From Newsgroup: alt.comp.os.windows-10
Marion wrote:
This is getting long so I'll post the results in the next post instead.
But here is the comment section showing I added all your suggestions.
Please keep them coming as I don't care what the KEV database says.
I care only that we correctly analyze what it says.
It's what intelligent people do.
Below is the latest kev.ps1 version
This kev.ps1 is a cross-platform (mac/linux/windows) PowerShell script that analyzes the CISA Known Exploited Vulnerabilities (KEV) catalog to estimate how many listed CVEs affect Apple (iOS/macOS) and Android platforms.
It uses keyword matching to classify exploits, filters out false positives, and outputs a summary with counts for Apple-related, Android-related, and shared vulnerabilities.
Here is the latest summary from that file (with macOS exploits excluded). Detailed logs are output for every CVE found, for reliable auditing.
###############################################################################
# Define script version
$scriptVersion = "kev.ps1 version 2.4 20250930"
## An Extensible cross-platform batch/powershell script to parse CISA KEV db
## Analyzes the CISA Known Exploited Vulnerabilities (KEV) database
## to compare iOS and Android-related security threats.
## a. Downloads lates KEV CSV or uses a local copy of the KEV CSV file
## b. Filters out irrelevant entries (e.g., smart appliances, printers)
## c. Uses keywords & vendor-product logic for platform-specific exploits
## d. Identifies shared vulnerabilities affecting both ecosystems
## e. Logs results to timestamped files in a clean ./logs directory
## f. Outputs Apple vs Android exploit summaries to console & log files
## All logs are saved in the ./logs directory:
## A. ios_matches_YYYYMMDD_HHMMSS.log
## B. android_matches_YYYYMMDD_HHMMSS.log
## C. shared_matches_YYYYMMDD_HHMMSS.log
## D. kev_output_YYYYMMDD_HHMMSS.log (summary)
## Note the CISA KEV db lists only about 6% of all known vulnerabilities!
## <medium.com/@yotamperkal/cisa-kev-a-balanced-perspective-ff3856e69ba9>
## That's because the KEV db only contains exploits meeting these criteria:
## 1. The exploit has a valid CVE ID.
## 2. There is reliable evidence of active exploitation.
## 3. A clear remediation action is already available to the general public.
###############################################################################
## Windows Usage: C:\> kev.bat
## Where kev.bat is the following three lines of code:
## set "PS_SCRIPT=kev.ps1" REM iOS vs Android known patched exploits
## powershell -ExecutionPolicy Bypass -File "%~dp0%PS_SCRIPT%"
## pause
## Linux/macOS Usage: $ pwsh ./kev.ps1
## Requires PowerShell Core (pwsh) <
https://github.com/PowerShell/PowerShell>
## Make sure execution policy allows script execution:
## $ pwsh -Command "Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass"
###############################################################################
## Version 1.0 20250829 (41L)
## Extensible Windows batch/powershell script to parse csv/json CISA KEV db
## Uses powershell to parse csv/json CISA database for iOS vs Android
## Added comment discipline rules for ASCII-only and no oxford comma
## CSV downloaded from GitHub mirror of CISA KEV database
## Keyword logic uses lowercase match on vendor, product, and vuln name
## Matching uses wildcard logic with simple substring detection
## Results printed to console with Write-Host
## Script can be extended to log output or refine keyword logic
## Verson 1.1 20250929 (56L)
## Adds time-stamped output file to current directory
## Uses Get-Date with custom format for filename
## Output file includes iOS and Android known exploit counts
## Output file UTF8 encoding for platform/editor compatibility
## Version 1.2 20250929 (68L)
## Expands keyword logic for iOS and Android ecosystems
## Adds ipad, watchos, macos, pixel, samsung, qualcomm, mediatek
## Improves platform distinction across shared components like WebKit
## Android common vendors & chipsets: pixel, samsung, qualcomm, mediatek
## iOS platforms: ipad, ipados, watchos, macos
## Used Join-Path to make filespecs usable on Windows/Linux/macOS
## Version 1.3 20250929 (87L)
## Added an output log to a separate file of each match with its source line
## Modified filespecs to enable macOS/Linux PowerCore portability
## Version 1.4 20250929 (97L)
## Included CVE ID in logs (Adds traceability & audit value)
## Added platform detection (Join-Path & $PWD)
## Add toggle for local file (avoid unnecessary d/l when testing)
## Version 1.5 20250929 (108L)
## Add exclusion filtering logic (e.g., samsung TVs)
## Exclusion filtering removes Apple smart home devices.
## Version 1.6 20250929 (130L)
## Added shared-match detection to avoid double counting overlapping attack
## surfaces in platform-specific summaries
## Version 1.7 20250929 (141L)
## Added vendor-product dictionary-style mapping to excluse false positives
## like "Samsung tv" or "refrigerator" or "Apple tv" or "homepod"
## Version 1.8 20250929 (148L)
## Refined keyword logic for deeper iOS & Android exploit detection
## around shared components like WebKit & cryptographic modules
## Apple includes subsystems like secure enclave, coremedia & launchd
## Android includes cryptographic modules & shared components like
## keymaster, webkit & play services.
## Version 1.9 20250929 (163L)
## Moved all log files into ./logs directory to reduce clutter
## Added usage instructions for macOS/Linux (pwsh)
## Version 2.0 20250929 (207L)
## Added toggle to include/exclude macOS from iOS counts
## Fixed platform detection (Join-Path & $PWD) console output
## Version 2.1 20250929 (212L)
## Added output of the1 PowerShell version (in case of mismatches)
## Version 2.2 20250930 (219L)
## Added date in the console output
## Version 2.3 20250930 (228L)
## Removed false positives from desktop and server-side CVEs
## Added 'chromium' & 'mojo' to iOS & Android keyword lists
## Improved detection of shared browser & sandbox escape exploits
## Added exclusion for Fortinet, Cisco, Oracle & Adobe using keywords of
## fortinet, fortios, fortiproxy, cisco, oracle, adobe, jenkins, mozilla,
## nagios, redis, qnap, crushftp
## Version 2.4 20250930 (231L)
## Added the script version to the console output for auditing purposes
###############################################################################
# Platform detection (v2.3)
$platform = $PSVersionTable.PSEdition
$version = $PSVersionTable.PSVersion
if ($platform -eq "Desktop") {
Write-Host "Running on platform: Windows PowerShell"
} elseif ($platform -eq "Core") {
if ($IsWindows) {
Write-Host "Running on platform: Windows (pwsh)"
} elseif ($IsLinux) {
Write-Host "Running on platform: Linux (pwsh)"
} elseif ($IsMacOS) {
Write-Host "Running on platform: macOS (pwsh)"
} else {
Write-Host "Running on platform: Unknown Core edition"
}
} else {
Write-Host "Running on platform: Unknown"
}
Write-Host "PowerShell version: $version"
# Download the KEV CSV from GitHub
$useLocalFile = $false # Set to $true for testing of existing downloads
$useLocalFile = $true # Set to $false to force download
$includeMacOS = $true # Set to $false to exclude macOS in iOS counts
$includeMacOS = $false # Set to $true to include macOS in iOS counts
if ($useLocalFile) {
$csvPath = Join-Path -Path $PWD -ChildPath "kev.csv"
Write-Host "Using local file: $csvPath"
} else {
$csvUrl = "
https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.csv"
$csvPath = Join-Path -Path $PWD -ChildPath "kev.csv"
Invoke-WebRequest -Uri $csvUrl -OutFile $csvPath
Write-Host "Downloaded fresh file: $csvPath"
}
# Define keyword logic for iOS and Android
# iOS includes Apple platforms and WebKit-based browsers
$iosKeywords = @(
"apple", "ios", "ipados", "watchos", "webkit", "safari",
"secure enclave", "coregraphics", "coremedia", "corefoundation",
"springboard", "launchd", "sandbox", "chromium", "mojo"
)
if ($includeMacOS) {
$iosKeywords += "macos"
}
# Android includes Google platforms and common Android vendors
$androidKeywords = @(
"android", "google", "pixel", "samsung", "qualcomm", "mediatek",
"play services", "keymaster", "keystore", "secure element", "omapi",
"webkit", "chromium", "mojo"
)
# Initialize counters for each platform
$iosCount = 0
$androidCount = 0
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$logDir = Join-Path -Path "." -ChildPath "logs"
if (-not (Test-Path $logDir)) {
New-Item -ItemType Directory -Path $logDir | Out-Null
}
$iosLogPath = Join-Path -Path $logDir -ChildPath "ios_matches_$timestamp.log"
$androidLogPath = Join-Path -Path $logDir -ChildPath "android_matches_$timestamp.log"
$sharedLogPath = Join-Path -Path $logDir -ChildPath "shared_matches_$timestamp.log"
$outputFile = Join-Path -Path $logDir -ChildPath "kev_output_$timestamp.log"
# Parse KEV CSV and count keyword matches
$excludeKeywords = @(
"refrigerator", "tv", "washer", "dryer", "smart appliance", "iot", "industrial", "printer",
"apple tv", "homepod", "airtag", "fortinet", "fortios", "fortiproxy", "cisco",
"oracle", "adobe", "jenkins", "mozilla", "nagios", "redis", "qnap", "crushftp"
)
$vendorProductMap = @{
"samsung" = @("galaxy", "android", "mobile", "tablet")
"qualcomm" = @("snapdragon", "modem", "chipset")
"apple" = @("iphone", "ipad", "ios", "watchos", "macbook")
}
if ($includeMacOS) {
$vendorProductMap["apple"] += "macos"
}
Import-Csv $csvPath | ForEach-Object {
$text = ($_.vendorProject + " " + $_.product + " " + $_.vulnerabilityName).ToLower()
$vendor = $_.vendorProject.ToLower()
$product = $_.product.ToLower()
# Skip irrelevant matches
if ($excludeKeywords | Where-Object { $text -like "*$_*" }) {
return
}
# Skip mismatched vendor-product combos
if ($vendorProductMap.ContainsKey($vendor)) {
$validProducts = $vendorProductMap[$vendor]
if (-not ($validProducts | Where-Object { $product -like "*$_*" })) {
return
}
}
$logEntry = "$($_.cveID): $text"
$iosMatch = $iosKeywords | Where-Object { $text -like "*$_*" }
$androidMatch = $androidKeywords | Where-Object { $text -like "*$_*" }
if ($iosMatch -and $androidMatch) {
$iosCount++
$androidCount++
Add-Content -Path $iosLogPath -Value "$logEntry`n"
Add-Content -Path $androidLogPath -Value "$logEntry`n"
Add-Content -Path $sharedLogPath -Value "$logEntry`n"
} elseif ($iosMatch) {
$iosCount++
Add-Content -Path $iosLogPath -Value "$logEntry`n"
} elseif ($androidMatch) {
$androidCount++
Add-Content -Path $androidLogPath -Value "$logEntry`n"
}
}
# Output results to console
Write-Host "KEV vulnerability summary ($scriptVersion) for: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
Write-Host "Estimated Apple-related exploits: $iosCount"
Write-Host "Estimated Android-related exploits: $androidCount"
if (Test-Path $sharedLogPath) {
$sharedCount = (Get-Content $sharedLogPath | Measure-Object).Count
Write-Host "Estimated shared exploits: $sharedCount"
Add-Content -Path $sharedLogPath -Value "Shared iOS/Android vulnerabilities:`n"
Add-Content -Path $sharedLogPath -Value "`nTotal shared matches: $sharedCount"
} else {
Write-Host "Estimated shared exploits: 0"
}
# Create time-stamped output file in current directory
# $outputFile = "kev_output_$timestamp.log"
# Allow for macOS/Linux PowerShell Core portability (filespec syntax)
# Write results to file
@(
"KEV vulnerability summary $timestamp",
"Estimated Apple-related exploits: $iosCount",
"Estimated Android-related exploits: $androidCount"
) | Out-File -FilePath $outputFile -Encoding UTF8
# Append a summary line to each match log (v1.4)
Add-Content -Path $iosLogPath -Value "`nTotal iOS matches: $iosCount"
Add-Content -Path $androidLogPath -Value "`nTotal Android matches: $androidCount"
###############################################################################
## end of kev.ps1
###############################################################################
--
--- Synchronet 3.21a-Linux NewsLink 1.2
