Apple confirms no successful spyware breaches on devices with Lockdown Mode enabled

A multi-year security review suggests Lockdown Mode has prevented successful commercial spyware intrusions on protected Apple devices. The result raises fresh debate on targeting and defense.

According to Techcrunch

Nearly four years after Apple launched Lockdown Mode, the company says that with the protection enabled there have been no reported cases of a user’s device being hacked with spyware.

“We have seen no successful attacks by mercenary spyware against Apple devices with Lockdown Mode enabled.”

Such a conclusion reinforces the idea that Apple devices with the protection activated can withstand government surveillance campaigns, including those by Intellexa, NSO Group, and Paragon Solutions.

Lockdown Mode was introduced in 2022 as a protective option that disables a range of iPhone and other Apple device features, specifically to reduce risks associated with the use of spyware. The mode is designed to help at-risk groups protect themselves from government spying threats.

In recent years, Apple has acknowledged the possibility of targeted spyware against its users and actively informs customers who may be at risk.

The company has sent hundreds of thousands of notices to users in more than 150 countries, warning potential spying, signaling greater transparency in its approach to security.

“My colleagues and I have seen no evidence that an iPhone was successfully hacked using mercenary spyware when Lockdown Mode was enabled during an attack.”

– Donncha Ó Cearbhaill

Digital rights organizations, such as Amnesty International and Citizen Lab (University of Toronto), have documented several attacks on iPhone, but none of them mentioned bypassing Lockdown Mode. In at least two cases, Citizen Lab publicly noted that Lockdown Mode actively blocks spyware attacks: one from NSO’s Pegasus, the other – Predator from the company that is now part of Intellexa.

“In at least one documented iPhone spyware attack, Google researchers reported that the spyware would stop trying to infect if Lockdown Mode is detected.”

Patrick Wardle, an Apple cybersecurity expert, notes that Lockdown Mode plays a vital role in hindering the development of spyware for attacks on Apple users.

“In my view, Lockdown Mode is one of the most aggressive protection features ever offered to consumers.”

Lorenzo Franceschi-Bicchierai, senior TechCrunch journalist, also emphasizes the importance of this option and its role in reducing the risks of targeted spying.

“I think it’s fair to say: Lockdown Mode is one of the most aggressive protection features ever released, aimed at consumers.”

– Lorenzo Franceschi-Bicchierai

If you have additional information spyware attacks or their developers, you can reach Lorenzo Franceschi-Bicchierai via Signal at +1 917 257 1382, via Telegram, Keybase, and Wire at @lorenzofb, or via email.