Zero Breach Toolkit v0.1.13

Zero Breach Toolkit 0.1.13.

What changed

• iPhone: if an encrypted backup can't be read because cryptography is missing, the message now names the Python running the check and gives the command that installs it there. The usual cause is that it was installed for a different Python on the same computer.
• Program-file check: folders it could not open are counted separately from files it could not read, so a gap no longer says things like "3 of 1 candidate file(s)" (contributed in #19).
• Help: a simpler fix for "No such file or directory" on a Mac (drag the script into Terminal, from any folder), python3 in the backup install command, and a note that the third_party/candiru folder holds detection rules, not spyware.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: bb0e6a7a36ee659c0494d02e9f7495d5fd4701f1ab7e57529e79925cb581ae15

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit v0.1.12

Zero Breach Toolkit 0.1.12.

What changed

• iPhone: a full backup of a current phone is checked again. A 512 GB phone with a large photo library has a Manifest.db over 300 MB and an Info.plist over 16 MiB. Both were over the check's limits, so the report said "exceeds the read limit" and nothing on the phone was checked. The limits are now sized for current phones and still bound what a crafted backup can make the check load.
• When a file is over a limit, the report names it with its size, for example "Manifest.db is 1.2 GB, over the 1.0 GB limit for one file".

If you checked an iPhone backup with an earlier version and the report listed ios:manifest under "could not be checked", run it again with this version.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 67fc3aa3c4a93cb2dc865d909eae4c6d84178d6485809a5b6e90396b354ebbe5

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit v0.1.11

Zero Breach Toolkit 0.1.11.

What changed

• Saving the report, the sharing summary or an evidence bundle to a folder now saves inside that folder under a dated name. Before, typing a folder asked to replace it and then failed with "Access is denied" (WinError 5 / Errno 13).
• If Windows will not let the toolkit write to the chosen place (such as the top of the C: drive without administrator rights), the message says so and suggests Documents or the Desktop.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 91254ab664f343f66a5116074f766ed48db732e7ebbcbeab082e41a60a46912d

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit v0.1.10

Zero Breach Toolkit 0.1.10.

What changed

Fewer false "could not run" lines, found in a real Windows report:

• An app's own history.db that is not a database (FreeTube keeps one) is no longer reported as unreadable Safari history.
• A problem finding Amcache is no longer also shown under Prefetch, and the line now says these records need the check to run as administrator.
• A missing Microsoft Defender log is explained plainly: it is usual when another antivirus is in charge.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 075b2a0ac20f285fa4385d6b6c5cda2cedd410364c4f4686db3c1b8b033265d3

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit v0.1.9

Zero Breach Toolkit 0.1.9.

What changed

• Browsers: "the browser was running" is now said only for a real lock. Other refusals say permission was denied and what to do; on a Mac they point to Full Disk Access.
• The empty LOCK file a running Chromium browser holds, Safari's standard cookie link and a large but valid write-ahead log are no longer reported as gaps.
• Browser icon stores are read in bounded steps, so a crafted icon database cannot use up memory.
• Downloaded indicator lists are used only if they match the copies pinned for this release. After moving to 0.1.9, update the lists once (menu option 8, or --update). Lists fetched with --update --latest need --latest on the scan too.
• Ad-network matches note that apps showing ads, such as the new Outlook for Windows, can record them too.
• The release check on GitHub now also compares the downloadable file and checks both signatures.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 8574f7e701bc64e459a2c19f28f8192f0c9d286ed900c95f1ed57a074fb2e828

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit 0.1.8

Zero Breach Toolkit 0.1.8.

What changed

• Mac: if updating the indicator lists fails because Python's certificates are not installed, the toolkit now stops with one clear message saying what to do (open Applications → Python 3 and double-click Install Certificates.command). The previous lists are kept. The Mac setup steps include this now.
• If the final menu cannot read any input, the toolkit says nothing was saved instead of closing silently.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: aa5cc97edb260f31e508a2b84ba4a1e7dec103cdd7534315ee8fc0755a502fd1

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit 0.1.7

Zero Breach Toolkit 0.1.7.

What changed

• Windows: the guided Android collection works again. It stopped with "Impossible to find ADB" because the collector could not find the adb it had just unpacked (#14).
• Pixel phones no longer show eight false monitoring-app matches. A Google feature flag lists hundreds of apps that the notification features skip, family-safety apps among them; server-pushed feature flags are no longer searched for app names. Thanks to Luke Hutchison for finding and fixing this (#13).
• iPhone app ids from the monitoring-app list are no longer matched on Android.
• A monitoring app that does not hide itself (often a family-safety app) is described as such in the report, with the same safety advice.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: 1fd1c8cf194f24a295005beb96836dd3bdec522134870c8b83f4b834b83c0cfd

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit 0.1.6

Zero Breach Toolkit 0.1.6.

What changed

• Finds spyware addresses hidden in encoded links (for example u=https%3A%2F%2F...), which ad-click URLs and browser storage often use.
• IPv6 addresses match however they are written.
• Linux: a known implant path run by a systemd service or cron job is now reported as configured to start, not just mentioned.
• OneDrive files kept on this PC, and OneDrive folders, are now checked instead of being skipped.
• Names that may have changed owner since their report (shared cloud hostnames, and old lookalike domains re-registered since) are reported as leads, not serious findings.
• Specially crafted files can no longer stall a scan.
• Temporary copies left by a scan that crashed are cleaned up at the next start, and the scanner warns before saving a report into OneDrive or iCloud.
• --update now downloads the indicator files checked for this release; --update --latest gets the newest versions.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: f80ec4a0e3e2f09ae8c6f7d3e9ed02705d8e927671a68c1c7ff5eebe71c20d5e

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit 0.1.5

Zero Breach Toolkit 0.1.5.

What changed

• Scans no longer stall on files kept only in iCloud ("Optimise Mac Storage") or OneDrive (online-only). They are listed as not checked instead of being downloaded.
• Windows launcher (run-scan.cmd): folder names containing & or ! are handled safely, and a Microsoft Store "python" placeholder no longer stops it from finding Python.
• A reassignable cloud IP address now counts as a weaker indicator, so a hit on it alone is not reported as serious.
• zsh history with non-English commands is searched; long lines in iPhone diagnostic reports are capped.
• Hardening of the build and of how indicator values are displayed.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: f3f8951c69ae3dae3050d6a40ee9b03f3470cceb905ebaf2ecbdc7b8fa7791bf

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.

Zero Breach Toolkit 0.1.4

Zero Breach Toolkit 0.1.4.

What changed

• Linux: Downloads, Desktop and Documents folders with translated names (for example on a French or Arabic desktop) are now fingerprinted. Snap Brave, Opera and Vivaldi, Firefox 147's new profile location (~/.config/mozilla/firefox) and Flatpak Firefox's newer layout are checked. Earlier versions missed all of these.
• Phones: iPhone support is no longer labelled experimental. The guided Android collection saves to the Desktop when you press Enter.
• --update --accept-shrink SOURCE_ID accepts a source whose list genuinely shrank; small housekeeping fixes.
• A simpler step-by-step guide for each device in the README.

Full list in CHANGELOG.md.

Verify before running

zero-breach-toolkit.py SHA-256: e1404e4a5602205a4a3f806ec538486d48363d97ff56e15a3256ec96aa1aaa67

Signed with key C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. See docs/VERIFYING.md.