iOS Internals · Staying Safe on iPhone · Lesson 5 of 5

Challenge: Rosa's Rough Month

Untangle a fake support call, a rogue profile and a tracker on one iPhone.

Case brief

Your aunt Rosa is a reporter at a local newspaper. She asks you to look at her iPhone, and walks you through her month.

• While reading news in Safari, a page flashed "Your iPhone has 3 viruses" with an Apple Support number. She called it.
• The friendly "agent" sent her to a website to download an "Apple Security Profile". She opened Settings, tapped Install and entered her passcode.
• He then had her go to Settings, General, About, Certificate Trust Settings and turn on the switch for "Apple Security Root".
• Finally he asked for the code that popped up on her screen "to finish the scan". She hung up instead.

Rosa says the profile listed a VPN, a certificate and a home screen icon. Use what you learned in this course to work out what happened.

Cleaning up

Rosa wants the profile gone today. She's the only person who has used her phone, and it isn't managed by her newspaper. You find the profile on the screen that lists everything installed on the device, tap Remove Profile, enter her passcode and restart. Since she may have typed her Apple Account password into a page the agent showed her, you also change it and confirm two-factor authentication is on.

An alert on the drive home

Two weeks later, Rosa is driving home alone at night when her iPhone shows AirTag Found Moving With You. The map shows red dots along her route for the past three days. She pulls into a busy, well-lit gas station and calls you. She's frightened and wants to make the tag stop reporting right now. She has no idea who might have hidden it in her car.

Planning ahead

A month later, Rosa starts investigating a powerful public official. She hasn't received any Apple threat notification, but she has good reason to think she could become a target for mercenary spyware. A colleague suggests Lockdown Mode, and Rosa is happy to live with blocked links and attachments in Messages. Her newspaper's IT team, meanwhile, plans to enroll her iPhone in the paper's MDM next week so she can get work email.