Apple previews Lockdown Mode

https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/

by todsacerdoti • 4 years ago

1577 731 4 years ago

apple.com

Nextgrid9• 4 years ago

Most of the features of this lockdown mode should be on by default.

egberts16• 4 years ago

ESPECIALLY the disabling of JavaScript, because … malicious JacaScript.

phoe-krk• 4 years ago

This does not seem to disable JS altogether, only JS JIT compilation. IIUC, JS will still be executed, although via an interpreter (which is safer) rather than via compiled machine code (which might be used to exploit memory safety bugs such as type confusion, somewhat frequent on the JS side).

jimt1234• 4 years ago

Totally agree. I'm also concerned about the fine print, what Apple is not announcing - like, "Oh, we also updated our EULA to reflect that metadata from phones with 'lockdown mode' enabled will be forwarded to the FBI", something like that.

someguydave• 4 years ago

This lockdown mode looks like what ought to be default security behavior.

andrewia3• 4 years ago

It slightly degrades some experiences, so I see why it's disabled by default. Disabling JIT JavaScript is going to make web browsing more painful. And incoming friend requests are useful because it simplifies things when two people are adding each other to their phones - one sends a request and the other reciprocates.

JCWasmx86• 4 years ago

Disabling JIT JavaScript

With a bit of luck, this will cause site operators to reduce their usage of unnecessary JS, so maybe this has positive impacts :)

jka• 4 years ago

It slightly degrades some experiences, so I see why it's disabled by default.

My sense is that the functionality to provide those experiences resulted in a decrease in user security and privacy when they were introduced -- and that those risks were widely-discussed and well-understood.

It's weird (although not unexpected) to see the reversal of them touted as a selling point.

_the_inflator• 4 years ago

"Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode."

Highly interesting, that Apple is doing this. This is a thing. MS and Google are also taking steps to harden Chromium security against JIT compiler issues with JavaScript. https://www.zdnet.com/article/securing-microsoft-edge-switch...

colechristensen2• 4 years ago

I just don't want most of the programming capabilities on the web, plain old hypertext with a bit of style is enough. There are plenty of other ways to run software on a computer than inside a web browser.

simion3142• 4 years ago

I agree half way with you, we need the web split into 2 parts, webpages and apps.

I seen some cool simulation, small apps, small games that I can just test online and not have to install them on my machine. Apple would love that we all got scared and only use installed apps from their store but the web is a decent deliver platform.

If we could have a modern subset of html and css for news websited and blogs , and the rest of js for web apps then you can have the option to turn off teh advanced settings or we could have different browsers that could focus on different things, like a website reader browser that does not care about super fast JITed JS it would not support webgl,camera or microphone acccess, it would just focus on text layout and simple forms,

and a web app browser that focuses on extreme optimizing for JS , canvas and webgl operations, camera and microphone access.

capableweb3• 4 years ago

Most (if not all) browsers allow you to disable JS, so that seems like the perfect preference for you. I know it works on Chrome and Firefox on desktop (I use the NoScript extension myself, that blocks JS by default but allows you to enable it per-site), I can imagine it works the same on smartphones as well.

kderbyma3• 4 years ago

just seems more antiweb from Apple. they love to ruin the web and make it harder to avoid their walled app garden....it's a money ploy to fight web apps and make their little devices even less useful.

wmf2• 4 years ago

Defense in depth is good. Apple is finally getting over their faith in their sandbox.

fbanon• 4 years ago

Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.

This should be ON by default. It would force webdevs to write efficient websites.

iasay• 4 years ago

They’d just work out how to write web apps entirely in CSS instead somehow.

colechristensen2• 4 years ago

Can I turn these features on one by one by some other method? (self-managed MDM, or something else?)

jackson1442• 4 years ago

Self-managed MDM is the way to go for most of them. I think the main one that can't be achieved thru MDM is the browser lockdown. MDM has a lot of other security policies available though.

mcculley9• 4 years ago

This is great but too big of a hammer for most use cases. What I really want is a per-application firewall.

For example, say I would like to install a photo editing application. It would need access to my photos. That is fine, so long as it is not allowed to connect to the Internet (or any other network). There is currently no way to ensure this.

imdsm• 4 years ago

I use little snitch for this, but I agree, a big hammer, and likely more hoops for regular developers to jump through. Notarisation, signing, forced developer keys...

post_break3• 4 years ago

Little Snitch is great. Apple would never allow it on iOS which is ridiculous.

mcculley9• 4 years ago

I use Little Snitch on macOS, but it is not available on iOS, so far as I know. Normal apps on iOS do not have enough visibility into the system for that.

radicaldreamer• 4 years ago

None of which is particularly effective since it's trivial to setup a legal entities that makes one game but signs a bunch of malware (or steal enterprise keys).

olliej4• 4 years ago

Edit: apparently I was wrong here? Though I'd swear it had the feature?

mcculley9• 4 years ago

Where do you see this in iOS? The Settings app has many permissions for applications, but no "Internet" permission.

LeoPanthera• 4 years ago

It does not ask for internet access, it asks for access to other devices on the LAN. Not the same thing.

Nextgrid9• 4 years ago

You can disable app's cellular data access, but that's it, at least on Western phones. Ironically, phones for the Chinese market actually expand that setting and also allow to block Wi-Fi access.

briffle• 4 years ago

I'd go a step further, and say per-application virtualization. Every single program running its own (ideally encrypted memory) namespace, with its own assigned memory, etc.

muricula• 4 years ago

That's what the ios sandbox provides. Heck, the tools arm64 gives you to isolate VMs are awfully similar to the tools they give you to isolate processes. VM escapes aren't too different than sandbox escapes.

Encrypted memory isn't part of arm yet, I was holding out hope with armv9 "realms" but not so.

jmprspret• 4 years ago

I think this is one of the very (very) long term goals of the GrapheneOS project.

fsflover2• 4 years ago

So basically Qubes OS on a phone?

lolsal• 4 years ago

This is great but too big of a hammer for most use cases.

This is not in any way intended for most use-cases, it's very clearly intended for a single, specific, uncommon use-case. The press release says as much more than once.

mcculley9• 4 years ago

I guess my point is that instead of making a special mode that is only useful for a minority of users, it would have been really nice to get a feature that everybody should be thinking about and using.

varenc• 4 years ago

Agreed. I wish iOS had a "network access" permissions just like Android does. (Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny)

That said, I think this is pretty unrelated to protecting yourself from nation state actors. Mercenary spyware (like NSO) doesn't use a legitimate app store app as their initial infection point. I can think of many reasons for this: difficulty getting target to install it, app store approvals, leaking their 0days, leaving more of a paper trail, and avoiding scrutiny in general, etc. I'd of course love this feature for my own data privacy of course.

mcculley9• 4 years ago

(Though to avoid permission fatigue for the average user, perhaps make it something only users that care can deny)

Yeah, I would not want to have to approve every app. What I would like is a machine readable description of the app's capabilities to include Internet access, just as is required for access to the microphone or photos. This would encourage app developers to advertise to users that they don't need such capability and encourage users to realize that privacy and Internet access are mutually exclusive.

There are many small apps I simply will not buy/install (e.g., apps for editing photos or contacts or calendars) because they cannot be trusted. Even if you trust the developer, the developers are often embedding third party analytics libraries that cannot be trusted.

derefr5• 4 years ago

It's not exposed in the UI, but if you really care, you can just create yourself a configuration profile that disables various per-app permissions (including network access, per-domain/per-IP/per-certificate) on a fairly fine-grained basis. MDM yourself.

Georgelemental2• 4 years ago

Stock Android doesn't allow denying network permissions, it would eat into Google's ad revenue

krrrh• 4 years ago

That would be a pretty interesting VPN service if you could easily deploy it as a docket container. Something simple that could give Little Snitch like whitelisting.

The Charles proxy iOS app doesn’t have the ui to support this, it’s clumsy to whitelist domains, but it does provide some visibility into what domains are being accessed.

TheRealDunkirk• 4 years ago

Sounds like a plan to make iOS the default for highly-placed government employees. Maybe that's already the case, but I thought I remembered that Obama had to have 2 phones, and the "secure" one wasn't an iPhone. Anyone have any more knowledge about this?

ceejayoz• 4 years ago

The secure one was a BlackBerry for a while. https://www.theverge.com/2016/6/11/11910306/obama-upgrades-f...

easton• 4 years ago

I'm guessing it isn't, if only because this feature completely disables MDM (which you'd need in government or business to do things like remote wipes or passcode policies). It looks to be designed for people that are possible targets to use on their personal phone, which shouldn't have work data on it.

(Of course, they could make some new MDM policies to individually turn these features on. You can already block external devices with MDM, and you can completely disable FaceTime/iMessage/iCloud. It wouldn't be much of a jump to add the more granular protections this has.)

bad416f1f5a2• 4 years ago

I think you’ve misread this announcement: it doesn’t appear that MDM is disabled. It merely looks like you cannot change MDM settings, including enrolling, while this feature is active.

InitialLastName• 4 years ago

At least at the start of the Obama Administration, he was known to be hooked on his Blackberry [0], and I know RIM did a lot of work to provide secured devices to government officials. I don't know what government officials are using since RIM went under though.

[0] https://www.nbcnews.com/id/wbna28780205

the_other3• 4 years ago

With this announcement, Apple are saying "we will protect you from state actors", which is a role usually performed by states. Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world": It's a flag-raise.

It's the first such flag-raise I've seen. Security researchers talk about protections from state actors all the time, and there are tools which support that... but this is the first public announcement, and tool, from a corporation with more spare, unrestricted capital than many countries. It comes at a time when multiple nation states are competing for energy and food security; and Apple are throwing up a flag for a security-security fight (or maybe data-security). This is not just handy tech, it's full-on cultural zeitgeist stuff. Amazing.

ivraatiems4• 4 years ago

The NSO Group, whom Apple specifically cites as an opponent that inspired this work, is a private corporation. They sell to governments, but so does Apple.

The relationship between state and private industry has never been binary and has always had features like this. I don't think this is a "Jennifer Government" type scenario.

thehappypm2• 4 years ago

NSO is pseudo-private, kind of like Raytheon.

bsedlm2• 4 years ago

agreed, the rise of the corporation as the most powerful institution (above the nation-state) in this new budding global civilization is a long time coming.

on the other hand, this is how democracy dies. what structures (systems) exist to prevent apple (and other comparable corporations) from being an oppresive force against human persons? moreover, what incentives do they have?

kube-system5• 4 years ago

Corporations definitely have a lot of power today, but nothing more than they've had in the past.

https://en.wikipedia.org/wiki/Company_rule_in_India

scottyah• 4 years ago

To be fair, banks have been more powerful than a lot of nation-states for awhile, and religious entities before that.

saurik• 4 years ago

Based on their history of using their control over the App Store to "protect people" from such harmful content as content about how smartphones are made in sweatshops and tools (such as VPN clients, but also for a long time cryptocurrency wallets) that allow people to bypass restrictions put in place by these nation states that Apple works with, I'd claim these incentives are pretty shit :(.

https://www.youtube.com/watch?v=vsazo-Gs7ms

ryandrake• 4 years ago

I can think of a few, at least applicable in the USA:

Apple doesn't have a military or police force with jurisdiction over me. They don't have the legal power to arrest me or throw me into prisons, which they also don't have. I don't have to pay taxes to Apple. I don't have to do business with them or interact with them in any way if I don't want to. I don't need Apple's permission to do anything unrelated to their product lines.

Same is true for any megacorporation. It's a big stretch to say they are even remotely as powerful as nation-states, let alone more powerful.

Omniusaspirer• 4 years ago

Apple is a public corporation and votes on its corporate direction are freely available on the open market for anyone to purchase. Based on my share ownership Apple is much more subject to my whims than my actual elected politicians are on a % basis.

axolotlgod• 4 years ago

Definitely very interesting. I know Google has their “Advanced Protection Program”[0] with a Titan security key which is similar. It is interesting considering that Google’s protections target the user as the weak link, as your data lives on their hardware; while Apple is obviously targeting both the user and the hardware they have. I’m curiuos what security researchers will think of this, if it’s more theater or if it is actually a innovative attempt at giving advanced privacy to people who need it. Despite their past stumbles (e.g., CSAM), it seems like Apple is genuinely in the privacy fight, even if it is just for their bottom line.

[0] https://landing.google.com/advancedprotection/faq/

alwillis19• 4 years ago

"About Apple threat notifications and protecting against state-sponsored attacks": https://support.apple.com/en-us/HT212960

legalcorrection6• 4 years ago

I think you're letting the reality distortion field get to your head. They're creating a safe mode for iPhones because a lot of features complex/intricate enough that they are perennial sources of vulnerabilities (and/or UX flaws that lead users to make unsafe decisions).

That is, they're turning features off for security. Something every IT department has been doing for decades. Windows supports this. Mac OS supports this. In fact, iOS was kind of notable in being so unconfigurable. The settings available in their MDM implementation were pitiful and didn't let admins disable many of these features.

saagarjha8• 4 years ago

One difference is that Apple is actually quite good at understanding which features get exploited in zero-click attacks and IT departments are not.

Swizec3• 4 years ago

Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world"

Apple's profits are bigger than my country's (Slovenia) whole GDP. You bet your butt they're a state level actor in the digital world. They have more resources than many countries.

If Apple was a country, their $365bn in revenue would make them the 43rd richest country in the world right after Hong Kong.

https://en.wikipedia.org/wiki/List_of_countries_by_GDP_(nomi...

amelius2• 4 years ago

And if you computed the per-capita GDP?

nradov2• 4 years ago

This also points out how the increasing costs of technology and economies of scale mean that small countries like Slovenia are no longer viable on their own. The only way they will be able to survive the next few decades and avoid turning into failed states is to surrender most of their sovereignty to larger regional alliances.

whatgoodisaroad• 4 years ago

At the same time, if that state actor happens to be China, Apple will just give the government access to your iCloud data. Not all state actors are equally within Apple's striking range.

milesskorpen• 4 years ago

If you opt-in to iCloud, you're opting in to a lot of state-level security risk in any country (and this is true of any commercial cloud).

KerrAvon2• 4 years ago

What makes you think so?

jonny_eh• 4 years ago

Apple will just give the government access to your iCloud data

"You" only means you if you're a Chinese citizen.

ivraatiems4• 4 years ago

I mean, since your phone was made there by a Chinese company, what's to stop the government from just forcing a backdoor in at the factory?

Matl• 4 years ago

It is worth mentioning that things like National Security Letters exist in the US. It is also the US who made Apple back off of encrypting iCloud backups E2E.

I wish we were more willing to cite our own government(s) as the bad actors here, rather than pretending that we have to reach for China/Russia/North Korea to find the kind of behavior Apple is attempting to protect its users against here.

kube-system5• 4 years ago

Yes, this is Apple protecting you against extralegal state actor threats. There's not really much Apple can do to protect you against the laws of your own country.

acomar• 4 years ago

and if the state actor happens to be the US? which of these tech companies do you expect to look after you then?

KennyBlanken3• 4 years ago

Apparently that protection does not include protection from the US government.

iMessage offers excellent privacy of message content, but no 'pen register' protection.

Phone device security is very strong, but it's made largely moot if you turn on iCloud backups (which is the default behavior if you provide an Apple ID. I'm not sure there's even a way to stop the initial backup from happening?)

Apple reportedly doesn't offer e2ee on iCloud, or even encrypted device backups, out of compromise with the federal government...specifically the FBI, CIA, and NSA.

Why might people care about this? Criminalizing abortion and miscarriages...and what looks like at the very least a re-recognizing, and possibly criminalization, of LGBTQ relationships.

eastbound• 4 years ago

True, Apple could stop nagging about backing up into iCloud.

Apple should offer other sorts of backups, and offline iCloud systems.

kube-system5• 4 years ago

When Apple says "state actor threats" they're not talking about future-state theoretical breaches of domestic privacy by your own government. Apple is always going to follow the law. They're talking about the types of situations where data from people's phones is used to commit international criminal activity, espionage, assassinations, etc.

germandiago6• 4 years ago

I know it is a very polemic topic but I genuinely think abortion is a crime, not a right.

Not anything against LGBTQ or the like, though.

spamfilter247• 4 years ago

Microsoft has a “Democracy Forward” team (previously called “Defending Democracy”) that aims to protect government officials and systems from adversarial state actors. It’s been ongoing for a few years now.

https://www.microsoft.com/en-us/corporate-responsibility/dem...

seanw4442• 4 years ago

Given their track record, I'd trust Microsoft approximately 0% to secure my critical/sensitive systems. The funny thing is that the U.S. government does, in fact, trust them.

kmeisthax2• 4 years ago

There's a bit of a journey from "protecting you against government hackers and spooks" to full-on sovereign states; and there's a lot of things that a country's government funds that Apple couldn't even begin to take on[0]. Physical security and military operations are a hell of a different field from that of locking down computers.

Furthermore this isn't the first of its kind; Google has been alerting high-risk Gmail users about state-sponsored hacking for about a decade now. Microsoft probably does something similar. Apple is comparatively late to the party on this. On the offensive side you have the zero-day vendors that broker exploits between hackers and the government.

A better explanation is that Apple isn't supplanting the US government. It's supplanting Halliburton. As more and more people and things go online, hacking and doxxing them is becoming more militarily valuable than just arresting someone or firing a missile. After all, physical attacks risk counterattacks and escalation, but Internet attacks are relatively cheap, not really treated as an attack by many sovereign states, and, most importantly, difficult to attribute.

[0] Call me when Apple black-bags Louis Rossman for illegally repairing MacBooks, or threatens literal nuclear war - like, with uranium bombs and radioactive fallout - on the EU for breaking the App Store business model.

lwswl2• 4 years ago

I've always thought that the companies coded the "zero day exploits" in, and then sold them for profit.

FredPret• 4 years ago

Apple doesn’t have to literally have an army and a bureacracy to rival a government. They just need enough flex. And they do!

alwillis19• 4 years ago

Furthermore this isn't the first of its kind; Google has been alerting high-risk Gmail users about state-sponsored hacking for about a decade now. Microsoft probably does something similar.

It’s great that Google alerted Gmail users, but then what?

“We believe you may be a target of a state-sponsored attacker; have a nice day.”

Beyond just telling you, Apple is providing some tools to do something about it.

starwind• 4 years ago

Apple are saying "we will protect you from state actors", which is a role usually performed by states

Not to sound flippant, but defense attorneys do this, too. I don't think it's as big a zeitgeist as you think

the_other3• 4 years ago

Good to know.

I think Apple's announcement (and as I've learned from this thread MS's and Google's similar programmes) represent a significant step-change. A single defense attorney performs this action on a case-by-case basis, and they earn "single human" levels of income from it. They (to some degree) use that money to make themselves comfortable and perhaps share it with charities and make investments. All the defense attorney's in the world combined still, probably, have access to a fraction of Apple's budget, and a fraction of Apple's audience. Defence attorneys don't always win all their cases.

Apple have the kind of money that makes 1000s of attorneys envious. Apple use that money to make infrastructure and client devices and then sell/share that technology with billions of people. Most of Apple customers buy their phones on loan agreements over some contract time-frame. It's "cheap", and the protections are automated.

I'm tired and getting rambly about this now, but I intuitively feel like the combination of state-level power (albeit exercised with a very narrow focus), and the way so many people live their (digital) lives interacting with a "noosphere" that crosses international borders are facets of a complex phenomenon we have not witnessed before, and which will merge with other related facets and then emerge as something really different. I accept I'm getting very fuzzy in my thinking here. I'm leaning into my inner sci-fi author (who's not come out for 30years and wasn't too talented when it did).

celdon25• 4 years ago

Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world": It's a flag-raise

Maybe. But these security “features” feel like things that should have been there from the beginning. Windows 11 has already had a much wider and deeper array of security options. Sure, it’s not mobile, but many of those security options would be unlikely to be needed against unsophisticated attacks.

Flag-raise or marketing gimmick? You be the judge I guess.

ziddoap• 4 years ago

Apple is saying "we operate at the same level as nation states; we are a nation-state level entity operating in the "digital world"

Making mountains out of molehills.

I'm pretty sure they are saying that they will "offer specialized additional protection to users who may be at risk of highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware".

There is a looooong list of things which nation states can do which Apple cannot, some examples of that are in other comments in this thread.

but this is the first public announcement, and tool, from a corporation with more spare, unrestricted capital than many countries.

Google & Microsoft have both had fairly long-standing tools and procedures (which were publicly announced) to both alert users and aid users against nation state attacks.

alwillis19• 4 years ago

Apple also started alerting people being targeted by state actors last year [1].

[1]: “About Apple threat notifications and protecting against state-sponsored attacks” https://support.apple.com/en-us/HT212960

sodality25• 4 years ago

Google's Advanced Protection program is the same: https://landing.google.com/advancedprotection/

cma• 4 years ago

It's the first such flag-raise I've seen.

After the Snowden leaks that showed even in-country citizen-to-citizen communication was being scooped up by the NSA without a warrant through fiber taps (if I remember that right) when Google replicated the data to out-of-country data centers, Google announced encryption of those links:

    Google encrypts data amid backlash against NSA spying

https://www.washingtonpost.com/business/technology/google-en...

modeless5• 4 years ago

It's the first such flag-raise I've seen

You haven't been paying attention. Many tech companies have been protecting accounts from state attackers for many years, and explicitly calling out state sponsored attacks. Google introduced state-sponsored attack warnings in 2012 [1] and the Advanced Protection program explicitly protects from state sponsored attacks [2].

[1] https://security.googleblog.com/2012/06/security-warnings-fo...

[2] https://blog.google/threat-analysis-group/protecting-users-g...

alwillis19• 4 years ago

Many tech companies have been protecting accounts from state attackers for many years…

How many people have Microsoft and Google actually helped?

Incase you didn’t notice, Apple is in the process of giving a few hundred million iPhone owners--every iPhone since the 2017 iPhone 8--protection from state-level actors, for free, in the next operating system update due this fall.

It totally dwarfs anything that any other company has done in this area. So there’s that.

labrador• 4 years ago

Apple is following the lead of Microsoft in this regard. Microsoft has been acting as an international cyber defense agency for a few years. On the effectiveness of Ukraine's cyber defense: "Microsoft in particular has been hard at work" 21:45

Assessing Russia’s War in Ukraine

https://youtu.be/CzbsPOaCrLw?t=1305

marcodiego• 4 years ago

Since the software is still proprietary, considering these statement as guarantees is just an exercise of faith.

stefan_• 4 years ago

I think you need to put away the pipe, this is Apple saying "we can't make JIT work safely so here's an option to turn it off".

alwillis19• 4 years ago

This is more like “there are always going to be zero-day exploits out there and until we can fix them, this is the next best thing."

threeseed6• 4 years ago

Apple saying "we can't make JIT work safely so here's an option to turn it off"

To be fair has anyone made it work safely ?

LegitShady• 4 years ago

Counterpoint - the EU has been passing laws that force apple to be more fair in their markets, and this "we're protecting you from bad guys" stuff is apple trying to figure out deniable methods to protest or sue against the EU passing laws to restrict apple's ability to lock other developers out.

Throw together a basic set of options that should have been available long ago, now apple is protecting you, don't strip apple of the ability to protect you, etc.

atmosx• 4 years ago

Nothing new. When states requested access to covid DB apple and Google refused access based on what happened in the Netherlands in WW2.

I must that on one hand it’s anti-democratic, on the other hand western democracies have a rather poor track record on safeguarding this kind of info.

unethical_ban• 4 years ago

No, they aren't, any more than an OS claiming "military grade encrypted boot drive" means they have a military.

germandiago6• 4 years ago

This is good news IMHO because it encourages that companies compete for the best offer in that space as they go.

In some way it reminds me (with all the differences!) of how things like cryptocurrencies could remove the state from a monopoly.

Good news for me this announcement!

dotnet00• 4 years ago

This feels like an argument the government would make against strong encryption like in the case a few years ago where the government tried to force Apple to unlock an iPhone and Apple refused claiming it wasn't possible.

Apple are basically saying that they're going to do their best in terms of security measures to thwart even state actors, which is only as much of a nation-state level thing as "military grade encryption" is a thing only applicable to militaries.

moogly2• 4 years ago

It's the first such flag-raise I've seen

Zuckerberg, 5 years ago: https://www.youtube.com/watch?v=mFPAe8Tc2NE

foobiekr• 4 years ago

Perhaps "first credible" is the correct description.

jiveturkey2• 4 years ago

It's the first such flag-raise I've seen.

“Flag-raise” seems a bit hyperbolic but at any rate I think the BSA asserted such reach and power, long ago. Both have to act within the oversight of actual nation states.

Beyond that, a secure phone is necessary but not sufficient to defend oneself against a nation state.

mnd999• 4 years ago

Do you also believe the earth is flat?

wyuenho• 4 years ago

A nation state has more than one way of extracting information from enemies of said state. There's the civilized way we now call hacking, and then there's the traditional way, which may or may not involve technology.

time_to_smile• 4 years ago

I don't know if you've been paying attention to Apple's strategy over the last year, but it's basically been "granting user privacy also happens to grant us an advertising/data monopoly"

I don't think the aim here is to block at state actors but to basically continue to close all security holes that can be exploited by any other company and continually proving to users that Apple cares about privacy.

The things is I really like Apple even more now since they have realize that my privacy interests can be tightly aligned with their own economic interests. I never trust companies to be good or look out for my interest even when I pay them to, but when my privacy ultimately means they gain a very strong competitive edge the I'm much more trusting.

Apple has realized they can become to privacy what Google has been to ubiquitous search, and doing so can reap even larger and more secure rewards.

They started with a walled garden and now extending it to fortress surrounding the garden.

happyopossum2• 4 years ago

advertising/data monopoly

not to be glib, but 'citation please?'

Other than running ads inside the App Store, do you have any knowledge or evidence of Apple collecting personal information for advertising or any other use?

kccqzy• 4 years ago

Google has been dealing with nation state actors targeting its users (Gmail specifically) for a decade now. They have Advanced Protection program. We actually regularly used to hear about how human rights activists were targeted in spear phishing campaigns and then arrested.

https://landing.google.com/advancedprotection/

the_gipsy• 4 years ago

It's marketing and you ate the hook, line, and sinker.

lolbutwutf• 4 years ago

Apple blocking a few features means it's now operating as a nation state.

Tell me it's a Hacker News comment without telling me it's a Hacker News comment.

bmitc2• 4 years ago

from a corporation with more spare, unrestricted capital than many countries

... than most countries. There are only 7 countries with a higher GDP than Apple's market cap.

I have been concerned for some time about these mega corporations being as powerful if not more powerful than governments. They wield tremendous economic and political power. Corporations have very little allegiance to countries and have little to check them. It is a major concern of mine. Democracy in the U.S. is already being sold to the highest bidders.

These corporations are feudal lords but much, much more powerful because there is not a single person who can be brought down. Corporations are a collective who are treated as people when it's convenient and as something else when it's not.

It's bothersome to me, because these corporations are tax sinks. They get absolutely massive tax breaks on everything they do and pay as little as possible income taxes, comparatively speaking, all the while keeping billions offshore.

Billionaires and mega-corporations are national security threats to the countries that house them.

octodog• 4 years ago

Market cap is a measurement of value. GDP is a measurement of output. Comparing the two doesn't really make sense.

sharikous• 4 years ago

"state actors" doesn't mean the US government in its full force or any other government Apple is in bed with to make money (like China).

It means in the best case shady agencies, foreign services, small governments, and in the likelier case just unhinged people with some access to state facilities (tax employees, unofficial police investigations, lawyers...)

rsync3• 4 years ago

"It's the first such flag-raise I've seen."

I was dripping with disdain and sarcasm as I clicked "reply" but I actually want to engage you and have you seriously consider the history of oil and gas exploration and extraction.

This may, in fact, be a first for a US tech company ... but not in any way whatsoever a first for a business interest or corporation, etc.

This is also a very tame, roundabout and implied flag-raise - as opposed to "... summary execution, crimes against humanity, torture, inhumane treatment and arbitrary arrest and detention ...":

https://en.wikipedia.org/wiki/Ken_Saro-Wiwa#Family_lawsuits_...

the_other3• 4 years ago

Good points. I had not thought about oil at all. I’ve become aware through light skimming that wars, coups and similar incursions have occurred around other resources.

This feeds into the point I was aiming at. The tech megacorps now have tooling to protect a narrow aspect of their customers lives from state incursion, regardless of which country that customer live in. I’ve not read the link you shared yet, so I don’t know the angle it takes or the angle you want to dig into my ideas from.

Thanks for sparing me the satcasm.

Chris2048• 4 years ago

They don't "operate at the same level as nation states", protecting against state actors isn't the only thing in that level, unless you mean cyber-security only. Abstracting this to anything "nation-state level entity" is the crux of your argument.

seanw4442• 4 years ago

I dislike big tech as much as the next hacker, but this seems like quite a leap. Protecting from nation-state actors digitally can be a job for digital powerhouses. In this case, the hackers are just very determined hackers with a lot of resources. Apple is a very motivated company with a lot of resources. Slightly to your point though, they have higher income than 96% of the countries on the planet. So they have the wealth to establish an Appletopia.

n0on3• 4 years ago

What they are doing is giving users an easy-to-use option to sacrifice part of the default user experience to enhance security by disabling features that are common vectors (which happen to be used by, as they phrase it multiple times in the announcement, "private companies developing state-sponsored mercenary spyware").

IMHO, whatever the reason why they are doing it, it's a good addition to their value proposition; but I don't think it's the same as what appears to be your understanding ("they will protect users from state actors"), at all.

galoisscobi• 4 years ago

I wonder if this mode would be helpful to protect myself if US border control forces me to unlock my phone so they can make a copy of all of my phone contents.

kube-system5• 4 years ago

If someone has your unlocked phone, they can look at the screen.

nielsbot• 4 years ago

Can you be forced to unlock your phone at the border? I thought you couldn't. (I don't actually know.)

BTW bringing up the power off UI on iPhone (holding power and up buttons at the same time) disables FaceID/TouchID until a passcode is entered.

andrewia3• 4 years ago

They can search your phone at the US border. https://www.theverge.com/2021/2/10/22276183/us-appeals-court...

kersplody2• 4 years ago

If you are a US Citizen or Permanent Resident, Border Patrol cannot prevent you from entering the United States. They can, however, detain you for up to 72 hours and confiscate the locked device if they have "reasonable suspicion". The confiscated property will be returned eventually.

https://www.cbp.gov/sites/default/files/documents/inspection...

If you are not a US citizen, refusal to unlock a phone and allow inspection, inclusive of allowing access to social media and corporate apps, will probably result in denied entry. They also have the right to detain you until indefinitely until you unlock the phone if they have "reasonable suspicion", but requires a court order within 72 hours.

Most foreign counties have similar rules in place for residents and non-residents.

Nextgrid9• 4 years ago

Pressing it 5 times does the same (and starts an emergency call countdown if you have that enabled). Also, removing the SIM also locks it out.

sneak6• 4 years ago

You can be forced to unlock it with biometrics, but not a password/code.

They also get to steal it and keep it if they want.

numpad02• 4 years ago

The sterile area between the gate and the border control is treated as international waters/lands, which sounds fine, and IIUC there is the logic that laws don't apply there so you can be forced-forced anything free from constitutional protections. Not sure if that actually works though.

kylehotchkiss4• 4 years ago

I'm excited about this mode for traveling outside the US, where other governments seem to be backsliding against privacy much more quickly

kersplody2• 4 years ago

It would be a good idea to enable this before going though any border controls. Doubly so for countries that require apps to be installed before entry/upon entry/after entry.

ArriveCAN (Canada), Mobile Passport Control (USA), WeChat (China), and other mandatory government apps would be perfect vectors to stage highly targeted attacks.

newscracker• 4 years ago

I hope Apple expands this quickly through minor updates to the OS rather than waiting for a next major release. This needs faster iteration than anything else.

Quoting what’s in the first release:

At launch, Lockdown Mode includes the following protections:
Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.
Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.
Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.
Wired connections with a computer or accessory are blocked when iPhone is locked.
Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

I’m not a target (I think, and hopefully don’t get to be one), but nevertheless I’d feel safer with this turned on (I very rarely use FaceTime, so not accepting it is not a big deal).

I’d also love more protections. Not allowing specific apps to connect to any network (WiFi included), Apple handling issue reports on apps with urgency (right now they seem to be ignored even when policy violations which are against the user’s interests are reported), etc.

perardi2• 4 years ago

I think it's reasonable to think Apple will iterate quickly on this.

Why? The iOS 15.x update history.

https://en.wikipedia.org/wiki/IOS_15

Lots and lots of privacy stuff in the point releases. (And accessibility stuff, they’ve been on a tear there.) They’re still in a monolithic mindset when it comes to the “big” apps, but they’re iterating faster on these sorts of things as the release cycle goes along.

alwillis19• 4 years ago

You might have missed that Apple announced realtime security updates at WWDC [1].

[1] https://techcrunch.com/2022/06/07/apple-introduces-real-time...

PoignardAzur3• 4 years ago

I’m not a target (I think, and hopefully don’t get to be one), but nevertheless I’d feel safer with this turned on (I very rarely use FaceTime, so not accepting it is not a big deal).

Good. We need people with nothing to hide to turn Lockdown Mode on, so that Lockdown Mode isn't a telltale signal that you have something to hide.

erichurkman• 4 years ago

Aside from the JIT change, those all sound like pluses to me!

post_break3• 4 years ago

When reading through this list at each feature I can't help but go "why isn't this in regular iOS?"

joshstrange• 4 years ago

Which is exactly why it's optional. Plenty of other people, myself included, look at that list and would not want them all or would like to pick and choose which subsets are locked down.

post_break3• 4 years ago

Yeah pick and choose makes sense for sure. Apple isn't exactly the king of choice unfortunately.

olyjohn2• 4 years ago

They should give you a list and the toggle should give you the option "SECURE" or "INSECURE" because that's basically what this is.

legalcorrection6• 4 years ago

I see they're running the reality distortion field at full power.

This is a load of bullshit and marketing hype. They are letting you turn off features for security reasons, i.e. what basically every OS has let you do, and what every half-competent IT department has been doing, for decades. In fact, iOS was an outlier in how unconfigurable it was, and with the pitiful MDM options not letting you turn off many of these features that are constant sources of vulnerabilities and social engineering.

Nothing that novel here other than the framing and cybersecurity marketing bullshit about Nation State Actors and "mercenaries."

haswell2• 4 years ago

Of course Apple is going to put a marketing spin on everything they do - that is a given. Does that somehow invalidate the work itself?

Why do you find it necessary to reframe the introduction of these features as a load of bullshit?

Are you arguing that these features are bad or not useful?

Or are you just saying that “it’s about time”? And if so, why not just focus on the part where Apple is doing a thing that needed to be done?

The undertones in your comment feel a bit unnecessary.

legalcorrection6• 4 years ago

Because it's being made to sound like something it's not. The comments are full of people fawning over how innovative and groundbreaking this is. Just trying to offer a dose of bitter reality to bring people back down to earth.

Tepix9• 4 years ago

Have you looked at the release notes of Android and iOS for the last 10 years? More than half of the security issues have to do with multimedia!

pluc3• 4 years ago

Apple's been making it real difficult to pick Android lately. Only thing Android still has going for it is the ability to flash custom ROMs, eg CalyxOS or Graphene.

ysleepy• 4 years ago

On Android I can use a firewall to block network access per app. on iOS that is not possible.

My password manager app might be bought out and exfiltrate all my credentials, or any of the linked libraries it uses.

idle_zealot• 4 years ago

My password manager app might be bought out and exfiltrate all my credentials

This is less likely if you use Apple Keychain for your passwords. lock-in intensifies

lordofgibbons• 4 years ago

I explored installing a custom ROM on my android phone, but ended up questioning the utility of them. There appears to be many banking apps, random apps (McDonalds??) and others that will not work if the device is running a custom ROM.

That makes my phone useless to me.

Our only hope is a proper Linux phone with an Android emulation layer

SirYandi• 4 years ago

You can get around that by spoofing safteynet stuff using Magisk. But yeah, it is a few more hoops to jump through and you need to be rooted which is itself not great for security.

Georgelemental2• 4 years ago

CalyxOS passes SafetyNet on my Pixel phone, at least for now

viktorcode• 4 years ago

Android has a wide plethora of devices, Apple can't make hardware catering to everyone's needs.

pluc3• 4 years ago

That is not an Android advantage. Tightly controlled hardware makes it so much easier to control software. You ever built an app for Android? It sucks

lern_too_spel2• 4 years ago

Better security, more features, more privacy, and more user control in general are significant reasons to choose Android.

pluc3• 4 years ago

Compare the actions of Google versus the actions of Apple and it's real difficult to think Google has your privacy in mind

oblio• 4 years ago

Maybe they changed this lately, but can you copy files through USB to an iPhone?

jacooper3• 4 years ago

What? No, not even close. - no way to use the phone without an account - no way to install apps from outside the store - no browsers other than Safari reskins.

These are all fixed by the DMA, but it will take a lot of time for things to mature, however other issues persist

- no way to put apps on the bottom of the screen - the FOSS scene on IOS basically doesn't exist, while on android there is a whole app store for it(https://f-droid.org) this is a big point for me. - no way to duplicate apps - no separate work profile - limited file mangament - no notification chat bubbles(a pretty good feature on android 11/10?+ - no advanced apps like local terminal emulators, virtual firewalls or virtual tracker blockers(partially because the FOSS community rightly doesn't care about iOS) - non encrypted iCloud backups(basically a backdoor into WhatsApp) or any important file medium - CSAM Scanning inbound

And many other issues, iOS is hardly making Android hard to choose, its still locked down prison, its just a bit nicer inside now.

Since I value my privacy and like FOSS iOS is even more useless for me.

k8sToGo• 4 years ago

I can also use stuff like Tasker on Android.

WmyEE0UsWAwC2i• 4 years ago

But should apple we liable when they, or any other organization making such claims, inevitably fail to protect their users?

I think their should.

KerrAvon2• 4 years ago

How do you propose to do that without disincentivizing the addition of such features? Even NASA has software failures.

matthewdgreen• 4 years ago

Last year I wrote: "In the world I inhabit, I’m hoping that Ivan Krstić wakes up tomorrow and tells his bosses he wants to put NSO out of business. And I’m hoping that his bosses say 'great: here’s a blank check.' Maybe they’ll succeed and maybe they’ll fail, but I’ll bet they can at least make NSO’s life interesting." [1]

Maybe this is the blank check :)

[1] https://news.ycombinator.com/item?id=27897975

c1sc02• 4 years ago

And yet this feels like it’s too little too late. If I’m likely to be the target of the kind of state-sponsored malware “lockdown mode” supposedly protects me from I shouldn’t have been using Apple products in the first place. Which begs the question: what are current security best practices to protect from state-level hostile actors?

savoytruffle2• 4 years ago

The current best practice is to have already been using an Apple device, and this will enhance that.

c1sc02• 4 years ago

Really? Not something like Tails or Qubes? Am I too paranoid? I’m genuinely interested in learning about this. What am I supposed to use these days when I’m working on a project that would make me a target for state-level actors?

egberts16• 4 years ago

Too bad that Google does not offer this same “Lockdown Mode” as Apple does.

Instead, they (Google Play Store) removed our ability to see what “app privileges” that an app would required BEFORE we do the installation step from the Google Play Store. What we got instead was an obfuscated “Data Security” section that is pretty much always “blank”.

My flashlight app should not require GAZILLION app privilegeS nor hide that fact before I can determine whether I can safely install it, much like Apple App Store can do by doing the CRUCIAL pre-reveal of any needed app privilege(s) … for our leisure perusual and applying any applicable but personalize privacy requirement BEFORE we do the app install.

andrewia3• 4 years ago

Google removed the install-time permissions dialog because they replaced it with runtime permissions. This makes sense - some users wants PayPal or WhatsApp to access their contact list, and others won't. It also fixes "permission blindness", where users blindly accept a long list of permissions because they need the app, or just stop caring because it's too much to comprehend all at once.

Obviously, this isn't perfect, especially since Google removed the internet permission and allowed all apps to access it. Allowing advanced users like us to toggle off internet access in the "App info" permission page would be a good compromise, and I hope and Android team does so to match Apple on their security efforts.

egberts16• 4 years ago

Fixes “permission blindness”? So, the current form of Google Play (app) Store “Data Security” section of each app being shown as “(blank)” is surely yet another form of “permission blindness”.

Google Play Store being proactive in protecting these end-users from their own form of stupidity (or “permission blindness”, as you have eloquently pointed out) is just opening themselves to potential liability ramifications instead of deferring to end-user’s responsibility of maintaining their own privacy.

I think that the term “permission blindess” is better referred to as an app having zero privilege.

And “App Privileges” should have referred to runtime permissions and should have been displayed in the first place at the Google Play Store instead of install-time privileges.

cmroanirgo• 4 years ago

It's taken a decade, but it's pretty much moved back to the permission model that j2me had, which iOS and Android deliberately removed & sold as better UX. Seems like the original devs of j2me knew what they were doing - only the joe public's weren't ready for permission popups then like they are now. :sigh:

varispeed• 4 years ago

You should be able to review the list of required permissions before installing the app anyway.

I find it frustrating when I install a simple app and it asks me for every permission possible. Waste of time.

javajosh2• 4 years ago

Google hiding information about apps in the app store is a big problem - but its not as big a problem as not having a Little Snitch equivalent built into Android. This alone is a reason for real capital to be spent on startups in the alt-android space. Imagine a company that lets you use your current Samsung or Google or Sony or ASUS or whatever flagship phone, but with a truly open-source fork of Android with a Little Snitch built in, and security updates guaranteed for as long as you stay current with your subscription, which is like $5/mo. (Maybe that's too low). Maybe you could even wipe your device and mail it in to have the software installed if you can't be bothered to do it yourself. Or maybe even a partnership with a phone repair chain. (And if you don't want to pay the fee you can always install updates yourself manually, from source.)

ignoramous6• 4 years ago

Imagine a company that lets you use your current Samsung or Google or Sony or ASUS or whatever flagship phone, but with a truly open-source fork of Android with a Little Snitch built in, and security updates guaranteed

You describe the direction CalyxOS / DivestOS are going. And of course, there's the Pixel phones on GrapheneOS which arguably is more security-focused.

okneil• 4 years ago

Whilst not quite the same, Google does offer the Advanced Protection Program for accounts.

https://landing.google.com/advancedprotection/

acdha4• 4 years ago

I’ve been using that for years but was wondering whether the documentation is current about Chrome - they offer things like disabling the JIT (nearly half of Chrome’s exploits last year) as a group policy option on Windows, for example, but it doesn’t appear that APP does anything for Chrome users other than mandatory Safe Browsing.

einpoklum3• 4 years ago

they (Google Play Store) removed our ability to see what “app privileges” that an app would required

Don't use Google Play Store, then. There are other APK repositories.

corytheboyd4• 4 years ago

If Apple could somehow make phone and sms not useless due to spam that'd really save the average person. They must have the resources to throw at something like this. I'm not claiming to be an expert, I'm not saying I'm right, but phone spam is fucking awful.

thothamon• 4 years ago

Phone spam as in text messages? Your email is a whole other thing

corytheboyd4• 4 years ago

Yes indeed email is a whole other thing, that's why I didn't mention it :)

ipsi• 4 years ago

Surely that's the responsibility of the providers, though? Apple can improve the situation a bit, maybe, but you'd really need to get AT&T & co to crack down on it to have any chance of solving it for good.

I know that I've had approximately zero spam on my German number (that I've had for ~2.5 years) - I'm sure why, whether I'm just lucky, or whether it's much more under control here. My UK number definitely had problems with spam, though. Maybe a couple of spam calls a week.

corytheboyd4• 4 years ago

Nice, glad to hear it's at least reasonable elsewhere, It's very, very bad in the US, at least for my partner and I. We started getting unsolicited calls days after starting the house buying process because the credit reporting companies sell you off immediately. Very frustrating.

jeroenhd5• 4 years ago

This seems to be a problem mostly localized to some countries. Device manufacturers should not be fighting a rotten network, the networks should be fixed instead.

corytheboyd4• 4 years ago

Yeah but... here we are. In the US at least, I don't see this ever being addressed at the root. Everything between the user and the phone service is at least somewhat malleable, what's the problem with at least trying in one of those places?

duskwuff2• 4 years ago

If Apple could somehow make phone and sms not useless due to spam

1) A full solution to this problem is going to depend on mobile carriers making changes. It isn't something which Apple can unilaterally fix.

2) This is completely irrelevant to the purpose of "Lockdown Mode". It's intended to protect high-risk users from certain sophisticated threats -- it isn't a feature which most users should use.

knodi• 4 years ago

they do already do this, report the message as junk the number will be flagged as junk and messages from it will be filtered to the junk view.

thedougd• 4 years ago

Worst part of switching from Android (Pixel) to iPhone. It was shocking.

2OEH8eoCRo02• 4 years ago

Wired connections with a computer or accessory are blocked when iPhone is locked.

Android defaults to charging only.

Aaronn• 4 years ago

The same is true on iOS (https://www.theverge.com/2018/7/10/17550316/apple-iphone-usb...). Lockdown mode just prevents you from enabling it.

2OEH8eoCRo02• 4 years ago

USB Restricted Mode prevents USB accessories that plug into the Lightning port from making data connections with an iPhone, iPad, or iPod Touch if your iOS device has been locked for over an hour.

Android asks every time for every device. There is no 1-hour grace period.

drexlspivey• 4 years ago

Does this offer any protection after you are already pwned? Is the expectation that you have it permanently on if you are a high value target or do you turn it on temporarily before clicking on a link for example?

dustyharddrive• 4 years ago

Don’t know enough about iOS to say for sure about persistence, but recent Pegasus (NSO Group spyware) versions don’t bother[1], instead repeatedly exploiting bugs starting with “features” like background Messages attachment parsing.

Those are the kind of threats Lockdown Mode finally acknowledges — targets (well IMO everyone) would need it permanently enabled.

Otherwise the temporary protection before clicking a link can be had today in other ways, like disabling Settings > Safari > Advanced > JavaScript.

[1] Lack of persistence likely an attempt at making it harder to analyze: https://www.amnesty.org/en/latest/research/2021/07/forensic-...

olyjohn2• 4 years ago

If you're going to run a crippled-ass phone to protect yourself, because the regular phone is so fucking insecure, why even bother with a smartphone? They'll just find an exploit in something that the "security mode" hasn't disabled.

olliej4• 4 years ago

If you have already been pwned, the OS is compromised so it clearly is not able to retroactively undo that - any checkbox, option or whatever can just be turned into a no op that lies.

Nextgrid9• 4 years ago

If you're already pwned to the point where they have kernel-level access and can bypass code signature enforcement, all bets are off. Even if lockdown mode interfered with their activity, at this point nothing prevents them from modifying the Settings app to not really enable lockdown mode even if you request it to.

throw20220706• 4 years ago

Reminds me of a classic https://xkcd.com/538/.

For the vast majority of users the most realistic threat is simply being ordered to unlock their phone under the threat of force (from a criminal, a cop, a CBP agent, etc). This is way, way more likely than being attacked through an unknown JIT compiler vulnerability.

What would be really helpful is Apple implementing a way to have multiple iPhone profiles with plausible deniability (a la VeraCrypt) or some sort of compartmentalization (a la 1Password travel mode).

Of course that would mean people can start sharing their phones instead of buying one per person from Apple, so I'm not holding my breath.

lwswl2• 4 years ago

Honestly, this is bad news, because it means Apple is no longer capable of offering both security and all features, but now needs to spit them into groups, presumably because they need to keep up with (the clearly less secure) Android...

lekevicius2• 4 years ago

I see this as securing against "unknown unknowns". No software can ever be "100% bug free". If you can identify areas that are more likely to contain yet-undiscovered vulnerabilities and turn them off in advance, the device becomes more secure.

capableweb3• 4 years ago

Security has never been "Secure or not" proposition, it's always a balance between convenience and safety against threats, threats that change depending on who you are, and who is targeting you.

Some features are (understandably) almost impossible to make very safe. Take PDF viewing for example, the entire thing is so huge, that it's bound to be holes in any implementation, just like what the NSO proved some time ago with the iMessage exploit.

I take this effort as something similar to the "Hardened Linux" effort. Just that it exists doesn't mean that Linux is "unsecure", it just means that if you really need to, there is more steps you can take to make it even more secure. Just like what Apple is doing here.

vorpalhex4• 4 years ago

If I could upvote you twice, I would.

Security is always a tradeoff and there is no single answer. A feature for one person is another person's hell.

An acquiantance just lost all their data because they had enabled "format on too many missed passcodes" and their kid was playing with their phone.. caused quite a few tears. On the other hand, that feature is invaluable to international travelers.

olliej4• 4 years ago

No, this is a completely reasonable response.

Security by reducing attack surface is a standard, and sensible response.

What you are asking for is that Apple (or any company) be able to produce absolutely 100% bug free code, no matter the complexity or requirements. This feature is an acknowledgement that what you're asking for is an unreasonable demand for any company.

So Apple has looked at the attack surface present by default, and then provided an option to that trades off removing presumably low use features in exchange for removing large attack surface. That is a trade off: for example any modern phone would be vastly more secure if all it could do is make phone calls, and everything - the browser, apps, etc - were disabled. But that end of the spectrum results in an impractically restricted device, in reality there's a middle ground, but for high profile targets the trade off is closer to "just a phone" than it is for normal users.

An example is the RW^X region required to support JITting JS - the OS simply supporting such memory region at all was a huge addition of attack surface to the platform - prior to that every single executable page was protected by code signing, afterwards there was a region that by definition the OS could not verify, and it has been used by every attack since then. But disabling that simply disables the JIT, the JS interpreter runs, so the impact is only that some web content runs slower, but the functionality itself is still there.

Similar for messages: receiving JPEGs is super common, receiving OpenEXR or whatever probably isn't, so removing everything other than JPEG by default again removes attack surface without realistically impacting the usability of messages.

npteljes2• 4 years ago

Security and convenience _can_ coexist, but you can't transition into a more secure world without breaking convenient, insecure stuff that already exists and users expect it to just work. Later they can ramp this up.

alwillis19• 4 years ago

Honestly, this is bad news, because it means Apple is no longer capable of offering both security and all features…

Absolutely not true.

There’s a difference between being secure and having all of the features and being secure against a state-level attacker. The vast majority of users are quite secure while enjoying all of the features of their iPhones.

For those who are being targeted, potentially in a life or death situation, being able to send attachments in iMessage is trivial by comparison. Only a tiny percentage of iPhone users should ever have to enable this; it won’t impact the user experience of over 95% of iPhone users at all.

einpoklum3• 4 years ago

Apple cannot even in theory protect you from spyware, because Apple's OS and apps _are_ spyware - as Apple (routinely? occasionally?) collects your personal data for the US government's NSA and passes it to them (Snowden revelations: https://www.theguardian.com/world/interactive/2013/nov/01/sn...)

Nextgrid9• 4 years ago

This might get downvoted but it's actually true. If you're logged into iCloud, even with all features disabled, things like your call history and email recipient history (regardless of whether you're using iCloud Mail) are uploaded for example.

einpoklum3• 4 years ago

I'm rather baffled by how all of that can just go over people's heads, and they go back to debating whether Apple is mindful enough of their security and privacy or not.

ProAm• 4 years ago

Apple is not stopping state-sponsored anything. They do not have the expertise nor willing to invest enough to stop it. And they also turn everything over they can at a local-law enforcement request, because they have to.

blintz• 4 years ago

I am so excited about this news. I understand that some people are pessimistic, and view it as a "giving up" on complete security against nation-states. I think that's the wrong way to analyze the situation.

The dream I have is someone making a phone that is purpose-built to be secure against state actors. Unfortunately, this makes very little economic sense, and probably won't happen (maybe if some rich person started a foundation or something?). The phone would need to have pretty restricted functionality and would not be generally appealing to mass market consumers.

As it stands, securing a mass market modern smartphone, even from just remote attacks, is just intractable. We should not bury our heads in the sand and wishfully think that if they just spend a little more money, close a few more bugs, and make the sandboxing a little better, somehow iOS 16 or Android 13 will finally be completely secure against state actors. The set of features being shipped will grow fast enough that security mitigations will not someday 'catch up'.

This is the next best thing! The more we can give users the freedom to lock down their devices, the more the vision of an actual solution comes into view. This is the first step towards perhaps our only hope of solving this someday - applying formal methods and lots of public scrutiny to a small 'trusted code base', and finally telling NSO group to fuck off.

Even this dream may not pan out, but at least we can have hope.

germandiago6• 4 years ago

The potential a phone like that would have if you explained people how states can and do put their nose into their lives is quite big IMHO. It is just that people have no idea of how much they can take from your info through a phone.

runnerup• 4 years ago

Most people couldn’t grasp the important ramifications even if you walked them through it from first principles. I’m not sure I can despite being very interested in information entropy my whole life.

A lot of people really don’t understand much at all about anything that they don’t constantly see and touch their whole lives. A lot of people truly just live in the moment constantly and use their higher order thinking for social navigation and sex.

Nextgrid9• 4 years ago

The problem 90% of cases is the user himself. Advanced attacks such as spyware-for-hire with zero-days and stuff only affect a minority of users. For the fast majority, the vulnerabilities are much simpler: password reuse/carelessness, malware on other devices (laptop, etc) that also has access to their data, willingly sharing too much information, etc.

You don't need a special phone or hardened OS to defend against that, and users vulnerable to this will remain just as vulnerable regardless of how much hardening there is.

Fargren• 4 years ago

In general, I'm much more concerned with private actors than state actors. I'm aware of multiple ways in which companies use information to try to extract money from me, and they actively make my life worse in the attempt.

I have a much harder time thinking about how giving states access to my information has been harmful for me. I can think of potential harms, if the state started doing religious or ethnic persecution(not trying to diminish the chance of this, but not a problem today) so I'm aware of potential threats. But other than that... What exactly should I be worried about?

PuppyTailWags• 4 years ago

I would suspect any phone designed to resist a state-level actor, that is made available to me (a regular citizen) would 100% be a honeypot for a state level actor.

wmf2• 4 years ago

https://www.vice.com/en/article/y3d3dx/doj-charges-anom-infl...

godelski5• 4 years ago

In fact, several phones which have been advertised as such have been honeypots from state level actors.

ajsnigrutin• 4 years ago

Most of the people in charge, only care about what state the "bad"/"good" actors are from, so preferably, "our guys" should be able to do everything, and "theirs" nothing.

newsclues2• 4 years ago

And yet we got TOR because it was required for National Security.

px43• 4 years ago

IMO Bunnie has the technical skills and the reputation to pull it off though.

I think it has about zero chance of withstanding physical attacks, which is important to me in a phone, but it's a nice effort.

stjohnswarts7• 4 years ago

Gotta trust somebody at some point? Otherwise you have to live off the grid in the woods eating squirrels and mushrooms

gambiting• 4 years ago

>The dream I have is someone making a phone that is purpose-built to be secure against state actors

I just don't see how anyone could build such a thing. State level actors have the tools necessary to force you or your company to build in any backdoor they want, and prevent you from ever talking about it to anyone. US certainly does, and could just force apple to add a backdoor to this lockdown mode and apple could never even hint at its existence under legal threat.

eurasiantiger2• 4 years ago

Or they could just add an implant at the factory.

Why anyone allows their devices to be manufactured overseas is beyond me.

stjohnswarts7• 4 years ago

Not just the US, so do the EU, any five eyes country, China, Korea, Taiwan. The US doesn't have a hegemony on backdoors so lets always remember that and not exclude others or act like it's an island of corruption in a world of benevolent state actors.

awll• 4 years ago

I feel like the closest you can come to the dream of a phone that is secure against state actors today would be a google pixel phone running graphene os.

googlryas5• 4 years ago

It might just be better to not rely on a phone, rather than rely on something achieving perfect security against the most malicious and capable of actors.

If I was really concerned about targeted cyber attacks against me, I think that I would exclusively use computers that I would buy from random people on Craigslist, take the hard drives out and only boot with live CDs using ram disks, and only connect via random public Wi-Fi locations.

reaperducer• 4 years ago

Excellent precautions if you live and work in average middle-class suburbia and never go anywhere or do anything dangerous, controversial, or politically unpopular.

Lockdown Mode is not for you. It's for other people with different lives.

Analemma_2• 4 years ago

This is a fantasy that could only from someone who doesn't actually need it. The people who actually need Lockdown Mode-- dissidents, organizers, journalists, etc.-- also actually need to communicate with normal people, and that means having a phone. If you're so unimportant that you can get away with your proposed computing scheme, you're not going to be the recipient of targeted cyber-attacks.

dark_star• 4 years ago

Bunnie Huang is working on Betrusted [1], a communications device that is designed to be secure from state actors. The first step is Precursor (about: [2], purchase:[3]) the hardware and OS that will be the platform for the communications device.

It's designed to be secure even though it communicates via insecure wifi, for instance via tethering or at home. The CPU and most peripherals are in an FPGA with an auditable bitstream to program the device to ensure there are no back doors. Hardware and software are all open source. It has anti-tamper capability.

It looks well-thought-out.

1. https://betrusted.io/

2. https://www.bunniestudios.com/blog/?p=5921

3. https://www.crowdsupply.com/sutajio-kosagi/precursor

stjohnswarts7• 4 years ago

Unless you design the FPGA inhouse and make it in your own Fab how would you know it's secure? Taiwan and Korea owe the US a lot of favors...

nebula88043• 4 years ago

I remember this talk at CCC two years ago. Has this device move forward? I haven't heard anything since that CCC talk.

samstave• 4 years ago

>"...a "giving up" on complete security against nation-states...

DEFINE:

State Actors: [0]

As one who is acting on "behalf" of a government.........

What if said government was actually an arm of the corporate entities as the state ACTING at their behest?

Crazy, I know.

[0] https://en.wikipedia.org/wiki/State_actor

RonMarken• 4 years ago

Realistically you cannot win against a resourceful adversary every time. But merely painting the situation through the lens of premature surrender is also a disservice.

It will be interesting to see what third-party researchers discover about these new protections. Might remember something about Apple rewriting format parsers for iMessage in memory-safe language with sandboxing as Blastdoor and it was discovered there was still plenty of attack-surface in the unprotected parsers.

ransom1538• 4 years ago

I want deniability. After watching the videos from Ukraine of Russians pulling out citizens from cars forcing them to unlock their phone with guns to their heads -- I want a way to hand someone a phone, unlock it, and STILL be protected. I want my private things in a volume with deniability. Trucrypt was close.

throwaway821909• 4 years ago

Buy a second phone, that's what some do in China due to an "anti-fraud" app with slightly softer enforcement

mariojv• 4 years ago

I would pay a good premium for an iPhone with a distress code that unlocks the phone into an environment with some fake but plausible contents. Bonus points if it optionally wipes the real user partition upon entering the code.

germandiago6• 4 years ago

The dream I have is that they do not sack us with taxes that later on they use to violate our rights.

First thing is to remove a lot of the economic power and legislative power states have and hardening security in devices is also good news. But the problem is also that they have so much money and power that they can misspend money to target people and violate their rights because yes.

fsflover2• 4 years ago

The dream I have is someone making a phone that is purpose-built to be secure against state actors

Here you go: https://puri.sm/products/librem-5.

FAQ: https://source.puri.sm/Librem5/community-wiki/-/wikis/Freque....

Terretta• 4 years ago

This is great, but also clever.

By offering users a more locked down option with clear tradeoffs, (a) users can make a choice between security and convenience, and (b) given user agency, negative press around hacks of not locked-down devices loses potency.

Meanwhile, the choice seems straightforward on most of these...

Lockdown Mode includes the following protections:

- Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.

GREAT!

- Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.

GREAT!

- Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.

GREAT!

- Wired connections with a computer or accessory are blocked when iPhone is locked.

GREAT! (Used to have to do this yourself with Configurator if you wanted to be hostile border-crossing proof.)

- Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

Infernal• 4 years ago

> - Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.
HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

Reading between the lines here - on lockdown mode, you can't install a profile, or enroll in MDM. What it doesn't say, is that you can't enable lockdown mode with a profile installed, or if enrolled in MDM.

I take this to mean, with lockdown turned on, I can't install profiles or enroll in MDM (but presumably could uninstall profiles or unenroll from MDM).

sodality25• 4 years ago

Correct. Existing MDM profiles will be unaffected.

derefr5• 4 years ago

I also take it to mean that most of these hardening features will be able to be enabled by configuration proflies / MDM anyway. Lockdown mode being essentially "Apple being the MDM for individual who don't otherwise have an MDM."

xoa• 4 years ago

- Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.
HMM ... there are hardening settings only available through Configurator or MDM profiles. Will those be defaulted on as well?

Yes, that one leapt out at me as well as kind of an awkward one with more compromises, painting with a very broad brush. It's obvious that some of the very powerful config profiles/MDM capabilities could be used for a lot of mischief, but some of them are also exactly what I'd want to be running myself if I was at a lot of risk, and some are both. Ie., continuing to have one's own offline based CA with proper Name Constraints could be handy for a group of people who want to try to better secure and keep private their own internal network services from anything short of a government physical assault, but if an attacker can slip on a profile with an unlimited CA your goose is cooked.

Perhaps Apple simply doesn't have the capability for fine grained control of those capabilities yet, which wouldn't be surprising given their path up until now. I'll be interested to see if over time Apple leaves this mostly untouched or invests in seriously improving it. Like it'd be interesting if you could boot into a special mode ala DFU though requiring password and with graphics up and have a bunch of toggles for various capabilities that would then be enforced in normal usage. Analogous to the Recovery Mode on Macs.

alwillis19• 4 years ago

Perhaps Apple simply doesn't have the capability for fine grained control of those capabilities yet, which wouldn't be surprising given their path up until now.

I have to believe they’re working on exposing some of this via MDM. Certain organizations may never want the JIT turned on, for example or allow attachments in iMessage.

I expect we’ll hear more about more capabilities this summer and fall.

sodality25• 4 years ago

You can simply enable those MDM profiles then enable Lockdown mode; they will stay on. You just can't enable new ones while Lockdown mode is enabled.

CobrastanJorji2• 4 years ago

I'm worried about that last point simply because I assume that most corporate CEOs would need MDM enabled to access their corporate email, which means they won't be able to use this feature despite being prime targets.

Still a really good feature for those that qualify, though.

stephen_g2• 4 years ago

I believe you can still have it, you just have to set it up before you put the device in lockdown mode.

ivlad• 4 years ago

Ideal approach would be to be able to manage all those features individually via MDM. This way corp admins would be able to lock down managed phones while bringing necessary configuration to access corp services.

alwillis19• 4 years ago

I'm worried about that last point simply because I assume that most corporate CEOs would need MDM enabled to access their corporate email…

As long as the MDM profile is installed before using Lockdown Mode, they’ll be fine. They just can’t install an MDM profile once the phone is locked down, which makes sense.

duxup• 4 years ago

I was wondering when a “hardened” option would come.

freedom-fries• 4 years ago

I'm guessing it will run afoul of the EU regulations. At the bare minimum there should be a way for level playfield - individual applications and third party application providers should have same access as Apple's apps!

* If Safari and Messages is allowed then all other apps should be allowed and have complete access to the device even in the lockdown mode. * If apple gets access to any traffic from the device in the lockdown mode, then all other applications should have full access to advertising metrics and device data as well.

At that point it's probably not much of a lockdown, but Apple can't have all the fun can it?

saos• 4 years ago

This seems rather extreme. I like it!

walrus01• 4 years ago

putting rich media like images, GIFs, video etc embedded inline in chat applications presents a huge attack surface.

i'm even suspicious that signal does it.

if you really want to design a secure messaging system it needs to handle text ONLY.

notriddle• 4 years ago

Text rendering is more complex than decoding a PNG.

brundolf2• 4 years ago

Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.

That's very cool actually. You can keep JS enabled but choose to make it run more slowly in exchange for better sandboxing

kylehotchkiss4• 4 years ago

I originally understood this to mean JS was disabled entirely in safari when enabled unless a site is allowlisted. Does this mean the web will run JS “normally” but slower? Does the speed of modern phones mean a slower style of JS processing might be less discernible?

brundolf2• 4 years ago

That's my interpretation. Modern JS engines have multiple tiers of optimization, which they apply in different ways based on how "hot" a piece of JavaScript is. JIT is the highest level of optimization, but also means generating and executing native code on the fly, which I assume leaves the door open for worse exploits if there's a bug in the engine. This is in contrast with bytecode interpretation, which is slower but available.

lisper• 4 years ago

Extreme? This sounds like the way I have my computing environment configured by default (to the extent that I'm able to do so with browser extensions and whatnot).

ArrayBoundCheck• 4 years ago

Same. Its too bad general browsing is nearly unusable with JS turned off.

Tepix9• 4 years ago

This isn't even turning off JS completely, merely certain JIT features.

janandonly• 4 years ago

If Apple was really serious about this, they would add one more feature to Lockdown mode: To delete and scrub permanently and definitively all your iCloud data.

You can close the proverbially "front door" by enabling "Lockdown mode" but if that same government sends a subpoena to Apple, then they will just give them a copy of all your iCloud private data.

devnulll• 4 years ago

Nobody who is at risk for this is doing iCloud backups. That's something you can already turn off.

sneak6• 4 years ago

Their conversation partners are. iCloud Backup is a backdoor in iMessage's end to end encryption preserved explicitly at the behest of the FBI.

threeseed6• 4 years ago

If you care about your privacy don't upload your private data to ANY cloud service.

Even if iCloud was encrypted they still run on third party cloud providers who nobody knows what relationship they have with governments. Many types of encryption are breakable if you have effectively unlimited resources.

Tepix9• 4 years ago

I've been using iPhones since the first iPhone. I don't sync any relevant stuff to iCloud. However, during previous iOS updates this sync turned itself back on multiple times (more than three times for sure).

It hasn't happened for a while but whenever there's an iOS update it's advisable to check your iCloud settings immediately afterwards and if they changed, you change them back and pray that your important data hasn't been sent to the cloud in the meantime.

luhn• 4 years ago

Most iCloud data is end-to-end encrypted; Apple doesn't have direct access to your data. In the end they do own the OS and could potentially backdoor your device, but if you're worried about that... well, Lockdown Mode is moot at that point.

Worth noting Apple previously refused an FBI order to do just that. https://en.wikipedia.org/wiki/FBI–Apple_encryption_dispute

jackvalentine• 4 years ago

Most iCloud data is end-to-end encrypted; Apple doesn't have direct access to your data.

Depends what you think of as ‘most’ really, things that don’t have end-to-end includes photos, icloud drive files, notes and backups.

https://support.apple.com/en-us/HT202303

modeless5• 4 years ago

Apple refused an FBI order to decrypt a phone; however they allow the FBI to access iCloud data all the time. And iMessage is not end-to-end encrypted in iCloud at the explicit request of the FBI. https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

stu2b502• 4 years ago

You can already turn off iCloud features?

yrgulation3• 4 years ago

What if there is a little device that acts like network firewall and router appliances but somehow the phone proxies all connectivity via it. Something to carry around that shows ingress and egress connections, calls and anything in between. You can either set an allowed or blocked list, detects cell connection mitm attacks and spikes in traffic (to detect leaks). Mobile phones are like desktop computers and will always have security issues. It only makes sense to firewall them.

Nextgrid9• 4 years ago

TLS and certificate pinning makes this a problem. Technically certificates don't have to be pinned, but if they weren't then people would use this to defeat "growth & engagement" and block analytics, ads, etc (or worse, reverse-engineer the API to make a third-party client) and we obviously can't have that.

jiveturkey2• 4 years ago

Like your own personal stingray

yrgulation3• 4 years ago

Had to look it up. I guess the question is how to make sure it cant be abused by capturing data from random nearby phones. In that case we’d end up worse off.

bistable• 4 years ago

Why not on the same device? Have a separate small simple SoC completely segregated from everything else, except shared battery, with 2 NICs and a physical switch to swap between using the firewall interface and the regular phone. Although this may make more sense for a regular computer plus router, with a cell phone there's multiple radios, not just a single simple IP connection...

yrgulation3• 4 years ago

Issue is that we would have to get device makers to buy into it, and also trust them that they show us everything. Also we wouldn't be able to retrofit existing devices. Most people dont like tinkering with things. A universal device small enough to fit in your pocket, with a nice little display or a usb connector to download data to a laptop and configure rules, is more desirable imo.

jasonhansel• 4 years ago

Downside: if attackers can tell that you've enabled Lockdown Mode, then they know that you're likely a high-value target.

tialaramex• 4 years ago

Most message attachment types other than images are blocked.

Who wants to bet that this reflects minimum requirements dictated for user experience, rather than reflecting what Apple are actually securing today ?

The correct model here, the one that would actually defeat these adversaries, is to start with what you can actually secure and expand from there, prioritising customer needs. This delivers security improvements for all customers, but it makes the calculus simple for Lockdown customers, whatever Lockdown allows will be OK.

Suppose today Apple has a working safe BMP reader, and a working safe WAV reader, but they're still using their ratty JPEG and MP3 implementations. As described, this feature says you can receive a JPEG attachment (which takes over your phone and results in your cousin who remains in the country being identified as a contact and imprisoned) but you can't listen to the WAV file an informant sent you because that's "dangerous"...

S0und• 4 years ago

I find is absolutely hilarious that they've kept the images in Messages while one of Pegasus attack vector was sending a PSD file as a *.gif, which crashed Messages parser.

Apple is over confident in it ability.

https://arstechnica.com/information-technology/2021/09/apple...

People who need this have already a dumb phone, using this Lockdown mode is an unnecessary gamble on they part.

kylehotchkiss4• 4 years ago

Yeah, apple really should dumb down that parser to just “modern” jpg/png/webp for their entire application stack. bmps and gifs shouldn’t still be used. And photoshop is a bit proprietary for apple to be rendering their files within iMessage

amelius2• 4 years ago

What they think will happen: users activate Lockdown Mode to protect themselves.

What actually happens: criminals activate Lockdown Mode to evade law enforcement.

Analemma_2• 4 years ago

Lockdown mode is for preventing 0-days. Law enforcement does not burn 0-days on common criminals, they get a warrant and get into the device that way.

Animats• 4 years ago

Does lockdown mode prevent updates from Apple?

camdenlock• 4 years ago

This is mostly great news. Then you scroll down a bit and see this eye-opening 2nd part:

“Apple is also making a $10 million grant […] to the Dignity and Justice Fund established and advised by the Ford Foundation - a private foundation dedicated to advancing equity worldwide and designed to pool philanthropic resources to advance social justice globally.“

So Apple is releasing a great new hardened security mode in iOS, AND… they’re donating money to collectivist activism? What a bizarre combination. One step forward, two steps back.

donkarma• 4 years ago

could always just not use a smart phone

xtat• 4 years ago

TBH even 2m bounty on lockdown mode bypass seems really low

O__________O3• 4 years ago

///// Re: Bounty

From press release, “Bounties are doubled for qualifying findings in Lockdown Mode, up to a maximum of $2,000,000 — the highest maximum bounty payout in the industry.“

Appears Apple is not aware there was a $10 million bounty [1] paid out; unless when they say “by industry” they mean phones, not bug bounties.

If Apple really believed it was secure, then even a $100 million bounty shouldn’t be a concern; 2 million, while clearly high, is no longer enough to pull in the best bounty hunters, in my opinion.

///// Re: Naming

Name conflicts with existing terms both Apple and consumers use. Naming should be unique so it’s possible to Google the unique name for this feature and only get valid search results.

///// Re: iCloud

While iMessage features are limited, it is neither blocked, nor is iCloud — and both are known to being vulnerable to nation state demands on Apple due to iCloud not being end-to-end encrypted.

///// Re: iCloud end-to-end encrypt

If Apple was serious about the topic, they would have already rolled out end-to-end encrypt for iCloud years ago.

///// Re: Targeting

If Apple is logging if this feature is on and sending it back to Apple, it will result in targeting from nation states even if this feature is “invincible” - which I have no reason it is; basically, nation states demand list of users subject to its jurisdiction.

///// Re: Off vs Locked

“Wired connections with a computer or accessory are blocked when iPhone is locked.” — Why is this not the default with an opt-in? Further, at the point you’re turning on this features, when locking the phone it should explicitly tell the user of the risk of locking vs turning the phone off. Lastly, when you turn an iPhone off, it should really be off if set to this mode; if it is, and activity is detected, likely good sign something is going on.

_______

[1] https://medium.com/immunefi/wormhole-uninitialized-proxy-bug...

barbarousbull• 4 years ago

The overlap of eth bug-bounty hunters and iOS bug-bounty hunters is 0.

saagarjha8• 4 years ago

You'd be surprised.

clamprecht• 4 years ago

They should offer "US President mode". Didn't Obama have to have a special version of the Blackberry developed for him, while he was president?

sedatk• 4 years ago

Yeah, in which Twitter is also locked down.

stephc_int134• 4 years ago

What does it even mean to be a state-level actor? For me this is the same kind of bullshit/PR language that is is used to sell so-called "military-grade" artefacts.

This is nonsense. Security breaches can be discovered and used by anyone with the right knowledge and skills. Geohot was not sponsored by the CIA or the FSB.

halJordan• 4 years ago

State-level is a label for groups that have resources and persistence and perhaps the technical acumen that is available to states.

stephc_int134• 4 years ago

I know what the label is, but from a strictly technical point of view, a breach is a breach, an exploit is an exploit, this is not like AI research where you need server farms.

From my own experience and from the postmortems I have had access to, most of the time this a work of patience and skills.

In my opinion, this is a way of saying to the public that their devices is secure against everything but state actors, this is simply not true.

WFHRenaissance• 4 years ago

I think they're focusing on the notion of protecting against well-funded mercenary firms with the resources/time/ability/motivation to target specific individuals with specific exploits. I have a hard time believing that anyone would enable this Lockdown Mode _prior_ to being owned though.

threeseed6• 4 years ago

I have a hard time believing that anyone would enable this Lockdown Mode _prior_ to being owned though

I can imagine many use cases where they would e.g.

journalist enabling this before working on an article that was critical of a foreign government. Or any government contractor, NGO, embassy worker etc.

threeseed6• 4 years ago

Security breaches can be discovered and used by anyone with the right knowledge and skills

That's often not enough.

You need a lot of resources and most importantly prosecutorial immunity.

stephc_int134• 4 years ago

Why is that not enough? What do you mean? Because it would take too much time?

xyst• 4 years ago

Is the apple bounty program still terrible in terms of payout and length of time to approval?

I can’t see many people submitting bounty reports if it’s too much of hassle or not worth the effort.

Since the apple ecosystem is mostly proprietary, it’s hard to gauge as individuals if this just provides a false sense of security or not against “state actors”.

stephc_int134• 4 years ago

Computer security is notoriously difficult, but at the same time, none of this is magical, this is meticulous hard work, and with enough time, skills and money I don't see how you can't plug all the holes.

At least the remote attack surface does not seem to be that huge...

tristor2• 4 years ago

This feature is really fantastic, and it re-affirms my commitment to using Apple devices due to security in preference over Android. The only thing I could see that would be a superior alternative could perhaps be something like Graphene. Already today I locally set up a profile via Configurator in order to ensure that my phone can't be hijacked by some local attacks, the work that is happening Lockdown is even better and I'll be enabling this as soon as it becomes available to me.

dannyw4• 4 years ago

How do you reconcile that with their move into CSAM scanning?

tristor2• 4 years ago

Personally, one of the major things that lead me to start investigating Graphene and other alternatives was the on-device scanning. Fortunately, it seems Apple has backed away from this position (at least for now), and unfortunately we live in a world where if you need a mobile device there's a dichotomy. Given that, I think sticking to Apple is still the best choice for me right now, and aligns most strongly with my threat model.

I travel internationally a lot (or did before the pandemic) and my primary concern is when crossing borders. I always power off my devices to prevent warm-boot attacks, and take other precautions, this lockdown mode would be a big win in this case. Even with the other protections Graphene offers over regular AOSP, I am concerned that Android doesn't really provide meaningful ways to prevent attacks where the adversary has physical access.

TIPSIO• 4 years ago

If you are "a target" and going to take measures of basically disabling everything on your iPhone, wouldn't it just make sense to get a burner dumb phone?

Hasn't this been happening for years (drug dealers, anonymous, etc..)?

stu2b502• 4 years ago

Think more about journalist. You need slack to talk to the rest of the team. You need WhatsApp to communicate with sources and locals in most of the world that’s not the US. Your iPhone is an important tool for your work in general - a dumb phone that can only make real phone calls and sms is not particularly close.

Phone calls and sms are also completely unprotected as opposed to chat apps with e2e.

yreg• 4 years ago

What then? Use SMS?

pizlonator• 4 years ago

But then you’ll want lockdown mode (or something like it) on whatever device you use to browse the web.

numpad02• 4 years ago

But how secure are iDevices peripherals, and RAM? I guess it's a start of a journey, but I don't see this does anything yet.

saagarjha8• 4 years ago

Peripherals are behind a DART.

alwillis19• 4 years ago

Let's not let the perfect be the enemy of the good.

This is a huge step forward for iPhone users. Look, I get it. From the typical HN perspective, this potentially looks like a lot of hype. But many of you aren't looking at from a high level.

In the world we are now living in; even what's happening in the United States right now, being able to protect yourself from well-funded, determined attackers for the average person couldn't come at a better time.

There's a huge gap between Fortune 500 executives, government officials, etc. and regular people in terms of the resources available to them to prevent state-sponsored attackers. It doesn't take much these days to go from a nobody to being on somebody's radar.

If you're a woman seeking an abortion in a state where it's illegal or severely restricted, you could be the target of malware from your local or state government or law enforcement. In Texas, you can sue anyone who aids and abets a woman who attempts to get an abortion for $10,000, which is enough to get someone to trick someone into installing malware on a phone.

No, it's not China or Russia coming for you but it doesn't take much to ruin someone's life.

I don't think this is virtue signaling or marketing hype by Apple; if anything, this is right in alignment with the stance they've had on privacy for years. Even for a company the size of Apple, putting up $10 million to fund organizations that investigate, expose, and prevent highly targeted cyberattacks isn't pocket change.

At the end of the day, this is all good news for user privacy and security going forward. I also suspect if I lockdown my iPhone, my other compatible devices using the same Apple ID will also lockdown. No IT department required.

hk1337• 4 years ago

I kind of want to turn it on and leave it on. I'm assuming since it's a "mode" that I can turn it off when I need to, do what I know is legit, then turn back on again.

rmbyrro4• 4 years ago

Might not be as convenient. Probably requires restarting the phone.

kelnos3• 4 years ago

I would assume that disabling Lockdown Mode means wiping the phone to factory condition. Otherwise Lockdown Mode is only as secure as whatever PIN or password you use to disable it, which isn't particularly secure at all.

oneplane• 4 years ago

The thing with Lockdown Mode is that it shifts the trade-off between functionality and security significantly away from functionality. This is an acceptable side-effect of intentionally disabling attack surface that isn't strictly required to have a useful phone. On the other hand, it also makes most social time wasting stuff not work, which is what the masses mostly use their phone for anyway.

This really is a mode designed for those who really desperately need it, and it really is implemented in a strong enough way to be useful (hardware root of trust, no-drive by changes since it requires a reboot with a wiped key bag cache so you must reauthenticate in order to change it). But all of that for consumer-attainable pricing. It doesn't have to be perfect and I'm sure in due time there will be jailbreak-esque attacks. But until then, this is effectively a very high barrier for an attacker that lacks the resources of a nation state (or a smart but bored teenager in a basement these days).

O__________O3• 4 years ago

At the point it puts users at more risk that not, I don’t see this as a step forward; not informing users of the risk of having iCloud enabled is one example.

For more of my take on the topic, see:

https://news.ycombinator.com/item?id=32006436

jorvi• 4 years ago

I agree with the rest of your comment, but this

Even for a company the size of Apple, putting up $10 million to fund organizations that investigate, expose, and prevent highly targeted cyberattacks isn't pocket change.

is kind of funny, as it’s about 1/20000 of their total cash reserves. With 20000 in my savings account, it’d be equivalent to giving 1 dollar to charity. In other words, pocket change :)

PoignardAzur3• 4 years ago

It's still ridiculously good by bug bounty standards.

Zero-day buyers are going to have a hard time topping that.

jjtheblunt2• 4 years ago

where are the cash reserves documented?

andrewmcwatters• 4 years ago

"Silly HN reader, you're just not seeing the big picture." Could you not?

You know what people do when they're targeted by state actors? They don't use computers. And if they have to, they air gap.

astrange5• 4 years ago

It's true, NSO Group doesn't exist and none of their exploits have ever worked on anyone.

dangus3• 4 years ago

It seems like there could be a median area between "in the crosshairs of the KGB" and "I need to avoid off-the-shelf exploits in a specific situation."

A great example of this might be visiting a country like China while on business. Straight up going "off the grid" isn't really an option in that scenario.

PoignardAzur3• 4 years ago

You know what people do when they're targeted by state actors? They don't use computers. And if they have to, they air gap.

That's like saying "men who don't have easy access to condoms just stay abstinent instead". This is what we wish would happen. But empirically, they just shrug and do the insecure thing.

(There was an article posted on HN a few years ago that was from a journalist pointing out this exact thing, from his personal experience. I can't find it though.)

wnevets• 4 years ago

Someone better let those NGOs hacked by china know right away!

MBCook• 4 years ago

Ok. You’re in the Republic of Somethingistan. You’re alone. All you have is your phone to contact people at home to help you and some money and you need to get out.

You know the state is after you.

So you ignore this, turn off your phone instead, and… what? Now you’re even more alone, can’t get help from friends/family.

This seems like a very reasonable option in some situations.

hsbauauvhabzb4• 4 years ago

You realise users who sit on air gapped networks generally have a secondary device that connects to the public network. To you think the Elon airgaps his mobile?*

*maybe he has a team that audit comms for malicious activity and payloads, but not everybody is as well resourced so the point still stands

dkarl• 4 years ago

In Texas, you can sue anyone who aids and abets a woman who attempts to get an abortion for $10,000, which is enough to get someone to trick someone into installing malware on a phone.

Anecdata for people who think this is unlikely: my wife had an issue getting unclaimed property back from the state of Texas and hired someone who advertise the ability to help. She turned out to be a bulldog with a ton of knowledge of the necessary bureaucracy. She put hours per week into it on our behalf for months, through many rounds of filing paperwork and then hounding bureaucrats on the phone by telling them exactly how and why we could sue if they ignored it. She did all that for a cut that was a fraction of the $10k abortion bounty. The $10k might seem like a symbolic gesture, but it will spawn a cottage industry of bounty hunters. No doubt most of them will be ideologically excited wannabes who quickly give it up, but some will be dogged and effective and will cultivate an expanding repertoire of skills. It's a terrifying prospect.

There will be many, many people who never previously entertained the idea of getting involved in serious criminality who now need protection from the prying eyes of the state and their fellow citizens. To look at it from a cold and opportunistic viewpoint, this could change the public perception of digital privacy from being just for dangerous creepy people to something that everybody should value.

nextos• 4 years ago

Also, I personally know many old people who use a device just for managing their finances as they are inexperienced with security and fear their main device might get hacked.

This functionality makes a lot of sense in such a case.

fastball2• 4 years ago

Yeah except putting malware on someone's phone is actually illegal, so seems like a pretty bad tradeoff since, ya know, you'd have to mention how you got the data when you sue someone in court.

cirgue• 4 years ago

To add to this: the whole point of the private right to action is so that anti-abortion groups can target individuals in order to create precedent-setting cases. This is a mechanism that is designed to be used by well-funded groups. The threat model here isn’t some rando deciding they want to sue you, it’s a team of determined lawyers that absolutely will take your case as far as they possibly can.

greiskul• 4 years ago

I hadn't thought about this, but you are right. Hell, they don't necessarily even have to be immediately targeted attacks bounty hunters. Try to perform attacks in mass to read personal messages/e-mails of people, use filtering to try to find messages of people discussing getting abortions, and then parallel construct a innocent sounding story to use in court. With 10k per success, you really don't need that many hits to start making big money.

auggierose6• 4 years ago

I've been warned before by dang here on this site not to spew Anti-American propaganda (that was pre Jan 6, I think), but I never did such a thing. When I studied in SF in 1999, I freaking loved it. But I've seen some things since that are deeply troubling. It seems more people are catching up now to what I observed: if you still think that the US is a modern western democracy with reasonable values, wake up. I mean, people hunting other people who need an abortion for $10K? How can you read that and not have a cold chill running down your spine?

languageserver2• 4 years ago

There are LITERALLY abortion bounty hunters in Texas, who earn money by hounding women seeking abortions and turning them in for profit. I cannot believe the state of this country.

YooLi• 4 years ago

Any way you can name the person who helped with the unclaimed property issue?

adamc• 4 years ago

What needs to happen to such bounty hunters probably isn't safe to print.

Sebb767• 4 years ago

There's a huge gap between Fortune 500 executives, government officials, etc. and regular people in terms of the resources available to them to prevent state-sponsored attackers. It doesn't take much these days to go from a nobody to being on somebody's radar.

It's also a question of whether you want that. Anyone can take anti-phishing training, it just takes a lot of time. Want to download a mod for a game? You better have a separate gaming machine with no important data on it and, to be sure, in a separate network. Want to buy a phone? Better drive to a random store, ordering is to dangerous.

Sure, it's easy to get on the radar, but avoiding a state-sponsored hack is also a lot of effort. Fortune 500 executives need to put that effort in and they do have the money to make it happen, but for most people, the problem is not the cost.

rmbyrro4• 4 years ago

putting up $10 million isn't pocket change

10 Million = 0.0027% of Apple's sales in 2021.

Equivalent to an Apple developer who made 300K in 2021 donating 8 dollars.

If this doesn't classify as pocket change, it's quite close.

tyingq3• 4 years ago

Enlightening comparison, though revenue isn't income.

If you went with net income, it would be 0.0105% of Apple's 2021 net income.

Or $31.80 of $300k instead of $8.

fastball2• 4 years ago

Apple has a lot of other stuff to spend money on. Pocket change adds up.

samatman3• 4 years ago

Apple made 25 billion in profit in 2021, so the equivalent of a 300K income donating $1200 dollars.

To stave off tedium, it's still $800 at a 1/3rd tax rate. These numbers aren't pocket change any way you slice it.

smoldesu2• 4 years ago

If you're a woman seeking an abortion in a state where it's illegal or severely restricted, you could be the target of malware from your local or state government or law enforcement.

Let's not get in above our heads, here: if the US government wants to know what's on your iPhone, they still have the faculties to retrieve that information. Setting your iPhone in a lockdown mode isn't going to let you escape the purview of government surveillance, and if it did then Apple wouldn't be announcing it today. We're all targets of government malware, and the way they ensure we all keep it installed is simple: they just make Apple and Google write it for them. This pervasive idea that Apple is somehow escaping the jurisdiction of PRISM is pretty hysterical, and it makes me excited for the first Senators to get caught paying for prostitution services with Apple Pay inside Lockdown Mode. The only enemy of "good" in a threat model is the unknown, and Apple makes sure there's plenty of unknown factors in your iPhone.

Edit: For all HN loves to rant about the Halloween Documents, you lot seem awfully unfamiliar with the Snowden leaks...

kelnos3• 4 years ago

I have mixed feelings about this.

Lockdown Mode basically cripples the phone, feature-wise. It's not quite to the point where I'd (even hyperbolically) say "why don't you just get an old dumb phone instead", but still...

The right thing to do would be to redesign the system from the bottom up to actually be secure in the face of vulnerabilities in any of these features that get disabled because they can be dangerous for people. (And maybe Apple is working on this behind the scenes, which will take them years to complete.)

But, agreed: let's not let perfect be the enemy of the good. It's better to have this option than to not have it, even though it likely creates a super restricted user experience that probably isn't particularly pleasant to use.

Syonyk4• 4 years ago

Lockdown Mode basically cripples the phone, feature-wise. It's not quite to the point where I'd (even hyperbolically) say "why don't you just get an old dumb phone instead", but still...

The problem is that phones (of the "dumb"/"feature" variety) are running OSes that don't have nearly the security attention or hardware features related to them as iOS devices.

I carry a KaiOS feature phone as my personal phone (when I remember it). Apple pissed me off enough with the CSAM stuff that I wanted to experiment with alternatives, and I've done so. However, I don't pretend KaiOS is particular "hard" against attackers - it's almost certainly not. But neither does it have much of an attack surface. It doesn't even try to render emoji, they're just black rectangles. And neither does it try to, say, render weird old Xerox image formats.

I would trust an iOS device with "most of the complex attack surfaces turned off" far more than I'd trust a KaiOS or stripped Android device. You get all the hardware protections, regular OS updates, a bug bounty program focused on this mode, and the smaller attack surface window of Lockdown.

I'm incredibly excited by it, because it turns off all the stuff I don't want in a phone anyway.

Unfortunately, "crickets on CSAM" is a problem too. If they say they're not going to ship that ill conceived feature, I might move back to iOS. If not, well... I'll probably play with Lockdown mode for a week or two and then go back to the Flip.

tinus_hn• 4 years ago

This is overblown hyperbole, it disables a few features a lot of people have never even heard of.

Disabling the JIT compiler makes the browser a bit slower. It does not cripple it.

Disabling profiles, debugging and MDM? These are not useful unless you’re in ‘enterprise’ or a developer.

Can’t send documents or links through iMessage? Use another service or copy and paste the links you actually want to open.

Really a tiny price to pay for the added security.

m3kw9• 4 years ago

Lol may as well use a dumb phone because to redesign it from ground up and have the same features would end back square one

toofy2• 4 years ago

The right thing to do would be to redesign the system from the bottom up to actually be secure in the face of vulnerabilities

i understand the impulse to immediately question if this might solve security, but it just won’t. there are some classes of known vulnerabilities which it may mitigate, but at best it would be a temporary security solution.

security is hard.

we also need to remember that we would, with almost 100% certainty reintroduce long forgotten about mitigations that someone silently did years ago but they didn’t make a big deal over. or even mitigations which were made a big deal of, but they were a decade ago therefor long forgotten about.

we have a tendency to think those who built complex systems before us were unenlightened, or lazy, or primitive. this often really isn’t the case.

anyone who has worked on large projects will inevitably learn the hard way that scale adds incredible fractal depths of complexities that we can’t dream of until it slaps us in the face. so we put out that fire, do not-nearly-enough-documenting on why or what caused it so future people might avoid the same mistake, and then we continue running up the hill.

security is hard.

and of course sometimes a from-scratch-rebuild might make sense but we’d be looking at years and years of relearning mistakes which were previously learned and corrected for.

security is hard.

ulchar• 4 years ago

I'm not so sure. They _could_ start from scratch, building the same feature set but paying extra attention to security in every possible aspect of design, do you now have a system guaranteed to be free of malware? Never. We are talking nation state actors here. Doing that would ignore the really great (if merely suggested) admittance that apple is making here: reducing the attack surface is the only way to mitigate the unknown unknowns of software security.

Veserv6• 4 years ago

Let’s not let better be the enemy of good either. Better than terrible is still bad and is nowhere near good.

It is frankly ridiculous that anybody should believe Apple when they claim to provide even minimal resistance to well-funded determined attackers. Protecting against well-funded determined attackers has been the holy grail of software security since forever and everybody in software security at least claims to be working toward that. Despite that, the prevailing state of “best-in-class” “best-practices” commercial software security is objectively terrible including Apple circa 1 year ago.

Are we supposed to believe that Apple, despite abject failure over the last few decades until as recently as the last time they announced security updates to the iPhone, has finally this time, for sure, pinky swear its true, jumped from terrible to the holy grail, or even good, because they said so?

No, this is absolute, utter, unequivocal garbage. Their claims are completely unsupported and they should be excoriated for spewing unsubstantiated bullshit that muddies the waters of the actual state of software security and misleads people into believing they are getting a meaningful degree of protection or software security.

If they want to make such claims, they should put their money where there mouth is and, instead of certifying iOS to EAL1+ and AVA_VAN.1 as they currently do, they should certify it in “Lockdown Mode” to EAL6-7 and AVA_VAN.5 which actually does certify protection against “high attack potential” attackers such as large organized crime and state-sponsored attackers. At the very least they could certify it to EAL5 and AVA_VAN.4 which certifies protection against “moderate attack potential” attackers. Until they do that, their claims to protect against state-sponsored attackers are complete unverifiable bullshit.

donw• 4 years ago

Especially as Apple is often the "well-funded attacker".

saagarjha8• 4 years ago

First off, calm down. This feature came out today. It's not really clear yet how well it will fare. Second, this feature is a step in the direction of Apple accepting that defending against a well-funded attacker is difficult when providing general-purpose software, so this is still a step in the right direction.

heavyset_go• 4 years ago

If the state is after you, even low-level state actors, all it takes is a court order or subpoena to compel any of the parties involved with your phone or data to hand over your data or start collecting it.

If your threat model includes any level of the US government, and that includes women seeking abortions in states where it is illegal, you cannot rely on US-based company's tech to protect you from the law.

projectazorian• 4 years ago

There are state actors other than the US Government, along with plenty of non-state actors who are willing to use illegal techniques on occasion, and this does increase people's protection against those actors.

If you're in a developing country and you engage in activism against some questionable project by the state owned mining company, you're probably not going to get the full force of the NSA directed against you. But your country's domestic intelligence agency may be interested, and they probably only have off the shelf spyware to work with.

gcanyon2• 4 years ago

Pretty sure most things are stored encrypted/delivered encrypted only to be decrypted and rendered on your phone. Meaning Apple/your provider have nothing to give up for the hypothetical US government demand.

datavirtue• 4 years ago

A prominent activist was targeted and her iPhone compromised (owned). She ended up in prison/tortured because of it.

Did not look good for Apple. For a company of their means, they had to do something.

raybb• 4 years ago

Are you talking about this case? https://www.reuters.com/technology/how-saudi-womans-iphone-r...

theshrike79• 4 years ago

This was a very expensive hack. These are not the kind people throw away on an abortion case.

When you use the hack and it's discovered, it'll get patched and you'll need a new one. These cost 6 figures to acquire in the least.

akira25013• 4 years ago

The disconnect here is that Apple already monopolizes the devices, the service, and the application distribution platform. Now, they're expecting you to be satisfied with them monopolizing the security controls and monitoring on your phone.

We expect so little of our phones with respect to our desktops when we know full well there's no legitimate reason to do so. Particularly now, if you're imagining that one needs security against state level actors.. then the notion that a single vendor is required to simplify the ecosystem and broaden adoption is directly in conflict with this future you have declared we are now in. It's literally the weakest possible model of defense available.

This isn't the perfect being the enemy of the good.. this is Apple monopolizing yet another aspect of the platform for themselves at the cost of true innovation.

noduerme• 4 years ago

It's also a handy way to keep their stranglehold on iOS web browsers, forcing all to use webkit. How exactly they turn off JIT compiling and allow any javascript to run at all, I don't really understand, and I don't know what vulnerabilities they must be aware of in Safari's engine that could lead to unsandboxed code execution (although thinking about it, this seems to prove they're aware of something inherently unsafe there). But if their claim is along the lines that all JIT compilers are vulnerable, that's a strong case for never allowing V8 or any other engine in the app store.

andsoitis2• 4 years ago

Now, they're expecting you to be satisfied with them monopolizing the security controls and monitoring on your phone.

What is the alternative, though? That each user figures out for themselves how what their security risks are, cobble together various security-focused apps, stays up to date with new developments, etc.?

anshumankmr• 4 years ago

$10,000, which is enough to get someone to trick someone into installing malware on a phone.

People have done far worse for far less.

mlindner2• 4 years ago

If you're a woman seeking an abortion in a state where it's illegal or severely restricted, you could be the target of malware from your local or state government or law enforcement. In Texas, you can sue anyone who aids and abets a woman who attempts to get an abortion for $10,000, which is enough to get someone to trick someone into installing malware on a phone.

Can we stop spreading these lies?

yourad_io• 4 years ago

What is false about this?

hulitu• 4 years ago

At the end of the day, this is all good news for user privacy and security going forward.

What can i say ? Good luck then with your "privacy and security going forward". And remember later, when they knock at your door, that it was for your's and (mostly) their security.

mouzogu2• 4 years ago

maybe stupid question, but wasn't apple a part of prism (https://www.theguardian.com/world/2013/jun/06/us-tech-giants...)

are these US companies not legally obligated through some clandestine patriot act style laws to enable backdoors - and to deny the existence of these at any cost.

captainmuon2• 4 years ago

I wonder, why doesn't Apple (and MS, Google, ...) throw all their weight into the ring and lobby for making selling exploits commerically a crime? It should be up there with counterfeighting money or selling nuclear secrets. NSO Group should be on sanction lists. Politicians should be ranting about how dangerous it is that foreign companies and countries can spy on US citizens (instead of what they are usually ranting about).

You could wake up one morning, and every billboard in Washington, every newspaper will have ads for this issue. Every representative would be followed around by lobbyists. And Apple could pay it from their coffee money.

Now, I get why we don't crack down harder on selling exploits. First, intelligence agencies love NOBUS (No one but us) exploits and believe something like this exists. Second, it is convenient because sometimes foreign intelligence agencies are used to spy where domesitc agencies are not allowed to; and third the US could probably do little (officially) against companies, say, in Israel.

But this is totally the kind of issue that you could escalate into a bipartisan national security thing. And it would be an incredible marketing, and security win if Apple could push any stricter legislation in that direction.

rsync3• 4 years ago

"I wonder, why doesn't Apple (and MS, Google, ...) throw all their weight into the ring and lobby for making selling exploits commerically a crime?"

I would be strongly, strongly opposed to this.

It is a clear-cut free speech / first amendment issue.

If you don't believe me, just imagine yourself describing the pseudocode of an exploit to someone over the phone - or sketching out the details of a vulnerability in a short note.

I believe we won't get to this place because we have the first amendment but I would really love to not waste ten years fighting about it ...

switch007• 4 years ago

Is there any topic Roe v Wade can't be shoehorned in to?

bakugo• 4 years ago

There is no topic that Americans won't somehow manage to shoehorn unrelated American politics into, no. No matter how little sense it makes.

lrvick2• 4 years ago

Let us not gloss over the fact that in China Apple willingly handed over their HSMs to the CCP granting them full control of Apple devices there, even if it means aiding in Uyghur genocide.

When it comes down to money, or protecting the freedom or privacy of users, they will choose money. In this case the money is in good PR to help them secure more government contracts. They are playing all sides.

I do not feel anyone that needs high freedom, security, and privacy is well served by proprietary walled gardens. Particularly those that only grant holes in the walls to corrupt state actors.

https://www.nytimes.com/2021/05/17/technology/apple-china-ce...

gtvwill• 4 years ago

Lol this is a whole lotta faith based on nothing. Sorry bud Aussie laws gonna puck you here. Your Apple device can be backdoored curtosy of aus laws and apples not allowed to inform you it's happened. If you think lockdown mode gonna prevent this your 100% dreaming. Much lulz y'all should just put less data on your phone if your concerned with others knowing that data.

Handytinge2• 4 years ago

Absolutely the Australian government have put in some questionable (bipartisan) security laws in the last few years, and Apple _may_ comply with a request under them (even though it famously hasn't many times).

However the Australian government attacking you specifically isn't the only problem this solves.

mkd1964• 4 years ago

On the other hand, if you're a ballot trafficker, this is good news for you and the non-profits and NGOs abetting you.

verdagon• 4 years ago

Very cool! I wonder if this, combined with some sandboxing for apps' unsafe code, could make a more secure OS than any previous mainstream ones.

toomim• 4 years ago

Messages: ... Some features, like link previews, are disabled.

I've been wanting to disable link previews for YEARS!! Not for security, but to keep those corporate advertisements (aka previews) out of the conversations I have with my friends and family.

It feels super disingenuous when I type out an articulate, heartfelt, personal message to my loved one, character by character, anticipate their reaction reading it, and then hit send — only to find the URLs expanded 400 pixels into corporate advertisements designed by the bonehead SEO jerks who care about clickbaiting over content.

rootsudo• 4 years ago

That's the thing, if you think your device is compromised, don't use it. This is dangerous as it's a bandage and most likely allows surveillance that's "pre-approved" or is carrier based, probably even baseband modem based.

mensetmanusman• 4 years ago

Will this be available to Chinese residents? Huge if so.

bombcar• 4 years ago

Everything else to the side, this is excellent marketing on the level of Tesla's "bioweapons filtering mode".

swayvil• 4 years ago

Inflation, pollution, censorship, global warming...

Hey no, don't look at that, look over here instead. We're playing ratfuck with the abortion laws.

Magicians call that "misdirection".

m4632• 4 years ago

If I could just firewall my phone like Little Snitch.

But apple doesn't allow this.

ignoramous6• 4 years ago

Firewalls like Little Snitch may not be enough against actors like NSO (that exploit unknown zero-days), tbh. The mechanisms to enhance protection does need to come from the vendor (Apple). This lockdown mode, for all its present shortcomings, is moving the needle in the right direction, imo.

m4632• 4 years ago

with something like little snitch, you could just prevent or tune internet access on an app-by-app basis. including system apps.

Apple - in a self-serving way - does not provide good permission for network access.

I think it should say "allow this app to access the internet?"

There is also deep linking, the ibeacon stuff, the find my, the wifi access point mapping, and more

lizardactivist• 4 years ago

It's good I guess, but I will not convince myself that a button saying "Lockdown mode" will casually side-step the entire legal and surveillance machinery built up in the U.S.

Veserv6• 4 years ago

I do not know why anybody would believe any claim by Apple with respect to security without overwhelming empirical evidence supporting their claims. The default assumption in commercial software security, supported by literal decades of abject failure by every player, is that commercial software security is atrocious. To claim anything more than trivial security is a extraordinary claim and thus demands extraordinary evidence before being accepted.

Apple has demonstrated no such evidence. In fact, the opposite is the case. Despite decades of assurances that their systems provide meaningful security, every single year we see their security torn apart by individuals and small teams with budgets that do not even constitute rounding errors to a Fortune 500 company. There is exactly no reason to believe they have meaningfully superior technical expertise with respect to security relative to the default standard of the industry.

However, this should be no surprise to anyone as the security certifications that Apple advertises for iOS [1][2] are only “applicable where some confidence in correct operation is required, but the threats to security are not viewed as serious.” [3][4]. I mean, look at [4], the process used to certify their security is that their evaluators typed search terms into the internet and verified that every vulnerability that turned up was patched, that’s it. There is no requirement to even do a independent analysis that it protects against attackers with a basic attack potential, that is done at the next higher level of security that they could have chosen to certify against, but did not.

To be fair, Apple has historically demonstrated the ability to certify against AVA_VAN.3 which demonstrates resistance to attackers with a enhanced-basic attack potential, but they have failed every time they have ever attempted to certify against AVA_VAN.4 which demonstrates resistance to attackers with a moderate attack potential. It should be no wonder that they can not protect against moderate attack potential threats such as individuals or small teams, let alone high attack potential threats such as large organized crime and nations.

If Apple wants their security claims to be taken seriously, they should start by demonstrating their ability to protect against moderate attack potential threats via the internationally recognized security certification process they already use and advertise. Until then, the only thing we should trust is what they certify they can do (protect against script kiddies), not what they have failed to ever achieve in a auditable manner (protect against moderately skilled attackers).

[1] https://support.apple.com/guide/sccc/security-certifications...

[2] https://www.niap-ccevs.org/Product/Compliant.cfm?PID=11146

[3] https://www.niap-ccevs.org/MMO/Product/st_vid11146-aar.pdf#p...

[4] https://www.commoncriteriaportal.org/files/ccfiles/CCPART3V3...

kderbyma3• 4 years ago

They would probably have a better chance of they applied the same budget to their security as their marketing.

GuB-422• 4 years ago

So Apple is saying that their "Lockdown Mode" protects against "highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware".

That's an interesting wording, because it claims to protect you against... nothing that matters. Notably, it doesn't protect you against:

- The police. Don't get me wrong, I am all for letting the police do its job fighting crime, even if it means hacking iPhones, but even if you got the police attention for a noble cause, Lockdown Mode won't save you, at least, it doesn't claim to.

- Foreign governments, as well as your own government. Notice how it mentions "private companies" specifically, as in, not public. And the cyberattacks themselves have to be performed by private companies, if the tools that these companies develop are used by government entities, it doesn't count.

- Cybercriminals, the kind who are after your money. They are not "private companies", and they are usually not state-sponsored.

- Terrorist organizations, mafias, drug cartels, etc... again, not "private companies", and while they may be backed by states, they typically work for themselves.

The technical aspects have value, and I think giving the user the choice of wearing a tinfoil hat is great, but the claim they are making is deceivingly weak if you read carefully.

ngetchell• 4 years ago

The NSO group used links and attachments in iMessage. These protections would mitigate those attacks.

concinds5• 4 years ago

They used an "invisible 0-click exploit"; where you don't even actually receive a text message or need to click any links or attachments. https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac... Would Lockdown Mode prevent those?

And what about the SMS equivalent? https://www.firstpoint-mg.com/blog/step-by-step-silent-sms-a... Apparently the German authorities sent 440,000 "silent SMSs" for tracking purposes in 2010: https://www.heise.de/newsticker/meldung/Zoll-BKA-und-Verfass...

ec109685• 4 years ago

Cybercriminals are often state sponsored and do a bit of government hacking and their own hacking.

This is kind of a silly comment.

Making a phone harder to hack will help with foreign (and domestic) governments that buy exploits to target individuals as well as hackers trying to make money off of similar exploits.

GuB-422• 4 years ago

I am not saying Apple did anything wrong with their solution, I think it is great, really.

I then thought: isn't that something that terrorists and pedophiles will love? If it is really that effective, I expect that soon enough, we will stories about Apple helping very very bad people who are after your children, and I don't think Apple wants to be associated with crime, and I was wondering what would Apple strategy be.

And that's when I noticed that very specific claim "highly targeted cyberattacks from private companies developing state-sponsored mercenary spyware", what are the words "private" and "mercenary" doing here? They do nothing but reduce their claims?

I am not calling conspiracy here, and I really think what Apple did is great, but I suspect that specific wording is Apple being cautious, probably of potential association with crime.

derefr5• 4 years ago

Cybercriminals and terrorist organizations mostly pay the private companies Apple refers to here to do their dirty work.

concinds5• 4 years ago

Could a security expert enlighten me: is Windows more secure today than macOS, if we purely take OS-level and hardware-level security measures and ignore subjective factors? (like marketshare, attractiveness of targets, etc.)

Windows has all sorts of buzzwordy-sounding security features: Microsoft Defender Application Guard (Hyper-V for untrusted websites & Office files), kernel virtualization-based security (VBS), Code Integrity Guard, Arbitrary Code Guard, Control Flow Guard, and Hardware-enforced Stack Protection.

It's extremely hard to compare the two on a deep technical level (beyond "modern OS's are safe, install updates, you'll be fine") without having deep security experience. Any professional insights?

Veserv6• 4 years ago

There is no meaningful difference if you are a modestly attractive target. The prevailing level of security is such that a single technically competent individual with a year of time can completely breach the commercial IT systems of any Fortune 500 company in the world and steal essentially all of their internal documents and IP and materially disrupt their operations. That is the maximum level of security in commercial IT systems.

So, if you have nothing worth more than ~$1M and indefinite disruption of your systems is worth less than ~$1M, then there might be a meaningful difference. However, basically every business is beyond those levels, so quantifying the differences in a professional context is kind of like discussing whether a tshirt or a single piece of paper provides more protection against a gun.

jacooper3• 4 years ago

I would say just use GrapheneOS, Ana actual security and privacy focused OS. And Qubes on PC.

subtract-smiles• 4 years ago

Wow I guess apple was really peeved about Pegasus.

masswerk• 4 years ago

I think this is a great feature and a huge step in the right direction.

However, will this comply with the new EU Digital Markets Act (DMA), which provides a general interoperability for messaging apps (for big players, with Apple and iMessage being certainly one of them)? Certainly, foreign services – or at least parts of their features and APIs – had to be disabled in lock-down mode. (Will it help to any degree that Apple is drastically limiting their own service?)

metadat4• 4 years ago

What is Google / Android doing to protect us from NSO group?

Seems like a lot less than the care Apple is taking on behalf of vulnerable people.

saagarjha8• 4 years ago

Well, Google happens to have teams that work to help shine a light on what the NSO is doing.

metadat4• 4 years ago

It's good to shine the light, and the Android platform still remains wide open.

nykolasz• 4 years ago

I would love to see a "child" lockdown mode. Maybe that will be a good option to make the iphone/ipad more young children safe?

saagarjha8• 4 years ago

This sounds like parental controls?

lttlrck• 4 years ago

Only yesterday I was wishing there was a Valet Mode for when I hand a phone over to Apple for servicing. Hopefully they will accept this...

dannyw4• 4 years ago

You don't need to give them the PIN.

halfsquatch• 4 years ago

Congratulations Apple, you just invented BlackBerry.

Terry_Roll2• 4 years ago

So can I still be tracked using SS7?

kylehotchkiss4• 4 years ago

You could carry your phone in one of these if you’re worried about being tracked: https://slnt.com/products/faraday-cage-sleeves-for-phones

But practically speaking your debit or credit card does a pretty good job keeping track of where you are if your phone isn’t transmitting

Terry_Roll2• 4 years ago

Well the last phone I got, it was directing me to AirBnB's with masonic ties who liked to tell stories of violence. I had my first masonic lesson of keeping my mouth shout or be killed when I was at primary school, but I dont care now, life is overrated!

motohagiography• 4 years ago

If Apple co-ordinated with Signal, Slack, and Symphony to release lockdown compliant modes for their products, this mode could be my daily driver.

stephen_g2• 4 years ago

This is great. Here in Australia, when you pass through the border, the goons can ask you for your phone, computer, devices etc. without a warrant. They’re not allowed to compel you to hand over passwords, PINs or have you unlock it for them (without a warrant) though, but apparently they’ll often imply that you have to, and if you don’t they can confiscate the devices for some time.

This mode sounds excellent, because all they can do without a warrant is try and attack it with a Celebrite or Graykey device, so having the extra protection from physical connection and other attacks sounds awesome.

I expect to always enable this while I’m doing international travel anywhere.

dannyw4• 4 years ago

I was threatened with 10 years imprisonment if I did not hand over my passcode at SYD airport in July 2018. I asked to contact a lawyer and I was told I have no right to do so. I am an Australian citizen.

WrtCdEvrydy• 4 years ago

Wired connections with a computer or accessory are blocked when iPhone is locked.

Damn... if this was something that could be enabled by typing the pin in wrong, it would be the death of modern phone forensics. Actually, I would rather this be the default after a device is powered on... let me "restart in non-safe mode" when I need it.

luispa• 4 years ago

I think this is very huge for the infosec game, but I think the `unless the user excludes a trusted site from Lockdown Mode.` is still a bad take.

fartcannon• 4 years ago

Great, now give me the options to fully open it up.

devwastaken• 4 years ago

Marketing vaporware. The attacks used by NSO and other groups were exploits. You have two choices, either do not use the device with any external connection and not be exploited, or use the device with external services and be exploited. You cannot have it both ways. The underlying software will have to be written in a safe programming language, along with significant scrutiny on it's logic.

We will never have this, because we are ever decreasing the quality of software development. Apple could do something about this, but that is a politically and financially expensive move for no extra financial gain.

As always people will eat this up, and business will continue unaffected as usual.

Tepix9• 4 years ago

If it reduces the attack surface by a lot, why do you call it vaporware?

throwaway787544• 4 years ago

Weren't SMS messages used to root iPhones in one exploit?

https://www.wired.com/story/imessage-interactionless-hacks-g... https://www.cnet.com/news/privacy/researchers-attack-my-ipho...

Tepix9• 4 years ago

Most exploits are related to dealing with multimedia contents. By protecting against these exploits the attack surface gets a lot smaller.

ece• 4 years ago

Hey look, sys-admining your phone, but it's Apple style sys-admining, so it's ok.

mouzogu2• 4 years ago

since it has been memory holed.

apple is/was a part of prism (https://www.theguardian.com/world/2013/jun/06/us-tech-giants...)

"An Apple spokesman said it had "never heard" of Prism."

fareesh• 4 years ago

I can't wait for people to turn this on and file bug reports and followed by "but I didn't enable that!"

vivegi• 4 years ago

These two sound like good defaults for all iPhones.

Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.
Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.

Labo333• 4 years ago

What about E2EE backups? https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

kraf• 4 years ago

Cool, is this like GrapheneOS just without being open and free?

shp0ngle• 4 years ago

Is there a reason why I wouldn’t use this as default?

I hate most iMessage functionality and I will be happy to get rid of it for security. The rest also seems reasonable?

highwaylights• 4 years ago

This seems to mimic, or at least rival, Google's Advanced Protection Program which has been running for a few years to offer similar protections to Google/Android users.

My concern about enabling this would be that I'm unsure how much this puts barriers in place to prevent the owner of an account regaining access should it be stolen by a threat actor (i.e. could this backfire on the account owner?).

It's still unclear to me how much Apple really protects against (for example) sim swaps to take over an iCloud account - and the documentation around when they'll truly insist on having something like a Recovery Key if it's enabled is sparse. It almost reads as if the right amount of begging will socially engineer access to a locked iCloud account by a threat actor with the right personal information to hand, which if coupled with Lockdown mode, seems pretty dangerous to the true account holder.

twayt• 4 years ago

This definitively signals that Apple devices are no longer secure, terrible move.

Tepix9• 4 years ago

If you thought they had no holes before, you were mistaken.

ngcc_hk2• 4 years ago

“Just when I needed you most.”

yieldcrv• 4 years ago

Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled.

NSO Group's zero click exploit for iphones involved images. specifically using the PNG compression algorithm to use the logic gate sequence of the CPU to compile and execute a new process that allowed for escape

If that's the level of sophistication this is to guard against, then it seems like it should include a block of images

nnm• 4 years ago

I just ordered a pixel 6. Really hope Android/Google will have the same mode.

jbaviat• 4 years ago

[Disclaimer: I worked in Apple Red Team]

What if this isn’t a good news for 99% of Apple users?

That’s obviously an amazing measure for the 1% high targets out there.

But what about the other 99%? Does that create an incentive for Apple to strengthen Lockdown Mode security to the detriment of the regular mode (should we call it Unsafe Mode)?

I’m afraid that this architecture will make it harder to prioritize security features or fixes for the 99% users. Developers bandwidth is limited, they can’t fix all bugs. Hence if you have to choose between one bug impacting the 1% most important users (from a security standpoint) versus one bug impacting the 99% others, which would you choose?

Would such an architecture have led to the emergence of Blastdoor[1] - which attempts at mitigating iMessage attachement exploits, but is now useless in Lockdown mode?

My hope here is that by reducing attack surface, Lockdown mode will make exploits much easier to fix (as they’ll target a limited area), allowing to strengthen the system core while freeing bandwidth to implement longer term, Blastdoor like mitigations.

[1] https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime...

jgerrish• 4 years ago

First, lets talk in the foggy dreamland of this article.

I can't imagine the threats security researchers deal with every day. And their innovative solutions. Extracting live code from samples to inject in other malware. Wow, so cutting-edge. It's wonderful to talk about, no stress there, no drama. We don't want wear and tear on our machines.

Like the article states, we're spending millions and billions on these problems.

And lockdowns are an innovative approach. I've been thankful for device lockout in the field before. It's saved my bacon. Captures the favorite philosophy of strong regulatory control. Nice, has network effects for other political goals. Very cool.

Better than Kevorkianing or Bricking a machine in the field.

Oh God, Oh God, Oh God. Sorry for that narrative-scape shattering. Dementia is a serious issue. Ok, back to sanity.

Some really fucking smart people showed me a study on evolutionary computation and diversity in investigator-guided processes. Hand-edited synthetic organisms may be less evolutionary successful than purely evolved ones.

Like my storytelling, right? It's a fucking hot mess that isn't excersing my audiences mind as much as a more diverse author population.

Oh God, there I am breaking down story-wise. Back to stability. We have political goals like reduction of 99% of security threats. And the perfect is the enemy of the good, right?

I'm so sorry for my slips there, I know you lost time with loved ones and reading other comments talking about this in a more professional tone that captures the point.

In closing, I'd like to thank the sponsors who kept me fed for years.

nhoughto• 4 years ago

ironically if this is successful we likely won't know how deep the hardening goes, unless security researchers who have legit access release something?

but i'd love to know the series of changes that goes into something like this if its not just hype, potentially unpicking a giant complex system from the bottom up to remove attack surface.. interesting challenge!

kderbyma3• 4 years ago

only $10m? hahaha they don't care

Apple previews Lockdown Mode

Related Stories