Mark release 2.5.0 (#445)

Co-authored-by: DonnchaC <DonnchaC@users.noreply.github.com>

mvt/android/modules/androidqf/dumpsys_accessibility.py

@@ -12,7 +12,7 @@ from .base import AndroidQFModule
 
 
 class DumpsysAccessibility(DumpsysAccessibilityArtifact, AndroidQFModule):
-    """This module analyse dumpsys accessbility"""
+    """This module analyses dumpsys accessibility"""
 
     def __init__(
         self,

mvt/common/logo.py

@@ -10,7 +10,7 @@ from .version import MVT_VERSION
 
 
 def check_updates() -> None:
-    # First we check for MVT version udpates.
+    # First we check for MVT version updates.
     mvt_updates = MVTUpdates()
     try:
         latest_version = mvt_updates.check()

mvt/common/version.py

@@ -3,4 +3,4 @@
 # Use of this software is governed by the MVT License 1.1 that can be found at
 #   https://license.mvt.re/1.1/
 
-MVT_VERSION = "2.4.4"
+MVT_VERSION = "2.5.0"

mvt/ios/data/ios_models.json

@@ -169,7 +169,7 @@
     },
     {
         "identifier": "iPhone14,8",
-        "decription": "iPhone 14 Plus"
+        "description": "iPhone 14 Plus"
     },
     {
         "identifier": "iPhone15,2",

mvt/ios/data/ios_versions.json

@@ -960,6 +960,14 @@
         "version": "16.7.2",
         "build": "20H115"
     },
+    {
+        "version": "16.7.3",
+        "build": "20H232"
+    },
+    {
+        "version": "16.7.4",
+        "build": "20H240"
+    },
     {
         "version": "17.0",
         "build": "21A327"
@@ -999,5 +1007,13 @@
     {
         "version": "17.1.2",
         "build": "21B101"
+    },
+    {
+        "version": "17.2",
+        "build": "21C62"
+    },
+    {
+        "version": "17.2.1",
+        "build": "21C66"
     }
 ]

mvt/ios/modules/base.py

@@ -92,7 +92,7 @@ class IOSExtraction(MVTModule):
         self.log.info("Database at path %s recovered successfully!", file_path)
 
     def _open_sqlite_db(self, file_path: str) -> sqlite3.Connection:
-        return sqlite3.connect(f"file:{file_path}?immutable=1")
+        return sqlite3.connect(f"file:{file_path}?immutable=1", uri=True)
 
     def _get_backup_files_from_manifest(
         self, relative_path: Optional[str] = None, domain: Optional[str] = None

mvt/ios/modules/mixed/sms.py

@@ -44,20 +44,25 @@ class SMS(IOSExtraction):
     def serialize(self, record: dict) -> Union[dict, list]:
         text = record["text"].replace("\n", "\\n")
         sms_data = f"{record['service']}: {record['guid']} \"{text}\" from {record['phone_number']} ({record['account']})"
-        return [
+        records = [
             {
                 "timestamp": record["isodate"],
                 "module": self.__class__.__name__,
                 "event": "sms_received",
                 "data": sms_data,
             },
-            {
-                "timestamp": record["isodate_read"],
-                "module": self.__class__.__name__,
-                "event": "sms_read",
-                "data": sms_data,
-            },
         ]
+        # If the message was read, we add an extra event.
+        if record["isodate_read"]:
+            records.append(
+                {
+                    "timestamp": record["isodate_read"],
+                    "module": self.__class__.__name__,
+                    "event": "sms_read",
+                    "data": sms_data,
+                }
+            )
+        return records
 
     def check_indicators(self) -> None:
         for message in self.results:

mvt/ios/modules/mixed/sms_attachments.py

@@ -55,6 +55,10 @@ class SMSAttachments(IOSExtraction):
 
     def check_indicators(self) -> None:
         for attachment in self.results:
+            # Check for known malicious filenames.
+            if self.indicators.check_file_path(attachment["filename"]):
+                self.detected.append(attachment)
+
             if (
                 attachment["filename"].startswith("/var/tmp/")
                 and attachment["filename"].endswith("-1")

tests/ios_backup/test_sms.py

@@ -17,7 +17,7 @@ class TestSMSModule:
         m = SMS(target_path=get_ios_backup_folder())
         run_module(m)
         assert len(m.results) == 1
-        assert len(m.timeline) == 2  # SMS received and read events.
+        assert len(m.timeline) == 2
         assert len(m.detected) == 0
 
     def test_detection(self, indicator_file):