Zero-Breach-Toolkit is a free, offline, read-only scanner that hunts for traces of known mercenary spyware like Pegasus and Predator on Windows, macOS, Linux, Android phones and iPhone backups, for at-risk individuals and authorized responders.
| Tool | interplains/Zero-Breach-Toolkit — offline, open-source scanner for traces of known mercenary spyware on desktops, Android phones and iPhone backups |
| Category | Forensics / spyware triage (defensive detection) |
| Primary Use | Self-triage and assisted triage for journalists, activists and defenders checking their own devices for indicators of Pegasus, Predator, Graphite and Candiru |
| Safe Use | Explicitly defensive: read-only scanning of devices you own or are authorized to examine, for civil-society support and incident-response triage; the README directs actively targeted people to expert helplines first |
| Telemetry Note | Leaves almost nothing behind: no network calls during a scan, writes only temporary database snapshots and locally saved reports in the findings folder; reports never leave the machine unless the user shares them |
Zero-Breach-Toolkit occupies an unusual niche in the security-tooling landscape: it is not offensive, not a scanner of other people's systems, and not a general antivirus. It is a defensive triage instrument built for the people most often targeted by the commercial spyware industry — journalists, activists, human-rights defenders and civil society — and for the helpers who assist them. Written in Python and released under Apache-2.0 by the author known as archivegenocide, it builds on the earlier Zero Breach project and scans for published indicators of mercenary spyware families including Pegasus, Predator, Graphite and Candiru. What it produces is not a verdict but an evidence-graded report, which is a design choice worth unpacking.
The most consequential architectural decision is that the tool is fully offline during a scan. The README states plainly that it makes no network requests while checking, never looks up spyware addresses, and has no upload feature; the authors even claim that Python network calls are blocked and redirected paths are refused. They are careful to note this is not an operating-system network sandbox and point to PRIVACY.md for the caveats — an unusually honest framing. For the threat model of a person who suspects state-grade targeting, this matters enormously: the act of scanning must not itself generate a beacon or leak the fact that a check is occurring to any observer.
The second pillar is strict read-only behavior. Zero-Breach-Toolkit does not modify source evidence or system settings; it writes only temporary database snapshots and whatever reports the operator explicitly asks for. This is textbook forensic hygiene — the difference between triage and tampering. When the tool snapshots a browser's history or cookie database, it works from a copy, preserving the original artifact for any subsequent expert examination. That matters because, as the README itself stresses, a Something matched result is a prompt to look closer, not a confirmation of infection, and a preserved device may need to go to specialists like Amnesty International's Security Lab afterwards.
The third design commitment — and the one most vendors get wrong — is epistemic honesty. Every report states what was found, how strong the evidence is, and what could not be checked. A clean result is explicitly never presented as proof of safety, and No known indicators found comes packaged with a list of the places the scan could not reach. This calibrated language reflects the reality of indicator-based detection: mercenary spyware is engineered for stealth, published indicator lists lag behind deployments, and false comfort is itself a harm. For professional responders, this framing makes the tool's output usable as a defensible triage artifact rather than a magic oracle.
Coverage spans four platforms. On Windows, no administrator rights are needed, and the browser sweep is unusually broad: Chrome, Edge, Brave (including beta, dev, canary and nightly channels), Chromium, Vivaldi, Opera, Opera GX, Arc, Yandex, plus the Firefox family — Firefox, LibreWolf, Waterfox, Floorp, Zen, Pale Moon and Tor Browser. Within each, the tool looks for indicator addresses across history, cookies, connection records, HSTS state, bookmarks, downloads, site storage and caches, per profile. The logic is sound: spyware frameworks often touch network resources that leave residues in browser-adjacent databases long after the implant itself is gone.
On macOS, the guide instructs users to grant Terminal Full Disk Access via System Settings → Privacy & Security, without which Safari's records stay hidden from the scan — a deliberate sandbox constraint the tool respects rather than circumvents. On Linux, the checklist verifies python3 --version and notes that the scan needs no sudo; run as root, it would inspect the root account's browsers instead of the user's, a subtle but important correctness detail that reveals the authors understand their own data sources. Desktop apps with embedded Chromium browsers are also in scope on Windows, closing a common forensic blind spot.
Mobile coverage is where the toolkit shows its civil-society orientation. For Android, it guides the user through enabling Developer options and USB debugging, then collects a scoped acquisition over USB — the checklist recommends backing up only SMS, pulling only non-system package copies, and declining intrusion logs and hashing unless needed. For iPhone, the workflow ingests a locally created encrypted backup from %USERPROFILE%\Apple\MobileSync\Backup on Windows or ~/Library/Application Support/MobileSync/Backup on macOS, dragging the backup folder into the tool's window and supplying the backup password. The optional-cryptography requirement for encrypted backups (python3 -m pip install --require-hashes -r requirements-backups.txt) shows a security-conscious dependency posture — hash-pinned installs are rare in consumer-facing tooling.
A notable operational warning sits in the troubleshooting table: the third_party/candiru folder contains published detection rules for Candiru's spyware, not the spyware itself, and users are told to leave it in place. This is a classic false-positive panic vector — a folder named after a spyware vendor inside a security tool — and handling it explicitly in the README prevents users from mutilating their own installation. The --require-hashes pinning, the refusal to run network lookups, and this clarification together paint a picture of maintainers who anticipate how non-experts will misread artifacts.
The onboarding path is explicitly non-technical: download the ZIP, extract, and on Windows double-click scan/run-scan.cmd; on macOS or Linux, run cd ~/Downloads/Zero-Breach-Toolkit-main && python3 -X utf8 scan/zero-breach-toolkit.py. The interactive menu first offers an indicator-list update step — the only phase that touches the network — before running the roughly fifteen-minute This computer - standard check. Results land in a findings folder or a user-named report.txt, and the README repeats that reports never leave the machine unless the user shares them, with a warning not to paste reports into public GitHub issues because they contain private details.
Where does this fit in a professional workflow? For DFIR teams and helpline responders, it is a first-contact triage tool: cheap, safe, evidence-preserving, and calibrated in its claims. It can route genuinely worrying cases to full forensic examination while reassuring the worried-well with honest uncertainty statements. For defenders, its indicator-update mechanism also offers a view of which published mercenary-spyware indicators are current. What it is not is a substitute for expert help — and the README's most prominent callout says exactly that, directing anyone who believes they are being actively targeted to the Access Now Digital Security Helpline or Amnesty International's Security Lab before running anything. With around 3.7k stars and an Apache-2.0 license, it is a genuinely defensive tool that documents its own limits better than most commercial equivalents.
interplains/Zero-Breach-Toolkit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.