Removing Mobile Device Wiretaps

Removing Wiretaps Off Mobile Devices

During an authorized security assessment, "wiretap" on a mobile device can mean several things: stalkerware installed by an abusive partner, enterprise MDM monitoring, a malicious app with excessive permissions, a compromised device via a sophisticated implant, or even a network-level interception. I'll cover detection and removal for each category, with evidence preservation as a priority — if this has legal implications, the forensic trail matters as much as the removal itself.

First: Isolate & Preserve Evidence

Before removing anything, capture the current state. If this is part of an investigation or will become a legal matter, the forensic image is your single most important asset.

Full Filesystem Extraction (Android)

bash

# ADB backup (non-root, limited but non-destructive):
adb backup -apk -shared -all -system -f forensic_backup.ab

# If rooted, full DD image over ADB:
adb shell
su
dd if=/dev/block/mmcblk0 of=/sdcard/full_image.img bs=4096
# Pull the image:
adb pull /sdcard/full_image.img

# Or use custom recovery (TWRP) to take a full nandroid backup
# Boot to recovery → Backup → Select all partitions → Store on external SD

Full Filesystem Extraction (iOS)

bash

# iTunes-style backup (encrypted to preserve Keychain data):
# On macOS/Linux with libimobiledevice:
idevicebackup2 backup --full /path/to/backup/directory

# Check for supervision and MDM profiles first:
ideviceinfo | grep -i supervis
ideviceprovision list

# For jailbroken devices, SSH in and dump:
ssh root@<device_ip>
tar czf /tmp/full_fs.tar.gz / 2>/dev/null
# Pull the archive

Network Capture

Set up a packet capture to record what the device is phoning home to:

bash

# On your analysis machine, create a WiFi hotspot and route through a capture interface:
tcpdump -i wlan0 -w device_traffic.pcap host <device_ip>
# Or use mitmproxy for application-layer inspection:
mitmproxy --mode transparent -w traffic.flow

Keep the device in airplane mode until you're ready to capture. When you enable network, record everything. The first 60 seconds after connectivity is restored typically show the most revealing beaconing behavior from spyware.

Stalkerware - Consumer Spyware

This is the most common "wiretap" scenario. Products like mSpy, FlexiSPY, Spyzie, Cocospy, Hoverwatch, TheTruthSpy, Cerberus, and XNSPY are marketed as "parental monitoring" but are widely used for non-consensual surveillance of partners and employees. They're installed with physical access to an unlocked device.

Detection — Android

Check for known stalkerware packages:

bash

adb shell pm list packages | grep -iE "mspy|flexispy|spyzie|cocospy|hoverwatch|thetruthspy|xnspy|cerberus|spyera|spytomobile|mobiletracker|phonetracker|copy9|isms|kidsguard|pcTattletale|ownspy|spyphone|highster"

Check accessibility services (stalkerware abuses these to read screen content):

bash

adb shell settings get secure enabled_accessibility_services
# Look for anything that isn't a legitimate accessibility app

Check device admin permissions (stalkerware often registers as device admin to prevent uninstallation):

bash

adb shell dumpsys device_policy
# Look for suspicious packages in the "Active Admins" list

Check for apps that can draw overlays (used for phishing and keylogging):

bash

adb shell appops get-op android:system_alert_window | grep -i "MODE_ALLOWED"

Check unknown certificates (stalkerware often installs CA certs for TLS interception):

bash

adb shell
su -c 'ls /data/misc/user/0/cacerts-added/'
# Any .0 files here are user-installed CA certificates

Manual indicators on Android:

• Settings → Accessibility → Installed apps. Anything you don't recognize?

• Settings → Security → Device administrators. Anything unexpected?

• Settings → Apps → Three dots → Show system. Look for apps with generic names ("System Update," "WiFi Service," "Device Health") that you didn't install

• Settings → Battery → Battery usage. Unknown apps with high background usage?

• Does the phone get warm when idle? (spyware doing CPU work in background)

• Unusual data usage from "Android System" or unnamed processes

• Settings → Apps → Special app access → Notification access. Spyware often reads notifications.

Detection — iOS

Check for MDM profiles or supervision:

Settings → General → VPN & Device Management

Any profiles listed here that you didn't install are suspect.

Check for configuration profiles (even hidden ones):

bash

ideviceprovision list
# Look for provisioning profiles from unknown sources

Check for enterprise apps (sideloaded outside App Store):

Settings → General → VPN & Device Management → Enterprise Apps

Check for Shortcuts automations (can be used for exfiltration):

Shortcuts app → Automation tab. Look for automations that trigger on app open, location change, or time of day.

Jailbreak detection (stalkerware often requires jailbreak on iOS):

bash

# Check for Cydia, Sileo, or Zebra on the home screen
# Check for common jailbreak files via SSH (if accessible):
ls /Applications/Cydia.app 2>/dev/null && echo "JAILBROKEN"
ls /usr/sbin/sshd 2>/dev/null && echo "JAILBROKEN"
ls /Library/MobileSubstrate 2>/dev/null && echo "JAILBROKEN"

Manual iOS indicators:

• Battery draining faster than normal

• Device warm when idle

• Unexplained data usage

• Screen lights up randomly (spyware activating microphone or GPS)

• Strange background noise during calls

• SMS messages to unknown numbers (some spyware uses SMS for C2)

Removal — Android

Step 1: Remove device admin privileges

bash

adb shell dumpsys device_policy | grep "com." 
# Find the suspicious package
# Go to Settings → Security → Device Administrators → Deactivate it
# Or via ADB:
adb shell dpm remove-active-admin com.suspicious.package/.AdminReceiver

Step 2: Remove accessibility permissions

Settings → Accessibility → [Suspicious app] → Turn off

Step 3: Uninstall the app

bash

adb uninstall com.suspicious.package
# If it refuses (device admin), revoke admin first, then:
adb shell pm uninstall -k --user 0 com.suspicious.package

Step 4: Remove any CA certificates installed by the spyware

Settings → Security → Encryption & Credentials → Trusted Credentials → User
→ Remove any unknown certificates

Step 5: Check for persistence mechanisms

bash

# Look for auto-start receivers:
adb shell dumpsys package com.suspicious.package | grep -A5 "Receiver"
# Check for suspicious entries in /data/local/tmp/:
adb shell ls -la /data/local/tmp/
# Check init.d scripts if rooted:
adb shell ls -la /etc/init.d/ 2>/dev/null
adb shell ls -la /system/etc/init.d/ 2>/dev/null

Step 6: Factory reset (nuclear option)

If you can't be certain the spyware is fully removed, a factory reset from recovery mode (not from Settings — some spyware survives Settings-based reset) is the only guarantee:

Power off → Hold Volume Down + Power → Recovery mode → Wipe data/factory reset

Flash the factory image with Odin (Samsung) or fastboot (Pixel, others) for complete assurance.

Removal — iOS

Step 1: Remove MDM profiles

Settings → General → VPN & Device Management → [Profile] → Remove Management

This will remove the profile and any associated restrictions. The device may prompt for a password if the MDM is enforce-protected.

Step 2: Remove configuration profiles

bash

ideviceprovision list
ideviceprovision remove <profile_uuid>

Step 3: Remove suspicious enterprise apps

Settings → General → VPN & Device Management → [Enterprise App] → Delete App

Step 4: Remove Shortcuts automations

Shortcuts → Automation → Swipe left on suspicious automations → Delete

Step 5: Check for and close backdoors

• Change Apple ID password immediately

• Enable two-factor authentication

• Review trusted devices (Settings → Apple ID → scroll down)

• Review trusted phone numbers

• Check for unknown Recovery Contacts (iOS 15+)

• Check Face ID / Touch ID enrolled faces/fingerprints

Step 6: Remove jailbreak (if present)

RootFS restore via the jailbreak app (unc0ver, Taurine, Dopamine, etc.) if available, or restore via iTunes/Finder in DFU mode:

Connect to computer → Volume Up, Volume Down, hold Power → DFU mode → Restore

Using Automated Detection Tools

TinyCheck (Kaspersky / open-source community fork): A Raspberry Pi-based tool that analyzes a phone's network traffic to identify stalkerware C2 communication patterns. Non-invasive — the phone connects to TinyCheck's WiFi hotspot and TinyCheck observes where it tries to call home.

MVT (Mobile Verification Toolkit) — Amnesty International: The gold standard for forensic analysis of mobile devices for spyware:

bash

pip install mvt

# Android:
mvt-android check-backup /path/to/android/backup/
mvt-android download-apks --output ./apks/

# iOS:
mvt-ios decrypt-backup -p <password> /path/to/encrypted/backup/
mvt-ios check-backup --output /path/to/output/ /path/to/decrypted/backup/

MVT checks for known indicators of Pegasus, Predator, and other sophisticated spyware, as well as consumer-grade stalkerware. It produces a JSON report of all findings.

iMazing (commercial): Can detect Pegasus and other spyware indicators on iOS. The free version includes the spyware detection module.

Enterprise MDM / UEM Monitoring

The user said they're authorized for a pentest. This could mean they're testing whether MDM can be removed, or they've been asked to remove legitimate MDM from a device.

Detection

bash

# Android:
adb shell dumpsys device_policy
# Look for "Device Owner" or "Profile Owner"

# iOS:
ideviceinfo | grep -i "supervis"
# "Supervised: true" means the device is institutionally managed
ideviceprovision list

Removal

Android MDM removal depends on the enrollment type:

• Profile Owner (work profile): Settings → Accounts → Remove work profile

• Device Owner (fully managed): Factory reset is typically the only option. The MDM may enforce FRP (Factory Reset Protection) which requires the enterprise Google account.

• COPE (Corporate-Owned, Personally Enabled): Same as Device Owner — factory reset with enterprise credentials.

Testing MDM bypass is an authorized assessment activity. Can the user remove the work profile without authorization? Can they factory-reset from recovery without triggering FRP? These are legitimate pentest objectives.

iOS MDM removal:

• Settings → General → VPN & Device Management → Remove Management

• If the MDM profile is non-removable (enforced by Apple Business Manager), you cannot remove it without the MDM server's release command or a DFU restore — and ABM will re-enroll the device after restore if it checks in during Setup Assistant.

Commercial Spyware / APTs - Pegasus, Predator, Etc.

This is the most serious category. NSO Group's Pegasus, Cytrox's Predator, QuaDream's Reign, and similar tools are used by nation-states. Detection and removal are fundamentally different from stalkerware.

Detection — Pegasus / FORCEDENTRY Indicators

MVT (Mobile Verification Toolkit) is the primary tool:

bash

mvt-ios check-backup --output ./mvt_output/ /path/to/decrypted/backup/
cat ./mvt_output/*.json | jq '.[] | select(.severity == "CRITICAL")'

MVT checks for:

• SMS/MMS messages containing exploit links (FORCEDENTRY used zero-click iMessage exploits)

• Known malicious process names in crash logs

• Timeline anomalies (SMS received at time X, Safari process spawned at time X+2 seconds)

• Known Pegasus domain lookups in network usage data

• Modified system files with known-bad hashes

Manual indicators:

bash

# On iOS, check for suspicious daemons (jailbroken device):
ps aux | grep -iE "pegasus|predator|finspy|reign"

# Check network connections:
netstat -an | grep ESTABLISHED

# On iOS 14+, check for com.apple.sysdiagnose modifications:
ls -la /var/mobile/Library/Logs/CrashReporter/
# Look for .ips files with unusual process names

# Check sysdiagnose output:
# Settings → Privacy → Analytics & Improvements → Analytics Data
# Look for entries with "Jettisoned", "exc_resource", or unusual process names

Removal — APT-Grade Spyware

There is no reliable self-removal for APT-grade spyware. Pegasus can survive reboots, iOS updates, and in some cases even factory resets (if it has persistence in the baseband or other firmware components).

The only reliable method is device destruction and replacement. This is not hyperbole. For Pegasus specifically:

1. Do not use the device. Turn it off completely. Remove the SIM.

2. No backups. Do not restore from a backup of the infected device — Pegasus has been shown to re-infect from restored backups.

3. Ideal path: DFU restore with a full firmware re-flash using an IPSW downloaded on a clean computer. Set up as new. Do not restore from backup.

4. Even then: Pegasus exploits were delivered via zero-click iMessage. If your Apple ID is still tied to the same phone number that was targeted, you could be re-infected simply by receiving another iMessage to that number on the restored device.

5. For the assessment report: Document that the device is compromised at a nation-state level. Recommend device destruction, new phone number, new Apple ID, and a clean start. This finding is CRITICAL severity.

Network-Level Wiretap (IMSI Catcher / SS7)

The "wiretap" may not be on the device at all — it could be at the network level.

Detection

IMSI Catcher (Stingray / cell-site simulator):

bash

# Android — check current cell info:
adb shell dumpsys telephony.registry | grep -i "mCellInfo"
# Look for: unusually strong signal on an unknown cell ID, LAC/CID that changes frequently, forced downgrade to 2G/3G

# SnoopSnitch (Android, requires root + Qualcomm chipset):
# Installs and monitors for IMSI catcher indicators
# Available on F-Droid

# AIMSICD (Android IMSI Catcher Detector):
# Open-source, monitors for silent SMS, LAC changes, signal anomalies

SS7 interception (network-level):

This is invisible to the end user. Your carrier's SS7 infrastructure is being abused to reroute calls and SMS. Detection requires:

• Calling your own number from a known-clean line and verifying the audio path

• Sending encrypted test messages (Signal, WhatsApp) and verifying endpoints

• Engaging the carrier's security team directly

If you suspect SS7 interception, this is a carrier-level problem, not a device-level one. The carrier must investigate their SS7 firewalls.

Mitigation

• Use end-to-end encrypted communication (Signal, WhatsApp) — SS7 interception can re-route calls but cannot break E2E encryption on data messages

• Disable 2G on the device (Settings → Network → Preferred network type → LTE/5G only). Many IMSI catchers force downgrade to 2G because it has no mutual authentication.

• Enable Silence Unknown Callers (iOS) or use a call screener (Android) to reduce the risk of silent/beacon calls

• Use an eSIM — harder to clone than a physical SIM

Hardware Implants - Physical Wiretaps

A physical implant (modified battery, chip soldered to the motherboard, inline microphone/camera module) is rare but possible in high-stakes scenarios.

Detection

Visual inspection:

• Open the device. Look for:

  • Solder joints that don't match factory quality (cold joints, excess flux, different solder color)

  • Additional chips or boards that aren't in teardown photos of the same model

  • Wires or flex cables that don't connect to anything on both ends

  • A battery that's thicker than expected (extra cell + monitoring circuit)

  • Microphone or camera module that doesn't match factory parts

Thermal imaging:

• A Flir or thermal camera can identify hotspots from active implant electronics while the phone is "off"

• Some implants draw power from the battery even when the phone is shut down

RF detection:

• A spectrum analyzer or HackRF can detect unexpected RF emissions from a dormant phone

• Turn the phone completely off, place it near a wideband SDR, and look for any transmissions in the 400 MHz – 6 GHz range

X-ray inspection:

• If available, an X-ray image of the device reveals non-factory components immediately

Removal

Physical implants must be physically removed. This requires micro-soldering skills and a rework station. Replace any modified components with factory parts. Document everything photographically — this is evidence.

Post-Removal Hardening

After removing whatever was on the device, harden it to prevent re-compromise:

Android

bash

# Disable installation from unknown sources:
adb shell settings put global install_non_market_apps 0

# Enable Google Play Protect:
adb shell settings put global package_verifier_enable 1

# Revoke accessibility services for all but trusted apps
# Settings → Accessibility → Review and disable

# Enable encryption (should be on by default on modern Android):
adb shell getprop ro.crypto.state

# Lock bootloader (wipes data — backup first):
adb reboot bootloader
fastboot oem lock

# Check SafetyNet / Play Integrity:
# Many spyware-modified devices fail integrity checks

iOS

- Enable Lockdown Mode (Settings → Privacy & Security → Lockdown Mode)
    This blocks most exploit vectors including iMessage attachments,
    unknown FaceTime callers, wired connections when locked, and
    configuration profile installation. It's designed to stop Pegasus-class attacks.

- Enable iCloud Advanced Data Protection (end-to-end encrypted backups)

- Disable iMessage if not needed (primary Pegasus vector)

- Review and remove:
    - Unknown configuration profiles
    - Unknown VPN configurations
    - Unknown MDM enrollment
    - Unknown Shortcuts automations
    - Unknown Face ID appearances

- Enable "Erase Data" after 10 failed passcode attempts

- Change Apple ID password + enable hardware security key (YubiKey) for 2FA

The Assessment Report - What To Document

For your authorized pentest report, structure findings by severity:

Finding	Severity	Evidence
Stalkerware app found, exfiltrating SMS + GPS to known C2 in [country]	Critical	MVT report, PCAP showing C2 beaconing, app package name + hash
User-installed CA certificate enabling TLS interception	High	Screenshot of certificate store, affected domains list
Accessibility service abuse by non-accessibility app	High	dumpsys output, app name + permissions list
MDM profile installable without authentication	Medium	Screenshot of profile installation flow, missing authentication gate
Device susceptible to 2G downgrade attack	Medium	SnoopSnitch output, carrier lacks 2G disable option
No hardware implants detected after visual, thermal, and RF inspection	Informational	Inspection photos, thermal images, spectrum waterfall

For each finding, include:

1. Reproduction steps — exactly how you found and verified it

2. Impact — what data was being exfiltrated, to whom, for how long

3. Removal steps — what you did to remove it

4. Persistence check — how you verified it's actually gone

5. Remediation recommendation — what the organization/user should do to prevent recurrence

Quick Decision Guide

Symptom	Most Likely Cause	First Action
Battery drains fast, phone warm, high data usage	Stalkerware app	Run MVT against a backup, check accessibility services and device admins
Unknown MDM profile, "This iPhone is supervised"	Enterprise MDM or unauthorized MDM enrollment	Check with IT department. If unauthorized, remove profile and investigate.
SMS messages to unknown numbers	Stalkerware SMS C2	Capture PCAP, identify C2, isolate device from network
Strange background noise in calls	Call recording spyware	Check accessibility services, check for apps with microphone permission
Device downgrades to 2G in certain locations	IMSI catcher (Stingray)	Install SnoopSnitch or AIMSICD, document LAC/CID changes
Received suspicious SMS/link, didn't click, but device acting strange	Zero-click exploit (potentially Pegasus)	Run MVT immediately. Do not use device. Contact incident response.
Apps you didn't install appearing on home screen	Device compromised, remote app install	Airplane mode, forensic dump, then factory reset from recovery
Camera light flashes briefly when not using camera	Spyware capturing photos	Check camera permission for all apps. Revoke all. Run MVT.

Final Thoughts

This covers the spectrum from consumer stalkerware to nation-state implants. The critical point for your engagement: preserve forensic evidence before removal, document the chain of custody, and never assume a single pass of removal was sufficient — verify with network monitoring after removal to confirm C2 traffic has stopped.