildcards on your PC/Mac. But knowing you have apps (including many hidden) does not remove them. I have contacted the Apple 3rd party venders to get some removed or disabled. But most apps remain.

Feb 21, 2024 8:45 AM in response to Katefromouterspace

You might want to run a System-diagnostic check on your device. If you google “how to do sys-diagnostic test on iPhone with touch assis.” It catches “leaks” on some of the processes running and you’ll see it’s easy to do and well worth what you’ll find running on your device. This can help you decide what kind of services you’ll want to look for. You could be right that part of the security intrusion has to do with your location. This diagnostic check revealed an unbelievable amount of security breaches and surveillance activity. A stingray device collecting and filtering all my communications. I would be interested to see what others find hidden in their devices and networks with this check.


Mar 1, 2024 3:09 PM in response to katiebeth_19

Hi Katie,


it sounds like your already on the right path with blue tooth and your apple id. If you buy a new phone, dont use any of the old apple ids you have had, be careful of email and sms attacks and most of all, make sure no settings can be changed while your phone is locked / unattended. and of course wifi too, if you haven't check out apple developer programs, basically all they need is your apple ID and device numbers and access to your phone when they have the password. Your in it for the long haul, but don't fret - you'll get there!


J.

Mar 23, 2024 11:28 AM in response to gravityfed

i've had same issue senior support hangs up on me een sealing with this for 5 years now had 5 brand new iphones quit working an ipad as well support sets up a call from senior advisor i explain issue and soon as i do they hang up on me currently out over 10,000 dollars in brand new personal iphones .hired a private investigator team and all information they have collected goes all the way back to a developer from apple hacking me and trying to blackmail me for 1500 dollars for some reason they tracked the call back to austin texas and next week they are flying there to confront the developer who did this wish me luck this is a major fraud and cyber theft issue and will hopefully end up throwing developer in prison and refunding all my money i've been ripped off for for last 5 years but we will see next week just wish the developer would of came forward on there own and turned themselves in but we will see come next week have documented everything since day one 5 years ago

May 17, 2024 7:56 PM in response to AgentDragonfly

Me too! All of the above. And they use Xcode & DT tools to make “user” & bundle versions of my apps to manipulate the settings that I can change. Use a lot of open source software. I believe that somehow they’re using my biometrics because sometimes my face scans only when I open up settings altogether. Which I’m sure they’re using somewhere else. Whenever I use screen time settings for and need more time, it always asked me twice. Like there is two screens. I find that it’s being mirrored to a PC and doing all kinds of things and has known about this since, November September 2022 and can’t get any help. Scary. The police said I called out over 10 times because they were coming. My home also only advised me to make a IC3 complaint. Which I made one back in 2022 and took screenshots of it. It made another in 2023 and that pages are different. Every site I visit is different than it should be, be acceptable. We spend on these devices and for their service just for people to steal them and have more access than we do.


also, if you have T-Mobile and it says in cellular settings that your plan is whitelist and regular usage. That means it’s only tallying and adding up the usage that is not streaming. So that is an in accurate amount of data it shows used. I went from 182 GB which I never used anywhere close the month before it turned to white and regular and then it went back to normal around 50.

Apr 4, 2023 11:04 AM in response to celliott147

Unfortunately I have tried everything & Apple Support has had to Google most of the terms I see in my Analytics

I dont live near an Apple store, but if that is a real possible solution I am open to a road trip. I would rather not go on a road trip only to find out not even they can figure it out

In this picture I am sharing ‘Home’ which I do not even have a device, and I uninstalled home. Usually, I am also sharing ‘notes’ ‘books’ and ‘health’ too

Apr 30, 2023 6:40 AM in response to AgentDragonfly

I am going through the same struggle. You were probably not actually on a phone call or chat with the legitimate Apple support, usually when you contact you will get a confirmation email of your contact. I also got elevated to the “Senior Technician” and I got suspicious and started asking questions and he hung up. That was from a “chat” and then the person typing said their supervisor would ring me straight back. Another time I was calling the correct number from my iPhone using the legitimate Apple website number, she asked for my AppleID and then tried to get me to screen share (did not ID me other than my email address) so I hung up.


I ended up taking in to the Apple Store my devices which were reset but it hasn’t resolved. From what I have pieced together it has been active for at least a year on my iPhone. The updates have not solved anything. I have never run anything non genuine on it and it’s always been keep updated. Tonight I captured my MacBook Pro kernel launching a buffer overflow to one of the Apple Devices.


I have also had the battle of the off and on settings, although it hasn’t happened on the iPhone in front of me as soon as I close Settings it changes it back.


Unfortunately until more people start kicking up a fuss we are on our own. I’m stuck with thousands of dollars worth of new Apple products that are not in my control.



This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

MDM on personal iPhone - Businesses, unauthorized developer activity HELP!

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.