iForensics - iCompromise

Description

As you pass through customs, the customs officer asks you to hand over your phone and its unlock code. The phone is returned to you a few hours later…

Suspicious, you send your phone to ANSSI’s CERT-FR for analysis. CERT-FR analysts carry out a collection on the phone, consisting of a sysdiagnose and a backup.

To conclude your analysis, find the initial infection vector.

You’ll need to identify :

• the vulnerability used (CVE number);
• the initial infection date (in UTC time, without seconds).

The flag is in the format FCSC{<CVE number>|<infection date>}. For example, if the vulnerability used is CVE-2025-00001 and the infection (UTC) date is 2025-01-01 01:00: FCSC{CVE-2025-00001|2025-01-01 01:00}.

This challenge is part of a serie. The challenges are independent, except iBackdoor 2/2 whitch depends on iBackdoor 1/2:

• iForensics - iCrash
• iForensics - iDevice
• iForensics - iWiFi
• iForensics - iTreasure
• iForensics - iNvisible
• iForensics - iBackdoor 1/2
• iForensics - iBackdoor 2/2
• iForensics - iC2
• iForensics - iCompromise