Hacker News Reader

Comment by deepfriedrice | Hacker News Reader

The article references Lockdown mode [0] which appears to be Apple's solution for this (and other) class of zero days.

[0] https://support.apple.com/en-ca/HT212650

Lockdown mode means you're able to use less stuff. In this case the "pass" feature doesn't exist in Lockdown mode and that's the attack target AIUI. So, if most people don't use it (because less stuff works) then it can be "successful" statistically because maybe the attackers aren't targeting the stuff you're allowed to use and you don't get exploited.

But this isn't a stable solution really. If Lockdown is popularized, NSO obviously will attack the things which are available in Lockdown. Apple shows no sign of only allowing it in Lockdown once it's actually safe - instead they've just arbitrarily decided what to allow and what not to allow.

Lockdown mode massively reduces the attack surface, which would make it far harder to find an exploit.

Not entirely true because NSO (or their clients) have very specific target requeriments. If they want to target another Jamal Khashoggi and lockdown mode is used, they have their incentive to buy and create the demand for any 0day that they can then re-sell to their lovelly clients. No need statistics for this, the incentive is purely greed.

The downsides of using Lockdown Mode are minimal and well worth if you are an at-risk target. It's about reducing the attack surface and potentially getting notified if nation state actors try to attack your phone.

The list is not arbitrary, but generally based on remote attack surface.

Of all the apps that I ran, only one banking app has failed in Lockdown mode. Everything else works just fine.

Reply on news.ycombinator.com