Apple explains: Lockdown mode has never been overcome

This article may contain affiliate links. Learn more on our Partner Program page.

Make Apfelpatient a preferred source One click – and you'll see us more often on Google

Security vulnerabilities and targeted cyberattacks on smartphones are no longer an exception. Apple devices, in particular, are regularly targeted by sophisticated spyware. With Lockdown Mode, Apple introduced a feature in 2022 specifically designed for extreme threat scenarios. New findings and studies show that this measure has proven exceptionally effective so far.

In recent years, numerous cases have been documented in which iPhones were successfully infected with surveillance software. Organizations such as Amnesty International and the Citizen Lab at the University of Toronto have repeatedly analyzed and publicized such attacks.

Against this backdrop, Apple developed Lockdown Mode in response to targeted attacks by state or state-sponsored actors. The feature is explicitly aimed at individuals at increased risk, including journalists, activists, and lawyers.

What exactly the Lockdown Mode does

Lockdown mode is an optional security feature available on iPhone, iPad, and Mac that must be manually activated. Once activated, numerous system functions are severely restricted to minimize potential attack surfaces.

Specific measures include:

Blocking most message attachments
Disabling certain complex web technologies
Preventing automatic connections to unsafe Wi-Fi networks

These restrictions are deliberately radical, as precisely such functions are frequently exploited by spyware.

No successful spyware attacks are known

Apple states that there are currently no known cases of a device with Lockdown Mode enabled being successfully compromised. A company spokesperson confirmed to TechCrunch that there is no evidence of successful spyware attacks under these conditions.

External experts have reached similar conclusions. Donncha Ó Cearbhaill, head of the security laboratory at Amnesty International, stated that no successful infections were observed when lockdown measures were in place at the time of an attack.

Findings from independent security researchers

Digital rights and security research organizations have documented many successful attacks on iPhones in the past. However, in none of these cases was the lockdown mode bypassed.

Researchers at Citizen Lab were able to confirm at least two specific situations in which the feature actively prevented attacks. These involved known spyware such as:

Pegasus, developed by the NSO Group
Predator, later part of a corporate group centered around Intellexa

Additionally, Google researchers discovered that certain spyware is programmed to abort an attack as soon as lockdown mode is detected. The underlying reason is presumably to avoid leaving any traces that could lead to detection.

Classification of the security level

The lockdown mode is considered by experts to be a particularly stringent protective measure. Patrick Wardle, a cybersecurity expert at Apple, described it as one of the most aggressive security features ever developed for end users.

This assessment makes it clear that Apple is deliberately pursuing a different approach here: Instead of prioritizing comfort and functionality, the focus is on maximum security.

Lockdown Mode: Maximum security for iPhone, iPad and Mac

Lockdown Mode: A turning point for smartphone security

Apple's lockdown mode demonstrates how far mobile security has come. The combination of strict restrictions and targeted protection against sophisticated spyware clearly distinguishes this feature from traditional security measures.

The fact that no successful attack has been reported so far speaks to the effectiveness of the concept. At the same time, the existence of this feature clearly demonstrates how real and serious modern threat scenarios in the digital realm have become. (Image: Apple)