How Haris Shield works
What the app reads from your phone, how it decides what is a threat, every connection it makes — and how to check all of it without taking our word for it.
Describes the current version, 1.0.12.
What the app reads over the cable
Your phone is connected to your computer with its USB cable. Haris Shield reads it with libimobiledevice (iPhone) and Android's adb — the same open-source tools forensic researchers use. Nothing is installed on the phone, and the scan only reads: it does not delete, move or change anything there. Everything it copies stays in the app's folder on your computer.
iPhone
Device information
Model, iOS version and build, serial number, whether a passcode is set, activation state, device name and time zone.
Crash reports
Copied to your computer and read there. The originals stay on the phone — the app copies, it never moves or deletes them.
shutdown.log
The log that lists processes still running when the phone was last shut down. It is the trace Amnesty International's method relies on, and it is checked for known spyware process names and suspicious file paths.
Configuration profiles
Installed profiles, MDM enrolment, supervision and VPN profiles — the way a phone can be managed or have its traffic redirected.
Provisioning profiles
Who signed the developer and enterprise apps on the phone, compared with the names of known spyware vendors.
Security state
Lockdown Mode, developer mode, and whether the iOS version is one known to be exploited.
A sysdiagnose you import (optional)
If you create a sysdiagnose on the phone and import the archive, the app also reads its network usage databases, process execution history, app usage and permission databases, and its network and process logs.
Android
Device information
Model, brand, Android version, security patch level and serial number.
Installed apps
Package names compared with known stalkerware, apps hidden from the launcher, and where each app was installed from (Play Store or sideloaded).
Permissions
Which apps hold surveillance permissions — SMS, call log, location, camera, microphone — and dangerous combinations of them, plus apps allowed to install other apps.
Accessibility, device admins, notification listeners
The three hooks stalkerware usually needs to read the screen, resist removal and copy notifications.
Processes and network
Running processes, the connections open right now and the DNS resolver cache, compared with known spyware servers and IP addresses.
Certificates
User-installed root certificates, which can be used to read encrypted traffic, and apps signed with debug or test certificates.
Battery, data and sensor use
Apps that wake up at night, move a lot of data in the background or use the camera and microphone without being on screen.
Settings and system logs
USB and wireless debugging, unknown sources, Play Protect, and a few specific system log entries linked to known spyware.
A full scan also runs a privacy review, hardware diagnostics and, on iPhone, component verification. Analysis of encrypted iPhone backups and fingerprint matching of Android app files are being built; they are not part of the current version.
How findings are judged
A scan ends with one of three results. The difference between them matters, so here is exactly what each one takes.
Spyware detected
Only when there is a concrete trace: a known spyware process in shutdown.log or the execution history, a connection or DNS lookup to a known spyware server, known stalkerware that has been granted access, or a profile from a known spyware vendor.
Suspicious activity
Things worth a closer look that are not proof. This includes exposure: an old iOS version or missing security patches make a phone easier to attack, so they are reported here — never as an infection. Before version 1.0.11 an old iOS version was wrongly reported as infected; that is fixed.
No threats found
None of the traces the app knows about were found. It does not mean the phone is guaranteed clean — see what no tool can promise below.
What the app compares against
The app ships with a built-in list of spyware process names, servers, IP addresses and stalkerware apps. On top of that it uses indicators from the MVT project, published by Amnesty International, Citizen Lab and other researchers who investigate Pegasus, Predator and similar tools.
A name only counts when it appears as a whole name in the log. Short Pegasus process names such as “bh” used to match words like “github”; they no longer do. Names that are also normal iOS system processes are left out, because finding them proves nothing.
Why the indicator list cannot be tampered with
- 1. Every night our server builds a bundle from the MVT indicator index.
- 2. It signs the bundle with an Ed25519 private key that only exists on the server.
- 3. The app checks the signature against the public key built into it, and only uses the bundle if it matches. If it does not, it keeps the last set that did.
So a fake bundle — from a compromised network or anyone else — cannot add or remove indicators. Findings are never uploaded to a shared list either: unverified reports from users are how threat lists get poisoned.
What leaves your computer
Every connection the app can make, taken from the app's code. If you watch its traffic (see Verify us yourself below), this is the list you should be able to tick off.
Whenever the app is online
Licence and balance check
harisshield.com
Your licence key and a computer ID — a short hash made from the computer's name, user name, processor, architecture and memory size. The answer is a balance proof signed by our server, which lets the app keep scanning offline for 14 days.
Scan count after each scan
harisshield.com
Licence key, computer ID, iOS or Android, the number of findings, a random scan ID and the time. This is how scans are counted against your balance. Not what was found, and nothing from the phone. Without a connection the report waits and is sent later.
Signed indicator bundle
harisshield.com
A download of the latest spyware indicators (see above). Nothing about you or your phone is sent with it.
Update checks
harisshield.com
With a licence key activated, the app checks for updates at launch and every four hours and downloads new versions, sending the licence key so the server will release the file.
Connecting a computer to your licence
harisshield.com
When you connect a new computer: the computer ID and the computer's name, so the confirmation email can tell you which computer is asking.
Only when you use a feature
Component verification (part of a full iPhone scan)
checkcoverage.apple.com, support-sp.apple.com
The iPhone's serial number, to look up the model and warranty status from Apple.
Certificate check during an Android scan
Servers the Android phone is talking to
The app opens short TLS handshakes from your computer to some of the public servers the phone has open HTTPS connections to (at most 18 handshakes per scan), to inspect their certificates. Those servers see your computer's IP address. In a network monitor this shows up as the openssl process.
Live network monitor
ipinfo.io
The IP addresses your phone connects to while the monitor runs — the servers' addresses, not yours — to show their country and owner. If you entered your own ipinfo token, it is sent too.
Breach check
haveibeenpwned.com
The email address you type in. The check needs your own Have I Been Pwned API key; without one the request is still sent but returns no results.
Error reports — off unless you tick the box
harisshield.com
Only from a fixed list of fields: app version, operating system, architecture, which step failed, error type and code, function name, iOS or Android, and an 8-character hash of the licence key. Never error messages, file paths, phone details, findings, your licence key or your email.
Older licence keys only
api.lemonsqueezy.com
Keys that do not start with HRS- were sold through Lemon Squeezy and are activated and checked there, with the key and the computer ID.
After repeated failed activations
harisshield.com
The computer ID and how many attempts failed, so a key cannot be guessed by brute force.
Never sent
- Messages, photos, contacts, call logs or email
- The list of apps on the phone
- Crash reports, shutdown.log or your sysdiagnose
- What a scan found, or the scan report itself
Scan results and reports stay in the app's folder on your computer until you delete them or choose to share a PDF.
Offline mode, and what it does not cover
Offline mode in the app's settings stops the indicator download, the IP lookups in the network monitor and the breach check. It does not stop the licence and balance check, update checks, the serial number lookup or the Android certificate check.
For a scan with no connection at all, disconnect the computer from the internet. After the app has been online once, it keeps scanning for up to 14 days on its last signed balance proof, using the indicators it already has. Scan counts are sent when you reconnect.
What no tool can promise
No tool can prove a phone is clean
Haris Shield finds traces that are known. The MVT project says the same about its own tool: public indicators are not enough to declare a device clean.
The most advanced spyware can stay hidden
Pegasus-class tools are built to leave as little as possible, and new versions are in use before anyone has published indicators for them. They can evade this scan, and any other.
“No threats found” is not “safe”
It means none of the known traces turned up. If your situation puts you at real risk, get a second opinion from the experts listed below, whatever our result says.
Where we are today
Some things are not finished yet. You should know which.
Not yet notarised by Apple
That is why macOS says the developer cannot be verified and you have to choose Open Anyway the first time. Apple Developer ID signing and notarisation are being set up.
Not yet code-signed for Windows
That is why Windows shows “Windows protected your PC”. Code signing is being set up. Until both are in place, the operating system cannot confirm that a file came from us — the checksums below can.
Builds
The Mac build runs on Apple Silicon only, and the Linux build on x86-64 only. See the download page.
Verify us yourself
A security tool asks for a lot of trust. These are real, independent ways to check that Haris Shield does what this page says — and to check your phone with someone other than us.
1. Check the installer
Upload it to VirusTotal. Drop the file you downloaded on virustotal.com and around 70 antivirus engines scan it. Read which engines flag something and what they call it, not just the count.
Compare the SHA-512 checksum. If the checksum of your file matches the one below, it is exactly the file we published. These are the same values the app's updater checks.
Version 1.0.12:
macOS · Haris Shield-1.0.12-arm64.dmg
128 MB
a30cdb5ff75664f2756783e224f3cee32a35a30f5f30b1980d772db4f151e76b4fbb9616dd86d6e17bfa5c280336c5175481af04674099cbfeefff441de0e4cd
Windows · Haris Shield Setup 1.0.12.exe
110 MB
82824cca94085f4c02b906d9ef8c2bcc8866c02f5f042961e3746a863e814193bea37f414c81a3f7d04f55cbc756a5d91da4fbe6eddf1a98ddf10758e853aa71
Linux · Haris Shield-1.0.12.AppImage
124 MB
0e715cf0dfaf52e4e21160e012dcfd80362cf04aa63c918aaf960e1fad812e80e14c152240c793ebbc46ca268e526b7d5477839e4d087ffb25096dd012a9cde8
Linux · phoneguard_1.0.12_amd64.deb
98 MB
1cf55d2415b5daf55a4a647954b1001e451ee9bef737804b9e6a4b4aa1da43754f3e93f7be7ba8fda68fffc521900c05d85c434b505d51ea9801e0a310815e8a
Mac (Terminal)
shasum -a 512 <file name>
Linux (terminal)
sha512sum <file name>
Windows (PowerShell)
Get-FileHash -Algorithm SHA512 <file name>
Upper or lower case does not matter when you compare.
2. Watch the app's network traffic
Run one of these while you scan. You should see Haris Shield talk to harisshield.com and, only when you use those features, to the services in the list above. The connection to the phone itself goes over USB and does not appear as internet traffic.
Mac
- LuLu
Free and open source, from Objective-See. Asks before any app makes a new outgoing connection and shows where it goes.
- Little Snitch
Paid, from Objective Development. Shows every connection per app, live and on a map.
Windows
- TCPView
Free, from Microsoft Sysinternals. Lists every open connection with the process that owns it.
- GlassWire
Has a free version. Shows which hosts each app connects to.
- Windows Defender Firewall
Built in. Block Haris Shield completely if you want to confirm that scanning still works without a network.
Linux
- OpenSnitch
Free and open source. Prompts per app for outgoing connections, like LuLu.
3. Get a second opinion on your phone
None of these are connected to us. If you are a journalist, activist or anyone else who may be targeted, contact the helplines directly — they do this work every day.
- Mobile Verification Toolkit (MVT)
Amnesty International Security Lab
Free, open-source forensic tool for iPhone and Android, built during the Pegasus Project. It runs from the command line and is meant for technologists and investigators, not for a quick self-check. Haris Shield uses the same public indicators.
- iVerify Basic
iVerify
An app for iPhone and Android from an independent mobile security company. It checks the phone for signs of Pegasus-type spyware from the phone itself — a useful second view from a different angle.
- Digital Security Helpline
Access Now
Free help around the clock, in several languages, for journalists, activists, human rights defenders and civil society groups who think they are targeted.
- Security Lab — Get help
Amnesty International
Support for journalists, activists and civil society organisations at risk from targeted digital attacks such as Pegasus.
- Coalition Against Stalkerware
stopstalkerware.org
A directory of helplines and support organisations by country for people worried that a partner or someone close is monitoring their phone. Look it up from a device that person has never had access to.
Found something on this page that does not match what the app does? Tell us at support@harisshield.com. See also our privacy policy.