3 ms·

Does this offer any protection after you are already pwned? Is the expectation that you have it permanently on if you are a high value target or do you turn it

Does this offer any protection after you are already pwned? Is the expectation that you have it permanently on if you are a high value target or do you turn it on temporarily before clicking on a link for example?

dustyharddrive 4y ago
Don’t know enough about iOS to say for sure about persistence, but recent Pegasus (NSO Group spyware) versions don’t bother[1], instead repeatedly exploiting bugs starting with “features” like background Messages attachment parsing. Those are the kind of threats Lockdown Mode finally acknowledges — targets (well IMO everyone) would need it permanently enabled. Otherwise the temporary protection before clicking a link can be had today in other ways, like disabling Settings > Safari > Advanced > JavaScript. [1] Lack of persistence likely an attempt at making it harder to analyze: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...
olyjohn 4y ago
If you're going to run a crippled-ass phone to protect yourself, because the regular phone is so fucking insecure, why even bother with a smartphone? They'll just find an exploit in something that the "security mode" hasn't disabled.
olliej 4y ago
If you have already been pwned, the OS is compromised so it clearly is not able to retroactively undo that - any checkbox, option or whatever can just be turned into a no op that lies.
Nextgrid 4y ago
If you're already pwned to the point where they have kernel-level access and can bypass code signature enforcement, all bets are off. Even if lockdown mode interfered with their activity, at this point nothing prevents them from modifying the Settings app to not really enable lockdown mode even if you request it to.

3 ms·

Does this offer any protection after you are already pwned? Is the expectation that you have it permanently on if you are a high value target or do you turn it

by drexlspivey 4y ago

dustyharddrive 4y ago
Don’t know enough about iOS to say for sure about persistence, but recent Pegasus (NSO Group spyware) versions don’t bother[1], instead repeatedly exploiting bugs starting with “features” like background Messages attachment parsing. Those are the kind of threats Lockdown Mode finally acknowledges — targets (well IMO everyone) would need it permanently enabled. Otherwise the temporary protection before clicking a link can be had today in other ways, like disabling Settings > Safari > Advanced > JavaScript. [1] Lack of persistence likely an attempt at making it harder to analyze: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ https://www.amnesty.org/en/latest/research/2021/07/forensic-...
olyjohn 4y ago
If you're going to run a crippled-ass phone to protect yourself, because the regular phone is so fucking insecure, why even bother with a smartphone? They'll just find an exploit in something that the "security mode" hasn't disabled.
olliej 4y ago
If you have already been pwned, the OS is compromised so it clearly is not able to retroactively undo that - any checkbox, option or whatever can just be turned into a no op that lies.
Nextgrid 4y ago
If you're already pwned to the point where they have kernel-level access and can bypass code signature enforcement, all bets are off. Even if lockdown mode interfered with their activity, at this point nothing prevents them from modifying the Settings app to not really enable lockdown mode even if you request it to.