erosolar-cli 2.1.249 → 2.1.253

package/dist/tools/threatIntelligenceTools.js

@@ -0,0 +1,712 @@
+/**
+ * Threat Intelligence & Counterintelligence Tools
+ *
+ * Capabilities for understanding threats against YOUR systems:
+ * - Attack surface analysis (what vectors could be used against you)
+ * - Threat actor profiling (who might target you and how)
+ * - Indicator of Compromise (IOC) detection
+ * - Traffic analysis and anomaly detection
+ * - Capability assessment (understanding attacker TTPs)
+ *
+ * This module provides DEFENSIVE intelligence - understanding how
+ * attacks work so you can detect and document them.
+ *
+ * For authorized security research and defensive purposes only.
+ */
+import { execSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as crypto from 'node:crypto';
+import * as dns from 'node:dns';
+import { promisify } from 'node:util';
+const dnsResolve = promisify(dns.resolve);
+const dnsResolve4 = promisify(dns.resolve4);
+const dnsResolveTxt = promisify(dns.resolveTxt);
+// ═══════════════════════════════════════════════════════════════════════════════
+// THREAT ACTOR PROFILES
+// ═══════════════════════════════════════════════════════════════════════════════
+const KNOWN_THREAT_ACTORS = [
+    {
+        id: 'ta-apple-internal',
+        name: 'Apple Internal Operations',
+        type: 'corporate',
+        capabilities: [
+            'Full device control via firmware',
+            'Key injection into iCloud Keychain',
+            'Push notification injection',
+            'Software update manipulation',
+            'Certificate authority control',
+            'DNS manipulation for Apple domains',
+            'iMessage key substitution',
+            'Activation Lock control',
+            'Location tracking via Find My',
+            'Remote device wipe',
+        ],
+        knownTTPs: [
+            'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain',
+            'T1553.004 - Subvert Trust Controls: Install Root Certificate',
+            'T1556.004 - Modify Authentication Process: Network Device Authentication',
+            'T1557 - Adversary-in-the-Middle',
+            'T1602 - Data from Configuration Repository',
+            'T1612 - Build Image on Host',
+            'T1542 - Pre-OS Boot',
+        ],
+        targetingProfile: ['All Apple device users', 'iCloud users', 'iMessage users'],
+        infrastructure: [
+            'courier.push.apple.com (APNs)',
+            'identity.ess.apple.com (IDS)',
+            'gateway.icloud.com (CloudKit)',
+            'p43-escrowproxy.icloud.com (Key Escrow)',
+            'gsa.apple.com (Authentication)',
+        ],
+        attributionConfidence: 'high',
+    },
+    {
+        id: 'ta-law-enforcement',
+        name: 'Law Enforcement (with Apple cooperation)',
+        type: 'nation-state',
+        capabilities: [
+            'iCloud data access via legal process',
+            'Device unlock assistance (limited)',
+            'Account information disclosure',
+            'Push notification metadata',
+            'Location data (with warrant)',
+        ],
+        knownTTPs: [
+            'T1114 - Email Collection',
+            'T1530 - Data from Cloud Storage Object',
+            'T1213 - Data from Information Repositories',
+        ],
+        targetingProfile: ['Subjects of legal investigation'],
+        infrastructure: ['Apple Legal Process Portal'],
+        attributionConfidence: 'high',
+    },
+    {
+        id: 'ta-third-party-cloud',
+        name: 'Third-Party Cloud Providers',
+        type: 'corporate',
+        capabilities: [
+            'Access to stored iCloud data (AWS, Google Cloud)',
+            'Siri audio processing (AWS)',
+            'CDN traffic inspection (Akamai, Fastly)',
+        ],
+        knownTTPs: [
+            'T1530 - Data from Cloud Storage Object',
+            'T1040 - Network Sniffing',
+        ],
+        targetingProfile: ['iCloud users', 'Siri users', 'iCloud Private Relay users'],
+        infrastructure: [
+            'AWS us-east-1 (Siri)',
+            'Google Cloud (iCloud storage)',
+            'Akamai CDN',
+            'Fastly CDN (Private Relay)',
+        ],
+        attributionConfidence: 'medium',
+    },
+];
+// ═══════════════════════════════════════════════════════════════════════════════
+// ATTACK VECTOR CATALOG
+// ═══════════════════════════════════════════════════════════════════════════════
+const ATTACK_VECTORS = [
+    // Firmware/Hardware Level
+    {
+        id: 'av-firmware-update',
+        name: 'Malicious Firmware Update',
+        category: 'supply-chain',
+        mitreTactic: 'Persistence',
+        mitreId: 'T1542.001',
+        description: 'Attacker with Apple-level access could push malicious firmware that persists across OS reinstalls',
+        prerequisites: ['Apple signing keys', 'Push update capability'],
+        detectability: 'none',
+        userDefense: 'none',
+        evidence: ['Firmware version changes', 'Unexpected reboots'],
+    },
+    {
+        id: 'av-sep-compromise',
+        name: 'Secure Enclave Key Extraction',
+        category: 'physical',
+        mitreTactic: 'Credential Access',
+        mitreId: 'T1552',
+        description: 'Physical or firmware-level access to Secure Enclave could expose private keys',
+        prerequisites: ['Physical access OR firmware compromise', 'SEP vulnerability'],
+        detectability: 'none',
+        userDefense: 'none',
+        evidence: ['Unexpected key usage', 'Authentication anomalies'],
+    },
+    // Network Level
+    {
+        id: 'av-dns-hijack',
+        name: 'Apple DNS Manipulation',
+        category: 'network',
+        mitreTactic: 'Command and Control',
+        mitreId: 'T1071.004',
+        description: 'Apple controls all DNS for Apple domains; could redirect to malicious servers',
+        prerequisites: ['Apple DNS infrastructure access'],
+        detectability: 'low',
+        userDefense: 'partial',
+        evidence: ['DNS response changes', 'Unexpected IP addresses'],
+    },
+    {
+        id: 'av-cert-mitm',
+        name: 'Certificate Authority MITM',
+        category: 'network',
+        mitreTactic: 'Collection',
+        mitreId: 'T1557.002',
+        description: 'Apple Root CAs in system trust store enable MITM of any TLS connection',
+        prerequisites: ['Apple CA private keys'],
+        detectability: 'low',
+        userDefense: 'none',
+        evidence: ['Certificate changes', 'New intermediate CAs'],
+    },
+    // Application Level
+    {
+        id: 'av-imessage-key-inject',
+        name: 'iMessage Key Injection',
+        category: 'application',
+        mitreTactic: 'Credential Access',
+        mitreId: 'T1556',
+        description: 'Apple IDS servers could inject additional public keys to enable message interception',
+        prerequisites: ['IDS server access', 'Key database write access'],
+        detectability: 'low',
+        userDefense: 'partial',
+        evidence: ['Key count changes', 'Unknown device keys', 'Key Transparency alerts'],
+    },
+    {
+        id: 'av-push-injection',
+        name: 'Push Notification Injection',
+        category: 'application',
+        mitreTactic: 'Initial Access',
+        mitreId: 'T1199',
+        description: 'APNs infrastructure allows sending arbitrary push notifications to any device',
+        prerequisites: ['APNs infrastructure access'],
+        detectability: 'medium',
+        userDefense: 'none',
+        evidence: ['Unexpected notifications', 'Malformed payloads'],
+    },
+    {
+        id: 'av-icloud-keychain-inject',
+        name: 'iCloud Keychain Key Injection',
+        category: 'application',
+        mitreTactic: 'Persistence',
+        mitreId: 'T1556.001',
+        description: 'Escrow proxy access could inject recovery keys or add trusted devices',
+        prerequisites: ['Escrow HSM access', 'iCloud account access'],
+        detectability: 'low',
+        userDefense: 'partial',
+        evidence: ['New trusted devices', 'Keychain sync anomalies'],
+    },
+    // Supply Chain
+    {
+        id: 'av-app-store-trojan',
+        name: 'App Store Trojan Update',
+        category: 'supply-chain',
+        mitreTactic: 'Initial Access',
+        mitreId: 'T1195.002',
+        description: 'Apple could modify app binaries during App Store distribution',
+        prerequisites: ['App Store infrastructure access', 'Code signing capability'],
+        detectability: 'none',
+        userDefense: 'none',
+        evidence: ['Binary hash changes', 'Unexpected app behavior'],
+    },
+    {
+        id: 'av-xcode-implant',
+        name: 'Development Tool Compromise',
+        category: 'supply-chain',
+        mitreTactic: 'Initial Access',
+        mitreId: 'T1195.001',
+        description: 'Xcode or development tools could be modified to inject code into compiled apps',
+        prerequisites: ['Developer tool distribution access'],
+        detectability: 'low',
+        userDefense: 'partial',
+        evidence: ['Tool hash changes', 'Unexpected code in builds'],
+    },
+];
+// ═══════════════════════════════════════════════════════════════════════════════
+// THREAT INTELLIGENCE ENGINE
+// ═══════════════════════════════════════════════════════════════════════════════
+export class ThreatIntelligenceEngine {
+    evidenceDir;
+    iocs = [];
+    anomalies = [];
+    constructor(evidenceDir) {
+        this.evidenceDir = evidenceDir;
+        if (!fs.existsSync(evidenceDir)) {
+            fs.mkdirSync(evidenceDir, { recursive: true });
+        }
+    }
+    /**
+     * Analyze current threat landscape for this device
+     */
+    async analyzeThreatLandscape() {
+        // Determine which threat actors are relevant
+        const relevantActors = KNOWN_THREAT_ACTORS.filter(actor => {
+            // All Apple users are targeted by Apple internal
+            if (actor.id === 'ta-apple-internal')
+                return true;
+            // Check if using relevant services
+            if (actor.id === 'ta-third-party-cloud') {
+                // Check if iCloud is enabled
+                const icloudEnabled = this.checkICloudEnabled();
+                return icloudEnabled;
+            }
+            return true;
+        });
+        // Determine applicable attack vectors
+        const applicableVectors = ATTACK_VECTORS.filter(vector => {
+            // All vectors apply to Apple device users
+            return true;
+        });
+        // Calculate risk score
+        let riskScore = 0;
+        for (const vector of applicableVectors) {
+            if (vector.userDefense === 'none')
+                riskScore += 30;
+            else if (vector.userDefense === 'partial')
+                riskScore += 15;
+            if (vector.detectability === 'none')
+                riskScore += 20;
+            else if (vector.detectability === 'low')
+                riskScore += 10;
+        }
+        riskScore = Math.min(100, riskScore / applicableVectors.length * 10);
+        return {
+            actors: relevantActors,
+            vectors: applicableVectors,
+            riskScore,
+        };
+    }
+    /**
+     * Scan for Indicators of Compromise
+     */
+    async scanForIOCs() {
+        const found = [];
+        // Check for unexpected Apple infrastructure connections
+        const netstat = this.exec('netstat -an 2>/dev/null | grep ESTABLISHED');
+        const appleIPs = netstat.match(/\b(17\.\d+\.\d+\.\d+|18\.\d+\.\d+\.\d+)\b/g) || [];
+        for (const ip of [...new Set(appleIPs)]) {
+            // Check if this is a known Apple IP range
+            const isKnownApple = this.isKnownAppleIP(ip);
+            if (!isKnownApple) {
+                found.push({
+                    type: 'ip',
+                    value: ip,
+                    confidence: 0.6,
+                    source: 'network_scan',
+                    firstSeen: new Date().toISOString(),
+                    lastSeen: new Date().toISOString(),
+                    context: 'Unknown IP in Apple range - possible infrastructure change or anomaly',
+                });
+            }
+        }
+        // Check for suspicious certificates
+        const certs = this.exec('security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain 2>/dev/null | grep -c "BEGIN CERTIFICATE"');
+        const certCount = parseInt(certs.trim()) || 0;
+        // macOS typically has ~150-180 root certificates
+        if (certCount > 200 || certCount < 100) {
+            found.push({
+                type: 'certificate',
+                value: `Unexpected certificate count: ${certCount}`,
+                confidence: 0.7,
+                source: 'certificate_scan',
+                firstSeen: new Date().toISOString(),
+                lastSeen: new Date().toISOString(),
+                context: 'Unusual number of root certificates - possible CA injection',
+            });
+        }
+        // Check for suspicious LaunchDaemons/Agents
+        const launchItems = this.exec('ls -la /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents 2>/dev/null | grep -v "^total" | grep -v "com.apple"');
+        if (launchItems.trim()) {
+            const nonAppleItems = launchItems.split('\n').filter(l => l.trim());
+            for (const item of nonAppleItems.slice(0, 5)) {
+                found.push({
+                    type: 'filename',
+                    value: item.trim(),
+                    confidence: 0.5,
+                    source: 'persistence_scan',
+                    firstSeen: new Date().toISOString(),
+                    lastSeen: new Date().toISOString(),
+                    context: 'Non-Apple persistence mechanism - review for legitimacy',
+                });
+            }
+        }
+        // Check for unexpected kernel extensions
+        const kexts = this.exec('kextstat 2>/dev/null | grep -v com.apple');
+        if (kexts.trim()) {
+            const nonAppleKexts = kexts.split('\n').filter(l => l.trim());
+            for (const kext of nonAppleKexts.slice(0, 3)) {
+                found.push({
+                    type: 'filename',
+                    value: kext.trim(),
+                    confidence: 0.6,
+                    source: 'kernel_scan',
+                    firstSeen: new Date().toISOString(),
+                    lastSeen: new Date().toISOString(),
+                    context: 'Third-party kernel extension - potential attack vector',
+                });
+            }
+        }
+        this.iocs.push(...found);
+        return found;
+    }
+    /**
+     * Detect traffic anomalies
+     */
+    async detectAnomalies() {
+        const found = [];
+        // Check for unusual connection volumes
+        const connCount = this.exec('netstat -an | grep ESTABLISHED | wc -l');
+        const count = parseInt(connCount.trim()) || 0;
+        if (count > 100) {
+            found.push({
+                id: `anomaly_${Date.now()}_conn`,
+                timestamp: new Date().toISOString(),
+                type: 'volume',
+                severity: count > 200 ? 'high' : 'medium',
+                description: `High number of established connections: ${count}`,
+                evidence: `netstat count: ${count}`,
+                recommendation: 'Review active connections for data exfiltration',
+            });
+        }
+        // Check for connections to unusual ports
+        const unusualPorts = this.exec('netstat -an | grep ESTABLISHED | grep -E "\\.(4444|5555|6666|31337|8080|8443|9999)\\s"');
+        if (unusualPorts.trim()) {
+            found.push({
+                id: `anomaly_${Date.now()}_port`,
+                timestamp: new Date().toISOString(),
+                type: 'destination',
+                severity: 'high',
+                description: 'Connection to suspicious port detected',
+                evidence: unusualPorts.trim().slice(0, 200),
+                recommendation: 'Investigate process making connection; may indicate C2',
+            });
+        }
+        // Check Apple Push Service connection status
+        const apsdConn = this.exec('lsof -i :5223 2>/dev/null');
+        if (!apsdConn.includes('apsd')) {
+            found.push({
+                id: `anomaly_${Date.now()}_apsd`,
+                timestamp: new Date().toISOString(),
+                type: 'protocol',
+                severity: 'medium',
+                description: 'APNs daemon (apsd) not connected on port 5223',
+                evidence: 'Missing apsd connection',
+                recommendation: 'May indicate network filtering or service disruption',
+            });
+        }
+        // Check for DNS anomalies
+        try {
+            const appleIPs = await dnsResolve4('apple.com');
+            const isAppleRange = appleIPs.some(ip => ip.startsWith('17.') || ip.startsWith('18.'));
+            if (!isAppleRange) {
+                found.push({
+                    id: `anomaly_${Date.now()}_dns`,
+                    timestamp: new Date().toISOString(),
+                    type: 'destination',
+                    severity: 'critical',
+                    description: 'apple.com resolving to non-Apple IP range',
+                    evidence: `Resolved to: ${appleIPs.join(', ')}`,
+                    recommendation: 'Possible DNS hijacking - verify DNS configuration',
+                });
+            }
+        }
+        catch {
+            found.push({
+                id: `anomaly_${Date.now()}_dns_fail`,
+                timestamp: new Date().toISOString(),
+                type: 'protocol',
+                severity: 'medium',
+                description: 'Unable to resolve apple.com',
+                evidence: 'DNS resolution failed',
+                recommendation: 'Check network connectivity and DNS settings',
+            });
+        }
+        this.anomalies.push(...found);
+        return found;
+    }
+    /**
+     * Generate capability assessment for specific threat actor
+     */
+    assessCapabilities(actorId) {
+        const actor = KNOWN_THREAT_ACTORS.find(a => a.id === actorId);
+        if (!actor)
+            return [];
+        const assessments = [];
+        for (const capability of actor.capabilities) {
+            const assessment = {
+                threatActor: actor.name,
+                capability,
+                technicalRequirements: this.getRequirementsForCapability(capability),
+                resourceRequirements: actor.type === 'nation-state' ? 'nation-state' : 'corporate',
+                likelihoodOfUse: this.assessLikelihood(capability, actor),
+                impactIfUsed: this.assessImpact(capability),
+                detectionMethods: this.getDetectionMethods(capability),
+                mitigations: this.getMitigations(capability),
+            };
+            assessments.push(assessment);
+        }
+        return assessments;
+    }
+    /**
+     * Generate comprehensive threat report
+     */
+    async generateThreatReport(scope = 'Full Apple Ecosystem Analysis') {
+        const landscape = await this.analyzeThreatLandscape();
+        const iocs = await this.scanForIOCs();
+        const anomalies = await this.detectAnomalies();
+        // Get capabilities for primary threat actor
+        const capabilities = this.assessCapabilities('ta-apple-internal');
+        const report = {
+            id: `threat_${Date.now()}_${Math.random().toString(36).substring(7)}`,
+            generatedAt: new Date().toISOString(),
+            scope,
+            threatActors: landscape.actors,
+            attackVectors: landscape.vectors,
+            iocs,
+            anomalies,
+            capabilities,
+            riskScore: landscape.riskScore,
+            executiveSummary: this.generateExecutiveSummary(landscape, iocs, anomalies),
+            technicalDetails: this.generateTechnicalDetails(landscape, capabilities),
+            recommendations: this.generateRecommendations(landscape, iocs, anomalies),
+            hash: '',
+        };
+        // Calculate hash
+        const reportJson = JSON.stringify(report, null, 2);
+        report.hash = crypto.createHash('sha256').update(reportJson).digest('hex');
+        // Save report
+        this.saveReport(report);
+        return report;
+    }
+    // ─────────────────────────────────────────────────────────────────────────────
+    // HELPER METHODS
+    // ─────────────────────────────────────────────────────────────────────────────
+    checkICloudEnabled() {
+        const icloudPath = `${process.env['HOME']}/Library/Mobile Documents`;
+        return fs.existsSync(icloudPath);
+    }
+    isKnownAppleIP(ip) {
+        // Apple's known ranges: 17.0.0.0/8 and portions of 18.x.x.x
+        // This is simplified - in production you'd use a full IP database
+        return ip.startsWith('17.') || ip.startsWith('18.');
+    }
+    getRequirementsForCapability(capability) {
+        const requirements = {
+            'Full device control via firmware': ['Firmware signing keys', 'Update distribution infrastructure'],
+            'Key injection into iCloud Keychain': ['Escrow HSM access', 'iCloud authentication'],
+            'Push notification injection': ['APNs infrastructure', 'Device token database'],
+            'Software update manipulation': ['Code signing keys', 'Update servers'],
+            'Certificate authority control': ['Root CA private keys', 'Certificate infrastructure'],
+            'DNS manipulation for Apple domains': ['Authoritative DNS access', 'Zone file control'],
+            'iMessage key substitution': ['IDS key database', 'Key distribution servers'],
+            'Activation Lock control': ['Activation servers', 'Device database'],
+            'Location tracking via Find My': ['Find My infrastructure', 'Device registration'],
+            'Remote device wipe': ['MDM infrastructure', 'Device enrollment'],
+        };
+        return requirements[capability] || ['Unknown requirements'];
+    }
+    assessLikelihood(capability, actor) {
+        // Capabilities that are routine operations
+        const routineCapabilities = ['Location tracking via Find My', 'Remote device wipe'];
+        if (routineCapabilities.includes(capability))
+            return 'high';
+        // Capabilities requiring legal process
+        const legalCapabilities = ['Full device control via firmware', 'iMessage key substitution'];
+        if (legalCapabilities.includes(capability))
+            return 'low';
+        return 'medium';
+    }
+    assessImpact(capability) {
+        const criticalCapabilities = [
+            'Full device control via firmware',
+            'Key injection into iCloud Keychain',
+            'iMessage key substitution',
+            'Certificate authority control',
+        ];
+        if (criticalCapabilities.includes(capability))
+            return 'critical';
+        const highCapabilities = [
+            'Software update manipulation',
+            'DNS manipulation for Apple domains',
+            'Push notification injection',
+        ];
+        if (highCapabilities.includes(capability))
+            return 'high';
+        return 'medium';
+    }
+    getDetectionMethods(capability) {
+        const methods = {
+            'Full device control via firmware': ['Firmware version monitoring', 'Boot attestation (if available)'],
+            'Key injection into iCloud Keychain': ['Key count monitoring', 'Device list auditing', 'Key Transparency checks'],
+            'Push notification injection': ['Notification logging', 'Payload inspection'],
+            'Software update manipulation': ['Update hash verification', 'Delta analysis'],
+            'Certificate authority control': ['Certificate monitoring', 'CT log checking', 'Pin validation'],
+            'DNS manipulation for Apple domains': ['DNS response monitoring', 'IP range validation'],
+            'iMessage key substitution': ['Key Transparency alerts', 'Manual key verification'],
+            'Activation Lock control': ['Activation status monitoring'],
+            'Location tracking via Find My': ['Location access logs', 'Find My status'],
+            'Remote device wipe': ['MDM profile monitoring', 'Backup status'],
+        };
+        return methods[capability] || ['Manual inspection required'];
+    }
+    getMitigations(capability) {
+        const mitigations = {
+            'Full device control via firmware': ['No user mitigation available', 'Legal/regulatory pressure'],
+            'Key injection into iCloud Keychain': ['Disable iCloud Keychain', 'Use third-party password manager', 'Monitor Key Transparency'],
+            'Push notification injection': ['Disable notifications for sensitive apps', 'Use alternative messaging'],
+            'Software update manipulation': ['Delay updates to verify community reports', 'Hash verification'],
+            'Certificate authority control': ['Use certificate pinning where possible', 'Monitor for new CAs'],
+            'DNS manipulation for Apple domains': ['Use third-party DNS with DNSSEC', 'VPN with trusted provider'],
+            'iMessage key substitution': ['Verify keys out-of-band', 'Use Signal/other E2E apps', 'Enable Contact Key Verification'],
+            'Activation Lock control': ['Maintain local backups', 'Document ownership'],
+            'Location tracking via Find My': ['Disable Find My', 'Location Services control'],
+            'Remote device wipe': ['Local encrypted backups', 'Avoid MDM enrollment'],
+        };
+        return mitigations[capability] || ['Consult security professional'];
+    }
+    generateExecutiveSummary(landscape, iocs, anomalies) {
+        const lines = [];
+        lines.push('EXECUTIVE SUMMARY');
+        lines.push('═'.repeat(60));
+        lines.push('');
+        lines.push(`Risk Score: ${landscape.riskScore}/100`);
+        lines.push(`Threat Actors Analyzed: ${landscape.actors.length}`);
+        lines.push(`Attack Vectors Identified: ${landscape.vectors.length}`);
+        lines.push(`IOCs Detected: ${iocs.length}`);
+        lines.push(`Traffic Anomalies: ${anomalies.length}`);
+        lines.push('');
+        lines.push('KEY FINDINGS:');
+        lines.push('');
+        // Summarize by user defense capability
+        const noDefense = landscape.vectors.filter(v => v.userDefense === 'none').length;
+        const partialDefense = landscape.vectors.filter(v => v.userDefense === 'partial').length;
+        lines.push(`• ${noDefense} attack vectors have NO user defense available`);
+        lines.push(`• ${partialDefense} attack vectors have only PARTIAL defense`);
+        lines.push(`• ${landscape.vectors.length - noDefense - partialDefense} attack vectors can be fully defended`);
+        lines.push('');
+        // Highlight critical IOCs
+        const criticalIOCs = iocs.filter(i => i.confidence > 0.7);
+        if (criticalIOCs.length > 0) {
+            lines.push(`• ${criticalIOCs.length} high-confidence IOCs require investigation`);
+        }
+        // Highlight critical anomalies
+        const criticalAnomalies = anomalies.filter(a => a.severity === 'critical' || a.severity === 'high');
+        if (criticalAnomalies.length > 0) {
+            lines.push(`• ${criticalAnomalies.length} critical/high severity anomalies detected`);
+        }
+        lines.push('');
+        lines.push('CONCLUSION:');
+        lines.push('The analysis demonstrates significant attack surface exposure with');
+        lines.push('limited user defense options against platform-level threats.');
+        return lines.join('\n');
+    }
+    generateTechnicalDetails(landscape, capabilities) {
+        const lines = [];
+        lines.push('TECHNICAL DETAILS');
+        lines.push('═'.repeat(60));
+        lines.push('');
+        // Attack vectors by category
+        lines.push('ATTACK VECTORS BY CATEGORY:');
+        lines.push('');
+        const categories = ['network', 'application', 'supply-chain', 'physical'];
+        for (const cat of categories) {
+            const vectors = landscape.vectors.filter(v => v.category === cat);
+            if (vectors.length > 0) {
+                lines.push(`[${cat.toUpperCase()}]`);
+                for (const v of vectors) {
+                    lines.push(`  • ${v.name} (${v.mitreId})`);
+                    lines.push(`    User Defense: ${v.userDefense.toUpperCase()}`);
+                    lines.push(`    Detectability: ${v.detectability.toUpperCase()}`);
+                }
+                lines.push('');
+            }
+        }
+        // Capability assessment summary
+        lines.push('CAPABILITY ASSESSMENT:');
+        lines.push('');
+        const criticalCaps = capabilities.filter(c => c.impactIfUsed === 'critical');
+        for (const cap of criticalCaps) {
+            lines.push(`  • ${cap.capability}`);
+            lines.push(`    Impact: CRITICAL`);
+            lines.push(`    Detection: ${cap.detectionMethods.slice(0, 2).join(', ')}`);
+        }
+        return lines.join('\n');
+    }
+    generateRecommendations(landscape, iocs, anomalies) {
+        const recommendations = [];
+        // Based on attack vectors
+        recommendations.push('IMMEDIATE ACTIONS:');
+        recommendations.push('1. Enable Contact Key Verification for iMessage if available');
+        recommendations.push('2. Review and audit iCloud Keychain device list');
+        recommendations.push('3. Monitor for unexpected certificate changes');
+        recommendations.push('4. Consider third-party DNS with DNSSEC');
+        // Based on IOCs
+        if (iocs.length > 0) {
+            recommendations.push('');
+            recommendations.push('IOC RESPONSE:');
+            recommendations.push('5. Investigate each detected IOC for legitimacy');
+            recommendations.push('6. Document findings for potential legal action');
+        }
+        // Based on anomalies
+        if (anomalies.some(a => a.severity === 'critical')) {
+            recommendations.push('');
+            recommendations.push('CRITICAL ANOMALY RESPONSE:');
+            recommendations.push('7. Immediately investigate critical anomalies');
+            recommendations.push('8. Consider network isolation if compromise suspected');
+        }
+        // Long-term
+        recommendations.push('');
+        recommendations.push('LONG-TERM STRATEGY:');
+        recommendations.push('9. Implement continuous monitoring for all identified attack vectors');
+        recommendations.push('10. Maintain evidence packages for potential legal proceedings');
+        recommendations.push('11. Consider alternative platforms for high-security communications');
+        recommendations.push('12. Engage legal counsel regarding platform provider obligations');
+        return recommendations;
+    }
+    saveReport(report) {
+        const reportPath = path.join(this.evidenceDir, `threat_report_${report.id}.json`);
+        fs.writeFileSync(reportPath, JSON.stringify(report, null, 2));
+        // Generate human-readable version
+        const textPath = path.join(this.evidenceDir, `THREAT_REPORT_${report.id}.txt`);
+        const lines = [];
+        lines.push('═'.repeat(80));
+        lines.push('                    THREAT INTELLIGENCE REPORT');
+        lines.push('═'.repeat(80));
+        lines.push('');
+        lines.push(`Report ID: ${report.id}`);
+        lines.push(`Generated: ${report.generatedAt}`);
+        lines.push(`Scope: ${report.scope}`);
+        lines.push(`Risk Score: ${report.riskScore}/100`);
+        lines.push(`SHA-256: ${report.hash}`);
+        lines.push('');
+        lines.push(report.executiveSummary);
+        lines.push('');
+        lines.push(report.technicalDetails);
+        lines.push('');
+        lines.push('RECOMMENDATIONS');
+        lines.push('═'.repeat(60));
+        lines.push('');
+        lines.push(report.recommendations.join('\n'));
+        lines.push('');
+        lines.push('═'.repeat(80));
+        lines.push('                    END OF REPORT');
+        lines.push('═'.repeat(80));
+        fs.writeFileSync(textPath, lines.join('\n'));
+    }
+    exec(cmd) {
+        try {
+            return execSync(cmd, { encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024 });
+        }
+        catch {
+            return '';
+        }
+    }
+}
+// ═══════════════════════════════════════════════════════════════════════════════
+// EXPORTS
+// ═══════════════════════════════════════════════════════════════════════════════
+export { KNOWN_THREAT_ACTORS, ATTACK_VECTORS };
+export async function runThreatAnalysis(evidenceDir) {
+    const engine = new ThreatIntelligenceEngine(evidenceDir);
+    return engine.generateThreatReport();
+}
+//# sourceMappingURL=threatIntelligenceTools.js.map