In early July of 2022, Apple announced a new feature coming to iOS 16 called
Lockdown Mode. While it’s marketed as an extreme feature meant to protect users who are at high
risk of government-sponsored spyware - think people like journalists, activists,
politicians, and so on - what I want to know is exactly what this lockdown mode actually does,
if there would be any benefit or even drawbacks for people like us to use
it and finally, what does this tell us about the kind of attacks we need to be worried about?
Here’s what we know so far.
Welcome to All Things Secured, a channel dedicated to helping you
secure your digital life and build better privacy online. My name’s Josh and since
I’ve personally been targeted and monitored during my time in a sensitive part of China,
I was naturally curious and excited about this announcement from Apple.
Now keep in mind, this Lockdown Mode isn’t available until the Fall, so this isn’t available
yet on your phone - this is just an explanation of what it is and my first impressions.
You see, Lockdown Mode is meant to harden your devices against sophisticated attacks by
limiting certain functions on your device and completely disabling other kinds of connections.
What does this mean? Well, for example, if my iPhone, iPad or MacBook is in Lockdown Mode,
I won’t be able to receive anything other than text and images in the messages app.
Any link previews, PDFs, or other kinds of files, which
might even include movie files - that’s not entirely clear - are going to be blocked.
I don’t know about you, but that doesn’t sound half bad. I don’t want people messaging me
and sending me files, to be honest, and the only place I can see some potential
problems would be if they block video files, which my wife and I send often among family.
In addition to this limitation on messages, Apple will also block
certain web technologies as you browse the internet, things like some types of JavaScript.
Again, there’s not much detail yet about which technologies are being blocked and
what kind of effect that would have on user experience.
A lot of what this kind of blocking feature protects you and I from would be
things that we normally wouldn’t see or even know exist. Things like a document
preview that downloads malicious code or even a website that loads a malicious font. In the end,
some of the webpages we visit might not load correctly with Lockdown Mode on,
but Apple does note that I can whitelist certain websites, meaning that those website I trust I can
tell Apple to not block these web technologies, which should make this another no-brainer feature.
My only question at this point is how this might affect users who don’t use Apple’s native Safari
browser. So if I’m using Firefox, for instance, this protection is supposed to still exist,
but perhaps the user experience would be even worse? I don’t know yet.
Moving beyond just messages and internet browsing,
Apple says that Lockdown mode will block incoming invitations and service requests unless I,
as the user, have called or sent that particular user a request already.
Apple references FaceTime calls as an example here, where a complete stranger couldn’t call me
on Facetime unless I had already called their number first, as well as shared
photo albums in the Apple’s Photos app, but I’m not sure what else this will include. Incoming
phone calls? Airdrop? I’m not sure, and again, this is something we won’t really know until the
beta version is released. But the truth is that I’m all for blocking any kind of incoming request
from a user that I haven’t approved first. There are times I get a call from a delivery
driver that would probably get blocked in this mode, but I can live with that.
Ok, here’s a fun fact for you. Did you know that if somebody plugs directly into your phone,
it’s possible for them to have full access to your device? I know this because when I was living in
China, the police would setup checkpoints where they would randomly pull people aside, have them
unlock their phones and then plug them into a mysterious device. You’d wait for a few seconds
until they gave you the all clear and then you’d be on your way. I reached out to Apple at the
time to see what data the police would have access to when plugging in, and their response was that
as long as the device had been unlocked with the correct passcode, all data was available.
I know China isn’t the only country to have figured this out, so it’s interesting to see that
in this Lockdown Mode, all other wired connections are blocked.
Basically, the lightning or USB-C port on your device will be good for nothing more
than charging and even then you may have to unlock it before it starts to charge.
Finally, Apple’s new Lockdown mode prohibits the use of mobile device management profiles,
which is something often used by businesses to control all the company devices.
The end result here - and keep in mind that I haven’t had the chance to test all this
out on a real device yet - but the end result is that the limitations
imposed by Lockdown Mode are something that I wouldn’t mind having myself.
In other words, unless it somehow stops a lot of my other apps that I use on a daily basis from
working, everything they’re promoting about this new security mode is something I think
most people should use, not just the small minority who are at higher risk of being attacked.
Apple calls it groundbreaking, but from what I see so far,
it looks more like a “what took you so long” kind of feature set.
That’s my two cents at least. What’s your take? Anything I’m missing here? Leave
a comment below and make sure you’re subscribed so you can watch my follow
up video once I’m able to beta test iOS 16 later this summer.