New Delhi: The alerts sent out by tech major Apple to some Opposition leaders in India Tuesday about a possible “state-sponsored” attack has put the spotlight on the ‘Lockdown Mode’ on its devices which can help protect them against extremely rare and highly sophisticated cyber attacks.
According to Apple, “the Lockdown Mode is an optional, extreme protection that’s designed for the very few individuals who, because of who they are or what they do, maybe personally targeted by some of the most sophisticated digital threats.” The company, however, believes that most people will never be targeted by such attacks.
Apple released the Lockdown Mode in September 2022 as a part of the new iOS 16 launch. It is available in “iOS 16 or later, iPadOS 16 or later, watchOS 10 or later and macOS Ventura or later. Additional protections are available in iOS 17, iPadOS 17, watchOS 10 and macOS Sonoma,” and Apple suggests updating the device to the latest software before turning it on.
Once the mode is enabled, the device does not function like it usually would. To reduce the attack surface that could potentially be exploited by highly targeted mercenary spyware, certain apps, websites and features are strictly limited for security, and some experiences may not be available at all.
For example, in the messages application in Lockdown Mode, most attachment types are blocked. Some features, such as links and link previews, are also unavailable. Similarly, during web browsing, certain complex web technologies are blocked, “which may cause some websites to load more slowly or to not operate correctly. In addition, web fonts may not be displayed, and images may be replaced with a missing image icon”.
According to an investigation by Citizen Lab, a Canada-based digital watchdog group, the Lockdown Mode seems to block some of the worst commercial spyware, including foil hacking attempts from Israel’s cyber intelligence firm NSO Group, which is known for its Pegasus spyware.
The Citizen Lab tracked the NSO Group’s attempts to target members of Mexico’s civil society, including two human rights defenders from Centro PRODH which represents victims of military abuse in the country.
It found that for a short period, “targets that had enabled iOS 16’s Lockdown Mode feature received real-time warnings when PWNYOURHOME exploitation was attempted against their devices”. PWNYOURHOME is a spyware that can infiltrate a user’s iMessages app and tamper with the HomeKit software.
“Although NSO Group may have later devised a workaround for this real-time warning, we have not seen PWNYOURHOME successfully used against any devices on which Lockdown Mode is enabled,” the watchdog said in its report, published earlier this year.
How Lockdown Mode protects device
According to Apple, “FaceTime — incoming FaceTime calls are blocked unless you’ve previously called that person or contact. Features such as SharePlay and Live Photos are unavailable. Apple services — incoming invitations for Apple services, such as invitations to manage a home in the Home app, are blocked unless you have invited that person previously.”
When photos are shared, location information is excluded, shared albums are removed from the Photos app, and new Shared Album invitations are blocked.
The mode also affects some features relating to device connections, wireless connectivity and configuration profiles. “Phone calls and plain text messages will continue to work while Lockdown Mode is enabled. Emergency features, such as SOS emergency calls, will not be affected,” the company says.
(Edited by Smriti Sinha)
Also read: What is Pegasus? The ‘ultimate spyware’ used for surveillance