Apple says no one using Lockdown Mode has been hacked with spyware

Nearly four years since the introduction of Lockdown Mode, Apple has reported no incidents of devices being compromised while this security feature is active. Sarah O’Rourke, a spokesperson for Apple, affirmed to TechCrunch that they have not encountered any successful spyware attacks against devices protected by Lockdown Mode. This statement reinforces the company's long-standing claim regarding the effectiveness of this feature against government-sponsored spyware attacks. Launched in 2022, Lockdown Mode offers an opt-in series of security measures designed to disable certain functionalities in Apple devices that are frequently targeted by spyware. This mode was specifically created to safeguard high-risk users from threats posed by government-affiliated spyware manufacturers, including well-known entities like Intellexa, NSO Group, and Paragon Solutions. In recent years, Apple has acknowledged the reality of spyware threats and has taken steps to inform users who might be affected. The tech giant has issued multiple notifications to customers across more than 150 countries, signaling their increased awareness of these types of cyber threats. While Apple does not disclose the number of users notified, estimates suggest that the figure could be in the dozens or more. Donncha Ó Cearbhaill, head of the security lab at Amnesty International, reported that there is no evidence of iPhones being compromised while Lockdown Mode was enabled. Research from digital rights organizations, including Amnesty International and the University of Toronto’s Citizen Lab, has confirmed multiple instances of spyware attacks on iPhone users, yet none have indicated a bypass of Lockdown Mode. Citizen Lab researchers have previously noted that Lockdown Mode successfully thwarted spyware attempts, including those utilizing NSO’s Pegasus and Predator spyware, the latter produced by a company now integrated with Intellexa. Google security researchers have also observed that certain spyware attempts would abort if they detected Lockdown Mode, indicating a strategic evasion of detection. Patrick Wardle, a cybersecurity expert specializing in Apple products, emphasized the importance of Lockdown Mode in complicating the efforts of spyware developers. He stated, "Lockdown Mode is one of the most aggressive consumer-facing hardening features ever shipped," highlighting its effectiveness in narrowing the attack surface available to cybercriminals. Wardle elaborated that Lockdown Mode significantly reduces the number of exploitation techniques available, forcing spyware developers to resort to more complex, costly methods. By blocking various message attachment types and restricting WebKit features, it effectively diminishes the potential for remote attacks, particularly those that do not require user interaction. While there remains a possibility that Lockdown Mode could be bypassed without detection, Apple’s latest claims represent a significant endorsement of the feature's efficacy. Users concerned about spyware or digital threats are encouraged to activate Lockdown Mode, despite some inconveniences it may present, such as requiring additional steps for certain actions like copying links from messages to a browser.