1

  • I've recently noticed that my devices battery life and data limit has been draining at a higher rate than normal.

  • Furthermore, upon a little further investigation, it seems a number of photos have been deleted that I do not remember removing.

  • I also noticed a disney plus profile added to my keychain (a service I do not use).

  • I pulled the logs multiple times and did not see the lines I'm interested in occurring during the first few attempts. Which apps or services might generate them?

I don't have any real reason to think someone would hack my device as I don't keep any real sensitive info on it and I do not do any banking or financial activity on it. Out of curiosity though, I took the time to take a look at the system log and see if I could pinpoint any odd activity. These are the ones I found peculiar. Is something wrong with my iPhone ?

 dams-iPhone locationd[60] <Notice>: {"msg":"got location notification", "subHarvester":"Avenger"}

 Jan 12 14:04:11 Adams-iPhone locationd[60] <Notice>: {"msg":"updateOperationalModeIfNecessary", "fIsAllowedToUseBest":1, "fCurrentTimeOffsetThreshold":"45.000000", "subHarvester":"Avenger"}

Jan 12 14:04:11 Adams-iPhone locationd[60] <Notice>: {"msg":"tried to harvest an empty pass cache", "subHarvester":"Pass"}

Jan 12 14:04:11 Adams-iPhone locationd(TrackingAvoidance)[60] <Notice>: <private>

 Jan 12 14:04:11 Adams-iPhone locationd(PersistentConnection)[60] <Notice>: Cancelling scheduled wake for <private> wake identifier <private>

 Jan 12 14:04:11 Adams-iPhone wifid(CoreLocation)[42] <Notice>: {"msg":"delivering locations to client's delegate", "self":"0x111d182c0", "delegate":"0x111e12f70"}

 Jan 12 14:04:11 Adams-iPhone kernel[0] <Notice>: PMRD: setAggressiveness(0) kPMMinutesToSleep = 2147483647

 Jan 12 14:04:11 Adams-iPhone kernel[0] <Notice>: PMRD: aggressiveness changed: system 0->2147483647, display 10

~iceActivityPolicy, policyWeight: 10.000, response: {Decision: Can Proceed, Score: 0.75}}
 ] sumScores:40.020000, denominator:42.520000, FinalDecision: Can Proceed FinalScore: 0.941204}

Jan 12 14:04:18 Adams-iPhone healthd(libxpc.dylib)[34] <Notice>: __XPC_ACTIVITY_CALLING_HANDLER__: <private>, current state 2, pending state 0

 Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: _xpc_activity_dispatch: beginning dispatch, activity name <private>, seqno 1

 Jan 12 14:04:18 Adams-iPhone maild(libxpc.dylib)[220] <Notice>: _xpc_activity_dispatch: beginning dispatch, activity name <private>, seqno 2

 Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: _xpc_activity_dispatch: <private>: found a activity with matching seqno 1

 Jan 12 14:04:18 Adams-iPhone maild(libxpc.dylib)[220] <Notice>: _xpc_activity_dispatch: <private>: found a activity with matching seqno 2

 Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: _xpc_activity_dispatch: lower half, activity name <private>, seqno from top half was 1

Jan 12 14:04:18 Adams-iPhone maild(libxpc.dylib)[220] <Notice>: _xpc_activity_dispatch: lower half, activity name <private>, seqno from top half was 2

 Jan 12 14:04:18 Adams-iPhone healthd(HealthDaemon)[34] <Notice>: com.apple.healthd.periodic-data-collection fired with activity <xpc object>

Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: _xpc_activity_set_state: <private>, 2

Jan 12 14:04:18 Adams-iPhone UserEventAgent(com.apple.cts)[24] <Notice>: Running XPC Activity (PID 1822): <private>

Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: STARTING: <private>

Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: Establish daemon connection; interrupted: 0

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: STARTING activity com.apple.Proximity.LogPowerStatistics:E76C24 <private>!

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: With <private> ...Tasks running in group [com.apple.dasd.default] are 2!

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: Not tracking activity: <private>

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: Unconstrained Available=1

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: com.apple.mobilemail.powernapFetches:A802CB:[
    {name: DeviceActivityPolicy, policyWeight: 20.000, response: {Decision: Can Proceed, Score: 0.75}}
 ] sumScores:69.030000, denominator:74.030000, FinalDecision: Can Proceed FinalScore: 0.932460}

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: com.apple.Proximity.LogPowerStatistics:E76C24:[
    {name: DeviceActivityPolicy, policyWeight: 10.000, response: {Decision: Can Proceed, Score: 0.75}}
    {name: MemoryPressurePolicy, policyWeight: 5.000, response: {Decision: Can Proceed, Score: 0.50, Rationale: [{[memoryPressure]: Required:2.00, Observed:1.00},]}}
 ] sumScores:35.520000, denominator:40.520000, FinalDecision: Can Proceed FinalScore: 0.876604}

Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: com.apple.healthd.periodic-data-collection:A10413:[
    {name: DeviceActivityPolicy, policyWeight: 10.000, response: {Decision: Can Proceed, Score: 0.75}}
 ] sumScores:40.020000, denominator:42.520000, FinalDecision: Can Proceed FinalScore: 0.941204}

Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: __XPC_ACTIVITY_CALLING_HANDLER__: <private>, current state 2, pending state 0

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Notice>: PRXPCActivityManager state: <private>

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Notice>: running activity with identifier: <private>

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Error>: Tried to send command to rose, but not ready for comms.

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Error>: Rose returned error. Command type: <private>

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Error>: Unexpected outputBuffer size (<private>) for AOPRoseError (<private>)

 Jan 12 14:04:18 Adams-iPhone nearbyd[1822] <Error>: failed to fetch power stats during activity

 Jan 12 14:04:18 Adams-iPhone nearbyd(libxpc.dylib)[1822] <Notice>: _xpc_activity_set_state: <private>, 5

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(com.apple.cts)[24] <Notice>: Completed XPC Activity: com.apple.Proximity.LogPowerStatistics

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: Establish daemon connection; interrupted: 0

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: Establish daemon connection; interrupted: 0

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(com.apple.cts)[24] <Notice>: Rescheduling XPC Activity: com.apple.Proximity.LogPowerStatistics

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: SUBMITTING: <private>

 Jan 12 14:04:18 Adams-iPhone UserEventAgent(DuetActivityScheduler)[24] <Notice>: Establish daemon connection; interrupted: 0

 Jan 12 14:04:18 Adams-iPhone dasd(DuetActivitySchedulerDaemon)[126] <Notice>: COMPLETED com.apple.Proximity.LogPowerStatistics:E76C24 at priority 30 <private>
```
Improve this question
14
  • 1
    Hacking is unlikely and probably not visible in the logs, so it‘s not really clear what kind of answers you expect here.
    – nohillside ♦
    Commented Jan 13, 2020 at 8:02
  • I'm not really expecting anything specific. I was mostly concerned with the presence of the disney profile in my keychain.
    – appleidiot
    Commented Jan 13, 2020 at 16:11
  • <Error>: Tried to send command to rose, but not ready for comms. In the log, this line occurs without the error text , but instead opens with the text "{"msg":" For some reason, it changed when I copied it over.
    – appleidiot
    Commented Jan 13, 2020 at 16:12
  • Perhaps someone else is signed to the same iCloud account you are using, and that other person is the one making those changes?
    – PaulJ
    Commented Jan 13, 2020 at 22:41
  • I haven't shared my apple account with anyone and in fact have icloud set to off. Could it be the result of some sort of number porting?
    – appleidiot
    Commented Jan 14, 2020 at 1:22

2 Answers 2

Reset to default
2

The log snippets you have included contain no evidence of hacking.

The observations you have are some that would most likely come with normal use of the phone.

All in all, there's nothing specific that indicates any form of hacking. I would say that it is very (!) unlikely that your phone has been hacked.

Improve this answer
5
  • Please excuse my lack of knowledge if my questions seem easily explainable. Does IOS come preinstalled with Backboardd? I've noticed it in the logs as well. I have never Jail broken the device, and I am unable to discern whether this is an out of the box feature.
    – appleidiot
    Commented Jan 13, 2020 at 17:07
  • Upon further investigation, despite there being multiple contradictory threads on this. It seems explainable as a native component of ios.
    – appleidiot
    Commented Jan 13, 2020 at 17:27
  • 1
    Blackboardd is the program responsible for handling touch input on the “springboard” - I.e. the home screen of an iPhone where you have all your icons. It’s most definitely supposed to be there. I would stop assuming you are hacked, and start looking at other explanations.
    – jksoegaard
    Commented Jan 13, 2020 at 20:44
  • Hacking, some sort of backdoor, is actually my last thought. However, I have retraced my steps pretty thoroughly and can't figure out where I might have implemented any changes. Further, I am the last person on earth who would spend money with disney, so the profile in my keychain totally throws me. Also, thanks for confirming my backboardd and ios in general learning curve. Ultimately, I'm here to learn. This is stuff I think everyone should have a better understanding of.
    – appleidiot
    Commented Jan 14, 2020 at 1:26
  • I also spent time comparing my logs to the plethora of others available online. I am really only questioning those items that I could not find something to correspond to. Most everything else was very easy to find an answer to.
    – appleidiot
    Commented Jan 14, 2020 at 1:29
1

This log line makes me wonder if the battery drain is location-related:

locationd(TrackingAvoidance)[60] <Notice>: <private>

Have you granted background location permissions for any apps? If so, are they contributing to the battery drain? Check the Settings > Battery screen.

Also, what iOS version are you running?

Improve this answer
1
  • 1
    I'm running the latest version of ios, 13.3. I'm generally pretty good about keeping all background permissions turned off, and in this instance I did a double check. Further, I don't have many non apple apps, only gmail, airbnb, and geico, all of which are only allowed any permissions while I'm using them. I do not allow them to communicate with siri either, a feature that I do not utilize and have set to off. At least to the extent that I can control through the available settings. Also, gmail was logged off and all accounts removed. I'll go ahead and check your recommendations
    – appleidiot
    Commented Jan 21, 2020 at 2:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .