From 1bb06b7db10376f3f4c9a1f231f63120ed176cc9 Mon Sep 17 00:00:00 2001 From: Redoomed <161974310+redoomed1@users.noreply.github.com> Date: Tue, 16 Jul 2024 11:47:40 -0700 Subject: [PATCH] fix: iVerify Basic link, minor grammar (#2646) --- docs/device-integrity.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/docs/device-integrity.md b/docs/device-integrity.md index 2fdf4d79..d059c770 100644 --- a/docs/device-integrity.md +++ b/docs/device-integrity.md @@ -27,7 +27,7 @@ This means an attacker would have to regularly re-infect your device to retain a If any of the following tools indicate a potential compromise by spyware such as Pegasus, Predator, or KingsPawn, we advise that you contact: - If you are a human rights defender, journalist, or from a civil society organization: [Amnesty International's Security Lab](https://securitylab.amnesty.org/contact-us) -- If a business or government device is compromised: Contact the appropriate security liason at your enterprise, department, or agency +- If a business or government device is compromised: the appropriate security liason at your enterprise, department, or agency - Local law enforcement **We are unable to help you directly beyond this.** We are happy to discuss your specific situation or circumstances and review your results in our [community](https://discuss.privacyguides.net) spaces, but it is unlikely we can assist you beyond what is written on this page. @@ -41,18 +41,18 @@ The tools on this page are only capable of detecting indicators of compromise, n These tools provide analysis based on the information they have the ability to access from your device, and publicly-accessible indicators of compromise. It is important to keep in mind two things: 1. Indicators of compromise are just that: *indicators*. They are not a definitive finding, and may occasionally be **false positives**. If an indicator of compromise is detected, it means you should do additional research into the *potential* threat. -2. The indicators of compromise these tools look for are published by threat research organizations, but not all indicators are made available to the public! This means that these tools can present a **false negative**, if your device is infected with spyware which is not detected by any of the public indicators. Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence. +2. The indicators of compromise these tools look for are published by threat research organizations, but not all indicators are made available to the public! This means that these tools can present a **false negative**, if your device is infected with spyware which is not detected by any of the public indicators. Reliable and comprehensive digital forensic support and triage require access to non-public indicators, research, and threat intelligence. ## External Verification Tools -External verification tools run on your computer and scan your mobile device for forensic traces which are helpful to identify potential compromise. +External verification tools run on your computer and scan your mobile device for forensic traces, which are helpful to identify potential compromise.

Danger

Public indicators of compromise are insufficient to determine that a device is "clean", and not targeted with a particular spyware tool. Reliance on public indicators alone can miss recent forensic traces and give a false sense of security. -Reliable and comprehensive digital forensic support and triage requires access to non-public indicators, research and threat intelligence. +Reliable and comprehensive digital forensic support and triage require access to non-public indicators, research, and threat intelligence. Such support is available to civil society through [Amnesty International's Security Lab](https://amnesty.org/en/tech) or [Access Now’s Digital Security Helpline](https://accessnow.org/help). @@ -88,7 +88,7 @@ Using MVT is insufficient to determine that a device is "clean", and not targete
-MVT is *most* useful for scanning iOS devices. Android stores very little diagnostic information useful to triage potential compromises, and because of this `mvt-android` capabilities are limited as well. On the other hand, encrypted iOS iTunes backups provide a large enough subset of files stored on the device to detect suspicious artifacts in many cases. This being said, MVT does still provide fairly useful tools for both iOS and Android analysis. +MVT is *most* useful for scanning iOS devices. Android stores very little diagnostic information useful to triage potential compromises, and because of this, `mvt-android` capabilities are limited as well. On the other hand, encrypted iOS iTunes backups provide a large enough subset of files stored on the device to detect suspicious artifacts in many cases. This being said, MVT does still provide fairly useful tools for both iOS and Android analysis. If you use iOS and are at high-risk, we have three additional suggestions for you: @@ -162,7 +162,7 @@ Using these apps is insufficient to determine that a device is "clean", and not -Auditor is not a scanning/analysis tool like some other tools on this page, rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious. +Auditor is not a scanning/analysis tool like some other tools on this page; rather it uses your device's hardware-backed keystore to allow you to verify the identity of your device and gain assurance that the operating system itself hasn't been tampered with or downgraded via verified boot. This provides a very robust integrity check of your device itself, but doesn't necessarily check whether the user-level apps running on your device are malicious. Auditor performs attestation and intrusion detection with **two** devices, an *auditee* (the device being verified) and an *auditor* (the device performing the verification). The auditor can be any Android 10+ device (or a remote web service operated by [GrapheneOS](android.md#grapheneos)), while the auditee must be a specifically [supported device](https://attestation.app/about#device-support). Auditor works by: @@ -196,7 +196,7 @@ Using these apps is insufficient to determine that a device is "clean", and not ![Hypatia logo](assets/img/device-integrity/hypatia.svg#only-light){ align=right } ![Hypatia logo](assets/img/device-integrity/hypatia-dark.svg#only-dark){ align=right } -**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud (scans are performed entirely locally). +**Hypatia** is an open source real-time malware scanner for Android, from the developer of [DivestOS](android.md#divestos). It accesses the internet to download signature database updates, but does not upload your files or any metadata to the cloud. Scans are performed entirely locally. [:octicons-home-16: Homepage](https://divestos.org/pages/our_apps#hypatia){ .md-button .md-button--primary } [:octicons-eye-16:](https://divestos.org/pages/privacy_policy#hypatia){ .card-link title="Privacy Policy" } @@ -222,7 +222,7 @@ Hypatia is particularly good at detecting common stalkerware: If you suspect you **iVerify Basic** is an iOS app which can scan your device to check configuration settings, patch level, and other areas of security. It also checks your device for indicators of compromise by jailbreak tools or spyware such as Pegasus. -[:octicons-home-16: Homepage](https://iverify.io/consumer){ .md-button .md-button--primary } +[:octicons-home-16: Homepage](https://iverify.io/products/basic){ .md-button .md-button--primary } [:octicons-eye-16:](https://iverify.io/privacy-policy){ .card-link title="Privacy Policy" } [:octicons-info-16:](https://iverify.io/frequently-asked-questions#iVerify-General){ .card-link title=Documentation}