For most of its existence, Apple has built its reputation on sleek design and marketing and delivering the new thing before people even know they want it. Recently, that new thing has often been new privacy and security features, and this fall the company plans to release a major option in iOS that will provide a significant new level of security for people who are at serious risk of highly targeted attacks.
When iOS 16 debuts in the fall, it will include a new set of security capabilities known collectively as Lockdown Mode, which Apple describes as an “extreme, optional level of security.” The capabilities are designed to remove much of the attack surface that sophisticated attackers, such as NSO Group and others that sell commercial spyware to state actors, use to compromise iPhones. Lockdown mode is specifically designed for high-risk user groups, such as activists, journalists and political dissidents, and will severely limit the iPhone’s functionality when enabled. Among other things, Lock Mode will block most message attachments, disable JIT and other network technologies, prevent configuration profiles from being installed, and block wired connections to computers or accessories when the phone is locked.
Users will be able to turn on the lock mode themselves, but they will not be able to turn on and off individual capabilities that are part of the new security suite.
“While the vast majority of users will never be victims of highly targeted cyber attacks, we will work tirelessly to protect the small number of users who are.” This includes continuing to design defenses specifically for these users, as well as supporting researchers and organizations around the world who are doing the critical work of uncovering the mercenary companies that create these digital attacks,” said Ivan Krstic, Head of Engineering and Architecture of security at Apple.
The pool of companies selling high-end custom spy tools is relatively small, but the effect they have on the people their products are aimed at is profound. The targets are often dissidents or activists in authoritarian states, journalists, social activists and others who become a nuisance to the governments that buy these tools. Security researchers at Citizen Lab have uncovered widespread use of the Pegasus spyware sold by NSO Group in many countries, including the UK, Bahrain, Jordan and others, and in many cases victims of these attacks have been compromised in some way through their mobile devices . Some of these hacks involved new exploits against previously unknown iOS vulnerabilities, often via text messages.
The blocking mode aims to remove as many of these attack vectors as possible off-board, and the researchers say it’s an important step forward not only for at-risk users, but for the larger user population as well.
“Many features provide a road map to better security for everyone.”
“Using lock mode is like banishing attack categories. It won’t prevent you from being vulnerable to anything. It’s important that major OS developers focus on providing better protection to users,” said John Scott-Railton, senior researcher at the Citizen Lab at the University of Toronto’s Munk School.
“It’s also light immersion, and it’s important that major platforms have higher security features.” The thinking is sometimes that more security can provide more friction, but users like these features. This is the first step towards implementing better protections. There is a collective action problem. If companies are competing with each other, they are sometimes reluctant to add features that may push users to their competitors. But this is an important move.”
Many of the technologies and features that have had the greatest impact on improving network security began as tests or features intended for small groups of people. One example is the use of HTTPS, which browser vendors initially encouraged, then made optional and eventually made the default connection mode. Almost all traffic on major platforms is now encrypted.
“When you zoom in, it’s like an antibiotic, like, Did you get all the bacteria? Or all threats? It makes the next big step easier,” Scott-Railton said.
And while Lockdown Mode is specifically designed for people who are at high risk of being attacked by commercial spyware or other advanced threats, the benefits will accrue to everyone in the end.
“High risk users should also mean people who run banks, celebrities, well-known crypto investors. Anyone who is at an elevated threat level,” Scott-Railton said. “Many features provide a road map to better security for everyone.”
Add Comment