Zero Breach Toolkit 2.0.6

Zero Breach Toolkit 2.0.6 is now the main release. It was published for testing on 5 November, nothing turned up, and the macOS fixes below were confirmed on a real Mac by the person who reported them. If you are on 2.0.4 or earlier, please update: on some Macs the optional pattern check stopped the scan with no message at all, which is fixed here.

New indicators

• SHA-1 sample fingerprints are now used. Where researchers publish a spyware sample only by its SHA-1, the file check, the record of programs Windows has run, and Android app files and file lists now compare SHA-1 as well as SHA-256, from the same single read of each file. Published feeds (STIX and MISP) contribute their SHA-1 sample hashes too.
• More phone spyware, from Lookout: MOONSHINE, Hermit, BouldSpy, KoSpy, DCHSpy, and Massistant — a phone-extraction tool used by police on seized phones.
• Dante (Memento Labs, formerly Hacking Team), from Kaspersky: sample fingerprints, plus, on Windows, a check for the Windows component its loader hijacks and for the module folder layout the report describes. Both are reported as leads to check, not findings.

macOS fixes (reported by s3ba-b)

• The optional pattern check now runs the pattern engine in a separate process first. On some Macs it stopped Python with no message; now the check is skipped with an explanation and the rest of the scan finishes and writes its report.
• When macOS refuses Safari's cookie file or a browser's bookmarks, the report gives the Full Disk Access advice instead of a raw error.
• Two tests no longer fail on Apple's own Python.

Your antivirus may flag these programs. Antivirus products often wrongly flag new programs that are not code-signed yet, and some flag these. If you downloaded the file from this page, this is a false alarm and you can ignore it: the code is public, and each program has a public build record you can check. We have applied for free code signing and are reporting these false alarms to the antivirus companies. If the file came from anywhere else, do not run it and trust the warning.

Downloads and first-launch steps: see the README. Full list: CHANGELOG.

Verify before running

Each program: gh attestation verify <file> --repo interplains/Zero-Breach-Toolkit.

The checksums are also GPG-signed. Import the signing key first - it is in the asset list below, as archivegenocide-signing-key.asc:

gpg --import archivegenocide-signing-key.asc
gpg --verify SHA256SUMS-programs.txt.asc SHA256SUMS-programs.txt
sha256sum --ignore-missing -c SHA256SUMS-programs.txt

Compare the key's fingerprint before you trust it: C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. GPG will also say the key is not certified with a trusted signature - that is normal, and it does not mean the signature is bad; it only means you have not personally signed the key. Full instructions: docs/VERIFYING.md.