mirror of
https://github.com/mvt-project/mvt.git
synced 2026-02-15 18:02:44 +00:00
Compare commits
1 Commits
fix/add-py
...
feature/io
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
b12eaa4007 |
@@ -17,6 +17,12 @@ from mvt.ios.modules.base import IOSExtraction
|
|||||||
APPLICATIONS_DB_PATH = [
|
APPLICATIONS_DB_PATH = [
|
||||||
"private/var/containers/Bundle/Application/*/iTunesMetadata.plist"
|
"private/var/containers/Bundle/Application/*/iTunesMetadata.plist"
|
||||||
]
|
]
|
||||||
|
KNOWN_APP_INSTALLERS = [
|
||||||
|
"com.apple.AppStore",
|
||||||
|
"com.apple.AppStore.ProductPageExtension",
|
||||||
|
"com.apple.dmd",
|
||||||
|
"dmd",
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
class Applications(IOSExtraction):
|
class Applications(IOSExtraction):
|
||||||
@@ -80,12 +86,10 @@ class Applications(IOSExtraction):
|
|||||||
self.detected.append(result)
|
self.detected.append(result)
|
||||||
continue
|
continue
|
||||||
# Some apps installed from apple store with sourceApp "com.apple.AppStore.ProductPageExtension"
|
# Some apps installed from apple store with sourceApp "com.apple.AppStore.ProductPageExtension"
|
||||||
if result.get("sourceApp", "com.apple.AppStore") not in [
|
if (
|
||||||
"com.apple.AppStore",
|
result.get("sourceApp", "com.apple.AppStore")
|
||||||
"com.apple.AppStore.ProductPageExtension",
|
not in KNOWN_APP_INSTALLERS
|
||||||
"com.apple.dmd",
|
):
|
||||||
"dmd",
|
|
||||||
]:
|
|
||||||
self.log.warning(
|
self.log.warning(
|
||||||
"Suspicious app not installed from the App Store or MDM: %s",
|
"Suspicious app not installed from the App Store or MDM: %s",
|
||||||
result["softwareVersionBundleId"],
|
result["softwareVersionBundleId"],
|
||||||
|
|||||||
Reference in New Issue
Block a user