0

I suspect the "Phoner" app from the Apple App Store compromised my iPad along with the device's IMEI.

After accepting a phone call on the iPad (I later found out to be a Google-generated listing), I noticed that the call record function that usually required me to push a button to start has turned itself on automatically. Now every time I place or receive a phone call the record button comes on by itself automatically.

Since this issue started, all email I've sent to certain addresses from my iPad have not been received and I am not receiving email from certain address.

I contacted the Phoner tech support, they state they have never seen a case like this before.

What steps can I take to find out if the Phoner app and/or my IPad have been compromised?

schroeder
  • 129,372
  • 55
  • 299
  • 340
RandallK
  • 1
  • 1
  • 1
  • 1
    Have you jailbroken your iPad? – lungj Jun 30 '17 at 02:19
  • 1
    Do you want to know if it has been hacked, or how to deal with it? If it was me, I'd just reset the device. – schroeder Jun 30 '17 at 10:51
  • You can install antivirus from prominent antivirus vendor to try out your luck. An expert is required to perform a throughout inspections. Perhaps you should backup your stuff and go to a safe system to reset your password, and then hard reset your ipad. – mootmoot Jun 30 '17 at 11:40

1 Answers1

-2

Set up a trap

This requires some social engineering:

  1. Send an e-mail with a shortened link to a mail adress you suspect of being monitored (you could use https://grabify.link/ for instance), make it intriguing.
  2. If your mails are monitored chances are good that your attacker will click on that link, to see what information you want to share.
  3. Via the tracking tools of your chosen link shortening service, you can now track the IP adress of everyone that clicks your link.

While this might not fix the security issue on your iPad, you might get an idea if your device has been compromised.

EDIT: I have not tested grabify myself and cannot vouch for its trustworthiness.

Tom K.
  • 7,976
  • 3
  • 32
  • 53
  • Some explanation for the downvotes would be nice. – Tom K. Jun 30 '17 at 12:27
  • Didn't downvote; it's a clever trick IMO but doesn't provide certainty that his ipad has been hacked. If the attacker doesn't fall for it, OP still has unanswered questions (or worse, incorrectly assumes that he's in the clear). – Ivan Jun 30 '17 at 14:47
  • True, but I think this is as far as you can get with a device like an iPad where all source code is closed and analytics tools a scarce. – Tom K. Jun 30 '17 at 17:15
  • This is unlikely to work in most cases. Not all instances of covert monitoring involve a person actively reading through everything and clicking on links. Most of the time it's fairly automated, with only certain keywords or regex pattern matches alerting the actual hacker. Because of this, I don't think it is possible to claim that this answers how to "tell with certainty" if an iPad has been hacked. – forest Jul 25 '18 at 02:20