KasperskyLab / triangle_check

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Check fails with error: KeyError: 'netUsageBaseline'

Nuru opened this issue · comments

commented

Running against an iPadOS 16.5 encrypted backup, triangle_check fails because osanalytics does not have a 'netUsageBaseline'.

Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/runpy.py", line 194, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/runpy.py", line 87, in _run_code
    exec(code, run_globals)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/triangle_check/__main__.py", line 49, in <module>
    main()
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/triangle_check/__main__.py", line 29, in main
    results = checker.scan_dir(dir, password, ask_password)
  File "/Library/Frameworks/Python.framework/Versions/3.8/lib/python3.8/site-packages/triangle_check/__init__.py", line 216, in scan_dir
    baseline = osanalytics['netUsageBaseline']
KeyError: 'netUsageBaseline'
commented

I have the same problem. My wild guess is that this happens when analytics collection is disabled on the iPhone.

I created a pull request to work around this. My change skips the detection of some IOCs. Not sure if this is a problem, since data usage of the same IOCs (f.e. BackupAgent) is still performed in the next step of the script.