Lockdown Mode: Apple's silver bullet for mercenary spyware

The new Lockdown Mode feature is coming with iOS 16, iPadOS 16 and macOS Ventura (v13) updates to eligible Apple devices later this year

Over the last few years, there has been increased surveillance by government and private spy agencies on activists and journalists. Some scandals include the Pegasus spyware by Israeli NSO Group and the most recent one the Hermit espionage software by Italy-based RCS Lab.

Now, Apple a strong advocate of user privacy is bringing a strong impregnable security feature 'Lockdown Mode' that is capable of blocking state-sponsored mercenary spyware on iPhones, iPads, and Macs.

The Cupertino-based company has previewed the new 'Lockdown Mode' feature in the beta versions of iOS 16, iPadOS 16 and macOS Ventura (v13).

Apple says the new Lockdown Mode will be an optional feature. It can be turned on and off by the user. If the individual is a high-value target (HVT), he/she can turn it on their device, and once activated, it will harden device defenses and strictly limits certain functionalities of messenger apps, web browsing, and wired connections (for data transfer), and more.

Here's what happens when 'Lockdown Mode is turned on:
Messages: Once the 'Lockdown mode is activated, most of the message attachment types other than images are blocked. Some features, even the link previews, are also disabled.

It should be noted that state-sponsored spy agencies used Pegasus spyware via phishing technique to breach iPhones. They sent texts with compromised URL links to the Messages app's inbox of the targeted individuals.

Once infected, Pegasus can record any conversation made in the vicinity via the microphone or the cameras of the user's iPhone. The live GPS location can be tracked at all times and the spyware uses keystroke logging (recording keystrokes) to keep a log of any text message or email typed out after the infection.

It can record phone calls, personal information such as passwords, contacts, and even personally identifiable biometric information as well. New variants of Pegasus are also capable of accessing data from user account-linked cloud storage and can even override two-factor authentication.

But, with the Lockdown Mode, the spyware will not be able to access anything on the iPhones (even iPads or Macs) in the future.

Read more | Pegasus spyware: All you need to know

Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode.

Apple services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent the initiator a call or request.

Wired connections: Any attachments with a computer or accessory are blocked when iPhone is locked.

Apple's new Lockdown mode on iPhone. Credit: Apple

Also, while Lockdown Mode is turned on configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM) software offered by the company's IT admins to track, manage and secure corporate. Even the personally-owned mobile devices that run across multiple operating systems will not be able to connect with other devices such as a computer during Lockdown Mode.

That's not all; Apple plans to add new protection features to the Lockdown Mode in the thwart threats in the future.

All three new software updates-- iOS 16, iPadOS 16, and macOS Ventura(v13) are scheduled to be rolled out later year around September to all eligible devices for free.

“Apple makes the most secure mobile devices on the market. Lockdown Mode is a groundbreaking capability that reflects our unwavering commitment to protecting users from even the rarest, most sophisticated attacks. While the vast majority of users will never be the victims of highly targeted cyberattacks, we will work tirelessly to protect the small number of users who are. That includes continuing to design defenses specifically for these users, as well as supporting researchers and organisations around the world doing critically important work in exposing mercenary companies that create these digital attacks,” said Ivan Krstić, Apple’s head of Security Engineering and Architecture.

It should be noted that Apple last November started a $10 million cybersecurity program to support civil society organisations that conduct mercenary spyware threat research and advocacy.

The company has also established a new category within the Apple Security Bounty programme to reward cyber experts who find Lockdown Mode bypasses and help improve its protections. Bounties are doubled for qualifying findings in Lockdown Mode, up to a maximum of $2,000,000 — the highest maximum bounty payout in the industry, Apple said.

Must read | Users can now check if their Apple iPhone has Pegasus spyware or not

Add to that, Apple will be offering more donations to the Dignity and Justice Fund (DJF) established and advised by the Ford Foundation. It is a private foundation dedicated to advancing equity worldwide and designed to pool philanthropic resources to advance social justice and work on detecting the development of spyware such as Pegasus globally.

Initial members of the DJF include Daniel Bedoya Arroyo (digital security service platform analyst at Access Now), Ron Deibert (professor of political science, and director of the Citizen Lab, University of Toronto), Paola Mosso (co-deputy director of The Engine Room), Rasha Abdul Rahim (director of Amnesty Tech at Amnesty International), and Ivan Krstić (head of Apple Security Engineering and Architecture).

Must read | Apple app tracking transparency: Key features you should know

Get the latest news on new launches, gadget reviews, apps, cybersecurity, and more on personal technology only on DH Tech.