Apple says no one using Lockdown mode has been compromised by spyware

Nearly four years after launching a security feature called Lockdown Mode, Apple says it has yet to see a case where someone’s device has been compromised with these additional security protections turned on.

“We are not aware of any successful mercenary spyware attacks against an Apple device that supports Lockdown Mode,” Apple spokeswoman Sarah O’Rourke told TechCrunch on Friday.

It’s the tech giant’s latest confirmation that Apple devices with Lockdown Mode can withstand government spyware attacks afterward First, submit the claim A year after the security feature debuted.

Apple announced in 2022 lockdown modea series of opt-in security protections that turn off certain features in iPhones and other Apple devices that are commonly exploited to compromise targets with spyware. Apple released this security mode specifically to help vulnerable customers defend themselves from threats posed by government spyware made by companies like Intellexa, NSO Groupand Proverb solutions.

In recent years, Apple has acknowledged that its customers could be compromised by spyware, and has been more active in notifying customers who have been targeted.

Apple has Sent multiple batches to Notifications to users in more than 150 countries, alerting them that they may have been compromised using spyware, demonstrating how much visibility the company now has into these types of attacks. Apple has never said how many users it has notified, but it’s safe to assume there are dozens, if not more.

Digital rights organizations such as Amnesty International and the University of Toronto’s Citizen Lab have documented several successful attacks on iPhone users, none of which reported bypassing Lockdown Mode. at least two CasesCitizen Lab researchers have publicly said they have seen Lockdown Mode effectively prevent spyware attacks, One was implemented using NSO’s PegasusThe other With predatory spywaremade by company Now part of Intellexa.

In at least one documented case Spyware attack targeting iPhone devicessecurity researchers at Google He said It will save the spyware from trying to infect the victim if it detects the lock mode, most likely as a means of avoiding detection.

Lockdown Mode is an important feature that makes it harder for spyware makers to attack Apple users, says Patrick Wardle, Apple’s cybersecurity expert and critic.

“I think it’s safe to say that Lockdown Mode is one of the most aggressive consumer-facing hardening features ever,” he told TechCrunch.

By “reducing the attack surface,” Lockdown Mode eliminates many of the techniques typically used to exploit iPhones, forcing spyware makers to use techniques that are more complex and expensive to develop, Wardle explained.

“It kills entire delivery mechanisms/exploit classes, because it blocks most types of message attachments, and restricts WebKit features. This is already a significant reduction in the remotely accessible attack surface, especially for zero-click exploit chains,” he added, referring to exploits that can target people online without any interaction from the victim.

The security mode was likely bypassed, and neither Apple nor independent investigators were able to detect the attack. But given that Apple typically remains publicly silent at the best of times, its latest statement represents an important milestone in lockdown mode.

I’ve been using Lockdown mode for years, and I barely think about it – Except when notifications pop up It can be confusing sometimes. Some turned off features require you to take an extra step, such as copying and pasting links from text messages to your browser. For this reason, I and many digital security experts recommend that anyone concerned about being targeted by spyware or digital attacks turn on Lockdown mode.