July 6, 2022
UPDATE
Apple expands industry-leading commitment to protect users of highly targeted mercenary spyware
Apple is previewing an innovative security capability that offers additional specialized protection to users who may be at risk from very specific cyberattacks by private companies developing state-sponsored mercenary spyware. Apple also offers details of its $ 10 million grant to bolster research exposing these threats.
Apple today detailed two initiatives to help protect users who may be the personal target of some of the most sophisticated digital threats, such as those from private companies that develop state-sponsored mercenary spyware. The lock mode, the first large capacity of its kind, which will arrive this fall with iOS 16, iPadOS 16 and macOS Ventura, is an extreme optional protection for the very small number of users facing serious and targeted threats to their digital security. Apple also shared details about the $ 10 million cybersecurity grant it announced last November to support civil society organizations conducting research and advocating for mercenary spyware threats.
“Apple makes the most secure mobile devices on the market. Lock mode is an innovative capability that reflects our unwavering commitment to protecting users from even the rarest and most sophisticated attacks,” said Ivan Krstić, head of Engineering and Apple Security Architecture. “While the vast majority of users will never fall victim to highly targeted cyber attacks, we will work tirelessly to protect the small number of users who are. This includes continuing to design defenses specifically for these users, as well as supporting researchers and organizations around the world doing critical work to expose the mercenary companies that create these digital attacks. “
Lock mode offers an extreme and optional level of security for the few users who, by who they are or what they do, can be personally targeted by some of the most sophisticated digital threats, such as those of the NSO group and other private companies. state-sponsored mercenary spyware development. Enabling lock mode on iOS 16, iPadOS 16, and macOS Ventura further tightens the device’s defenses and strictly limits certain features, drastically reducing the attack surface that could be exploited by highly targeted mercenary spyware.
At launch, lock mode includes the following protections:
- Messages: Most message attachment types other than images are blocked. Some features, such as link previews, are turned off.
- Web browsing: Certain complex web technologies, such as just-in-time JavaScript (JIT) compilation, are turned off unless the user excludes a trusted site from blocking mode.
- Apple Services: Incoming invitations and service requests, including FaceTime calls, are blocked if the user has not previously sent a call or request to the initiator.
- Wired connections to a computer or accessory are blocked when the iPhone is locked.
- Configuration profiles cannot be installed and the device cannot register with mobile device management (MDM) while the lock mode is activated.
Apple will continue to strengthen lock mode and add new protections over time. To invite feedback and collaboration from the security research community, Apple has also established a new category within the Apple Security Bounty program to reward researchers who find it circumvent lock mode and help improve their protections. Rewards are doubled for qualified finds in lock mode, up to a maximum of $ 2,000,000, the highest maximum reward payout in the industry.
Apple is also awarding a $ 10 million grant, in addition to any damages awarded by the lawsuit filed against NSO Group, to support organizations that investigate, discover, and prevent highly specific cyberattacks, including those created by private companies that develop state-sponsored mercenary spyware. The grant will go to the Fund for Dignity and Justice established and advised by the Ford Foundation, a private foundation dedicated to advancing equity around the world, and designed to pool philanthropic resources to advance social justice at the global level. world. The Dignity and Justice Fund is a fiscally sponsored project of the New Venture Fund, a 501 (c) (3) public charity.
“The global spyware trade is aimed at human rights defenders, journalists and dissidents; facilitates violence, reinforces authoritarianism, and supports political repression, “said Lori McGlinchey, director of its Ford Foundation Technology and Society program.” The Ford Foundation is proud to support this extraordinary initiative to strengthen civil society research and advocacy to resist mercenary spyware. We need to build on Apple’s commitment and invite companies and donors to join the Fund for Dignity and Justice and provide additional resources to this collective struggle. “
The Dignity and Justice Fund expects to make its first grants in late 2022 or early 2023, initially funding approaches to help expose mercenary spyware and protect potential targets that include:
- Build organizational capacity and increase field coordination of new and existing civil society research and advocacy groups in cybersecurity.
- Support the development of standardized forensic methods to detect and confirm spyware infiltration that meet evidence standards.
- Enable civil society to partner more effectively with device manufacturers, software developers, commercial security companies, and other relevant companies to identify and address vulnerabilities.
- Raising awareness among investors, journalists and policymakers about the global mercenary spyware industry.
- Develop the capacity of human rights defenders to identify and respond to spyware attacks, including security audits for organizations facing higher threats to their networks.
The Dignity and Justice Fund’s grant-making strategy to investigate, monitor and hold accountable the enhanced trade in cyber weapons will be advised by an independent global Technical Advisory Committee. Initial members include:
- Ron Deibert, Professor of Political Science and Director of the Citizen Lab at the Munk School of Global Affairs & Public Policy at the University of Toronto
- Ivan Krstić, head of security engineering and architecture at Apple
“There is now undeniable evidence from research by the Citizen Lab and other organizations that the mercenary surveillance industry is facilitating the spread of authoritarian practices and massive human rights abuses around the world,” said Ron Deibert, director of Citizen Lab, a research group at the University of Toronto. “I applaud Apple for establishing this important grant, which will send a strong message and help encourage independent investigators and advocacy organizations to hold mercenary spyware vendors accountable for the damage they are inflicting on innocent people.”
Click Contacts
Scott Radcliffe
apple
sradcliffe@apple.com
Apple Media Helpline
media.help@apple.com
(408) 974-2042