Lock Mode is a new Apple feature that you hope you never have to use. But for those who do, such as journalists, politicians, lawyers and human rights defenders, it’s a last line of defense against nation-state spyware designed to break through an iPhone’s protections.
The new security feature was announced earlier this year as an “extreme” level of protection against spyware makers who were increasingly finding ways to hack into iPhones remotely without any user interaction. These so-called zero-click attacks are invisible and exploit weaknesses in basic iPhone functions such as calling, messaging and web browsing. Apple patches vulnerabilities as they are discovered, often by security researchers who find evidence of spyware on victims’ phones. But it’s an ongoing chase between Apple and spyware makers that has targeted thousands of journalists, activists and human rights defenders in recent years.
What is lock mode?
With Lockdown Mode, Apple gives users the option to temporarily disable some of the most abused device features with the push of a button (and restart the device) to make it much harder for spyware to penetrate and divert the your private phone. data Or, as Apple calls it, “drastically reducing the attack surface that could potentially be exploited by highly targeted mercenary spyware.”
TechCrunch tested Lock Mode with an iPhone running Apple’s public beta of iOS 16, which includes the new mode. Lockdown mode kicks in after a few disclaimers and a device reboot, and can be turned off again via the Settings menu.
While the mode does limit what you can do and who can contact you, which is the trade-off for having a much more secure iPhone, we didn’t find using our iPhone in Locked Mode to be as prohibitive or frustrating as we first thought the function was announced for the first time.
The idea is to shore up as many routes to your iPhone, iPad, or Mac from the Internet as possible without degrading the usability of the device too much. This means blocking contact from people you don’t know so that only people you know can call or message you. As the saying goes, your mileage may vary as your experience may vary based on your needs.
One of the first things you’ll notice is that Block Mode disables link previews in text messages, which have been shown to unmask a person’s anonymity by obtaining their IP address. The mode does not block the link, only the preview, so you can still copy and paste the web address into your browser. This adds a moment of inconvenience to the user, but makes it much more difficult for attackers to penetrate where they were previously successful.
Link previews are blocked when block mode is on. Image credits: TechCrunch.
Lockdown mode also changes how the Safari browser works, disabling certain features that can affect some websites or break others entirely. You will see some web pages that rely on more complex web technologies in your browser, such as web-based fonts and just-in-time compilers that help websites load faster, may not display correctly or that they are not loaded at all.
Disabling just-in-time (or JIT) compilers will slow down some websites, but will prevent malicious JavaScript from running that can escape your browser’s protective sandbox and access other parts of your device’s data. Some websites load custom font files from the Internet to make them look the way they’re supposed to, but fonts can also be bundled with malware that can remotely execute malicious code on your device.
Safari says “Block Mode” when the feature is on. You can see that TechCrunch loads pretty well, and that the browser relies on built-in fonts if it can’t download them from the Internet, slightly changing the appearance of the page. You can still set certain sites as “trusted” in block mode, which allows you to bypass restrictions on sites you know are safe.
Before and after
When features are no longer available, such as shared photos, which seem to mysteriously disappear from the phone when in lock mode, the device generally does a good job of alerting the user when the feature is proactively launched.
You’ll see that when Lock Mode is in effect, you won’t be able to receive FaceTime calls from contacts you’ve never spoken to before. It is designed to protect against zero-click attacks that exploit weaknesses in FaceTime and iMessage, which are known to be used by spyware makers such as NSO Group and Candiru. You should also not open attachments such as documents or files because they might contain malicious code that could compromise your device. You won’t receive Apple service invitations, such as calendars and notes, from people you haven’t communicated with before while Locked Mode is on, and you can’t install new configuration profiles to join new networks work or school, as they can be misused. bad actors to remotely control a person’s device.
Most blocked or limited features make it harder for attackers or spyware makers to remotely hack an iPhone over the Internet or cellular network, but it also blocks wired connections to your device, preventing anyone from having physical access to your phone or computer. of being able to download its content, using phone cracking technology.
Lockdown mode may be a tacit admission that Apple can’t protect against every spyware maker or malware threat, just as no company can. But it’s a sign of addressing the matter head-on, rather than denying it exists. Lockdown mode is coming to iOS 16 and macOS Ventura later this year.