ACCOUNT TAKEOVER W BANK, EMAIL- they required me to wipe phone/ bur new- question about unknown parent process?

Hi, I’ve had a a rough month with bank of america shuttering my online profile and account because of suspected Device Malware- account takeover it says, and I lost admin privileges to my primary email and Amazon account as well. Figured iOS was unbreachable. I’ve had some odd things happening- remotecloudiu or something caught and stopped in lockdown, and in MC meta showing mdm migration and hidden profiles. Device flickers and crash error 308 repeatedly shows. Avg 40 gb mobile data but last month showed 350 gb. Need some help with analytics or direction.

Payload manifest: bplist00)_OrderedProfiles^HiddenProfiles i_8com.apple.ATT_NR_US.f7eb2f44-daOe-11eb-8349-f45c89abb0d9

mc meta: bplist00Ô_LastMDMMigratedBuild_LastMigratedBuild_&StopFilteringGrandfatheredRestrictions_ AllowedGrandfatheredRestrictionsU21G93Ñ

possible unauth mdm? Sorry I’m clueless!!!

Answered by Connormain122 in 801273022

ADDENDUM TO ABOVE——— it won’t let me add attachment files, or photos, as a reference which ughhh- but I wanted to correct something noted above- lockdown caught a process and warned my iPhone main screen, something CALLED- ‘REMOTECLOUDQUOTAUI”, tried to run in lockdown and Apple gave me an alert preventing the process, whatever it is. I do nothing remote and own no computer.

Also of note: Last week, my cell wouldn’t accept my appleid pin and I got a apple security prompt- asking me to provide the password for “MY OTHER IPHONE” when my device code failed to LOGIN- I’ve HAD Apple ask me similarly, to provide device challenge for password/login for password ‘of my iPad’ on my iPhone, as a security protocol, however I don’t have another, nor couldn’t afford another, iPhone. this didn’t make sense at all.

In sum, I DONT BELIEVE this is an exploit targeting apple and overcoming their architecture and opsec, I’m not rich or famous and barring zero day or Pegasus I don’t see anyone getting through their layers- initial thoughts leaning toward configuration/settings manipulation through Apple ID/cloud access unauthorized , or something in the species of remote admin as a profile (enterprise/admin) without consent. My idiots 2 cents.

Y’all….. II AM LOOKING FOR ANY SUGGESTION, SPECULATION, FEEDBACK OR INPUT- I just want pointed in a direction. Any feedback is SUPER APPRECIATED!! ~ I never knew there existed any manner of intelligence out there I couldn’t reconcile on some basic level with, but cyber/programming/IT is absolutely foreign to me I’m barely afloat realizing I have zero aptitude in this discipline. Respect to those who do.

for Developer interest I’ve pasted my remotec dump state from syslog. Just seems like a lotta REMOTE and UNTRUSTED stuff…….. I know analytics is strictly for pro’s, but I’m in developer arena, so this is a Hail Mary. if anyone has ANY HINT OF A CLUE *** is going on here, please lemme know!!:) much appreciated!

LOCAL DEVICE UUID: 191A01ED-0763-4BA4-95C6-B28CFFDA56B1 Messaging Protocol Version: 3 Product Type: iPad14,11 OS Build: 17.6.1 (21G93) Properties: { AppleInternal => false CPUArchitecture => arm64e ChipID => 33042 EffectiveProductionStatusSEP => true EthernetMacAddress => 28:83:c9:34:e0:e6 HWModel => J538AP HasSEP => true HumanReadableProductVersionString => 17.6.1 ThinningProductType => iPad14,11 IsUIBuild => true RegionInfo => LL/A RestoreLongVersion => 21.7.93.0.0,0 DeviceSupportsLockdown => true EffectiveSecurityModeAp => true SigningFuse => true SupplementalBuildVersion => 21G93 BuildVersion => 21G93 OSVersion => 17.6.1 SensitivePropertiesVisible => true Image4CryptoHashMethod => sha2-384 MobileDeviceMinimumVersion => 1643.100.59 ProductName => iPhone OS ProductType => iPad14,11 SerialNumber => M74J7XG3K2 BootSessionUUID => EC2A6814-F2BF-4057-AF71-7A631E42EA36 BoardId => 22 DeviceColor => 1 EffectiveProductionStatusAp => true EffectiveSecurityModeSEP => true StoreDemoMode => false UniqueChipID => 3467353379086366 UniqueDeviceID => 00008112-000C518A1E78A01E OSInstallEnvironment => false RemoteXPCVersionFlags => 72057594037927942 CertificateProductionStatus => true CertificateSecurityMode => true DeviceClass => iPad DeviceEnclosureColor => 7 ModelNumber => MV6U3 RegionCode => LL SecurityDomain => 1 HardwarePlatform => t8112 Image4Supported => true IsVirtualDevice => false } Services: com.apple.sysdiagnose.remote com.apple.internal.dt.coredevice.untrusted.tunnelservice com.apple.dt.remoteFetchSymbols com.apple.remote.installcoordination_proxy com.apple.mobile.lockdown.remote.untrusted com.apple.mobile.notification_proxy.remote com.apple.preboardservice.shim.remote com.apple.mobile.notification_proxy.shim.remote com.apple.mobile.heartbeat.shim.remote com.apple.osanalytics.logTransfer com.apple.dt.remotepairingdeviced.lockdown.shim.remote com.apple.accessibility.axAuditDaemon.remoteserver.shim.remote com.apple.mobile.insecure_notification_proxy.shim.remote com.apple.mobile.installation_proxy.shim.remote com.apple.internal.devicecompute.CoreDeviceProxy com.apple.atc.shim.remote com.apple.mobilebackup2.shim.remote com.apple.afc.shim.remote com.apple.misagent.shim.remote com.apple.RestoreRemoteServices.restoreserviced com.apple.mobile.file_relay.shim.remote com.apple.atc2.shim.remote com.apple.crashreportmover.shim.remote com.apple.internal.devicecompute.CoreDeviceProxy.shim.remote com.apple.mobile.assertion_agent.shim.remote com.apple.bluetooth.BTPacketLogger.shim.remote com.apple.pcapd.shim.remote com.apple.idamd.shim.remote com.apple.security.cryptexd.remote com.apple.companion_proxy.shim.remote com.apple.backgroundassets.lockdownservice.shim.remote com.apple.sysdiagnose.remote.trusted com.apple.mobile.insecure_notification_proxy.remote com.apple.mobile.lockdown.remote.trusted com.apple.mobile.storage_mounter_proxy.bridge com.apple.carkit.service.shim.remote com.apple.webinspector.shim.remote com.apple.mobile.diagnostics_relay.shim.remote com.apple.mobile.house_arrest.shim.remote com.apple.mobileactivationd.shim.remote com.apple.mobilesync.shim.remote com.apple.preboardservice_v2.shim.remote com.apple.PurpleReverseProxy.Conn.shim.remote com.apple.fusion.remote.service com.apple.GPUTools.MobileService.shim.remote com.apple.mobile.mobile_image_mounter.shim.remote com.apple.mobile.MCInstall.shim.remote com.apple.syslog_relay.shim.remote com.apple.crashreportcopymobile.shim.remote com.apple.iosdiagnostics.relay.shim.remote com.apple.PurpleReverseProxy.Ctrl.shim.remote com.apple.streaming_zip_conduit.shim.remote com.apple.springboardservices.shim.remote com.apple.commcenter.mobile-helper-cbupdateservice.shim.remote com.apple.amfi.lockdown.shim.remote com.apple.os_trace_relay.shim.remote com.apple.corecaptured.remoteservice _———

Accepted Answer

ADDENDUM TO ABOVE——— it won’t let me add attachment files, or photos, as a reference which ughhh- but I wanted to correct something noted above- lockdown caught a process and warned my iPhone main screen, something CALLED- ‘REMOTECLOUDQUOTAUI”, tried to run in lockdown and Apple gave me an alert preventing the process, whatever it is. I do nothing remote and own no computer.

Also of note: Last week, my cell wouldn’t accept my appleid pin and I got a apple security prompt- asking me to provide the password for “MY OTHER IPHONE” when my device code failed to LOGIN- I’ve HAD Apple ask me similarly, to provide device challenge for password/login for password ‘of my iPad’ on my iPhone, as a security protocol, however I don’t have another, nor couldn’t afford another, iPhone. this didn’t make sense at all.

In sum, I DONT BELIEVE this is an exploit targeting apple and overcoming their architecture and opsec, I’m not rich or famous and barring zero day or Pegasus I don’t see anyone getting through their layers- initial thoughts leaning toward configuration/settings manipulation through Apple ID/cloud access unauthorized , or something in the species of remote admin as a profile (enterprise/admin) without consent. My idiots 2 cents.

Y’all….. II AM LOOKING FOR ANY SUGGESTION, SPECULATION, FEEDBACK OR INPUT- I just want pointed in a direction. Any feedback is SUPER APPRECIATED!! ~ I never knew there existed any manner of intelligence out there I couldn’t reconcile on some basic level with, but cyber/programming/IT is absolutely foreign to me I’m barely afloat realizing I have zero aptitude in this discipline. Respect to those who do.

for Developer interest I’ve pasted my remotec dump state from syslog. Just seems like a lotta REMOTE and UNTRUSTED stuff…….. I know analytics is strictly for pro’s, but I’m in developer arena, so this is a Hail Mary. if anyone has ANY HINT OF A CLUE *** is going on here, please lemme know!!:) much appreciated!

LOCAL DEVICE UUID: 191A01ED-0763-4BA4-95C6-B28CFFDA56B1 Messaging Protocol Version: 3 Product Type: iPad14,11 OS Build: 17.6.1 (21G93) Properties: { AppleInternal => false CPUArchitecture => arm64e ChipID => 33042 EffectiveProductionStatusSEP => true EthernetMacAddress => 28:83:c9:34:e0:e6 HWModel => J538AP HasSEP => true HumanReadableProductVersionString => 17.6.1 ThinningProductType => iPad14,11 IsUIBuild => true RegionInfo => LL/A RestoreLongVersion => 21.7.93.0.0,0 DeviceSupportsLockdown => true EffectiveSecurityModeAp => true SigningFuse => true SupplementalBuildVersion => 21G93 BuildVersion => 21G93 OSVersion => 17.6.1 SensitivePropertiesVisible => true Image4CryptoHashMethod => sha2-384 MobileDeviceMinimumVersion => 1643.100.59 ProductName => iPhone OS ProductType => iPad14,11 SerialNumber => M74J7XG3K2 BootSessionUUID => EC2A6814-F2BF-4057-AF71-7A631E42EA36 BoardId => 22 DeviceColor => 1 EffectiveProductionStatusAp => true EffectiveSecurityModeSEP => true StoreDemoMode => false UniqueChipID => 3467353379086366 UniqueDeviceID => 00008112-000C518A1E78A01E OSInstallEnvironment => false RemoteXPCVersionFlags => 72057594037927942 CertificateProductionStatus => true CertificateSecurityMode => true DeviceClass => iPad DeviceEnclosureColor => 7 ModelNumber => MV6U3 RegionCode => LL SecurityDomain => 1 HardwarePlatform => t8112 Image4Supported => true IsVirtualDevice => false } Services: com.apple.sysdiagnose.remote com.apple.internal.dt.coredevice.untrusted.tunnelservice com.apple.dt.remoteFetchSymbols com.apple.remote.installcoordination_proxy com.apple.mobile.lockdown.remote.untrusted com.apple.mobile.notification_proxy.remote com.apple.preboardservice.shim.remote com.apple.mobile.notification_proxy.shim.remote com.apple.mobile.heartbeat.shim.remote com.apple.osanalytics.logTransfer com.apple.dt.remotepairingdeviced.lockdown.shim.remote com.apple.accessibility.axAuditDaemon.remoteserver.shim.remote com.apple.mobile.insecure_notification_proxy.shim.remote com.apple.mobile.installation_proxy.shim.remote com.apple.internal.devicecompute.CoreDeviceProxy com.apple.atc.shim.remote com.apple.mobilebackup2.shim.remote com.apple.afc.shim.remote com.apple.misagent.shim.remote com.apple.RestoreRemoteServices.restoreserviced com.apple.mobile.file_relay.shim.remote com.apple.atc2.shim.remote com.apple.crashreportmover.shim.remote com.apple.internal.devicecompute.CoreDeviceProxy.shim.remote com.apple.mobile.assertion_agent.shim.remote com.apple.bluetooth.BTPacketLogger.shim.remote com.apple.pcapd.shim.remote com.apple.idamd.shim.remote com.apple.security.cryptexd.remote com.apple.companion_proxy.shim.remote com.apple.backgroundassets.lockdownservice.shim.remote com.apple.sysdiagnose.remote.trusted com.apple.mobile.insecure_notification_proxy.remote com.apple.mobile.lockdown.remote.trusted com.apple.mobile.storage_mounter_proxy.bridge com.apple.carkit.service.shim.remote com.apple.webinspector.shim.remote com.apple.mobile.diagnostics_relay.shim.remote com.apple.mobile.house_arrest.shim.remote com.apple.mobileactivationd.shim.remote com.apple.mobilesync.shim.remote com.apple.preboardservice_v2.shim.remote com.apple.PurpleReverseProxy.Conn.shim.remote com.apple.fusion.remote.service com.apple.GPUTools.MobileService.shim.remote com.apple.mobile.mobile_image_mounter.shim.remote com.apple.mobile.MCInstall.shim.remote com.apple.syslog_relay.shim.remote com.apple.crashreportcopymobile.shim.remote com.apple.iosdiagnostics.relay.shim.remote com.apple.PurpleReverseProxy.Ctrl.shim.remote com.apple.streaming_zip_conduit.shim.remote com.apple.springboardservices.shim.remote com.apple.commcenter.mobile-helper-cbupdateservice.shim.remote com.apple.amfi.lockdown.shim.remote com.apple.os_trace_relay.shim.remote com.apple.corecaptured.remoteservice _———

ACCOUNT TAKEOVER W BANK, EMAIL- they required me to wipe phone/ bur new- question about unknown parent process?
 
 
Q