Today, we hacked what we'd set out to hack: the iPhone

jeroenhd 1 day ago

Very cool demos, but now I'm interested to know: does enabling Lockdown mode help at all against these exploits? It'll theoretically protect against a lot of common attack vectors, but I'm curious about its real-life effectiveness.

sumam 1 day ago
yes for PDFs in iMessage where would be blocked, not sure in Signal though. No idea for 3rd one.
- paxy 1 day ago
  It only blocks auto loading. Clicking on the PDF will have the same effect.
sigmoid10 1 day ago
These are still 1-click, not zero click. So the best protection you can have is not opening unknown files that were sent to you. That being said, lockdown mode blocks all sorts of message attachments. From the videos it look like they are using pdfs in the messaging vector, which would get blocked too. So you would be safe-ish. But lockdown mode is so restrictive that it doesn't really make sense for most users. Or at least it doesn't make sense to buy a $1500 phone and then limit yourself to something you could have gotten for $50.
- so-gala-massey 1 day ago
  You don’t know what lockdown is do you? I’ve had my phone in lockdown for a year. I can’t: collaborate on notes, and it does not automatically open links in chat. Other than that my experience is identical to non lockdown.
  - sigmoid10 1 day ago
    I guess you don't browse any modern webpages? Otherwise I can't explain your perspective. You basically lose up to 95% of performance in anything remotely resembling a JS heavy web app. So it would run the same as on a cheap Android phone.
    Gigachad 1 day ago
    My experience has been the iPhone chip is fast enough to still run pages just fine. Maybe those ones that load 300 adverts and relay out the page 5 times as they load won’t work but they hardly worked before anyway.
    sigmoid10 19 hours ago
    Everything that runs with such a major performance decrease will also run fine on a cheap phone. If this is your normal use case that's fine, but it simply means you also didn't need such a powerful Iphone in the first place. It's like buying an RTX5090 and then playing 2048 in a browser and saying you don't understand why people always install Nvidia drivers.
    giancarlostoro 18 hours ago
    > It's like buying an RTX5090 and then playing 2048 in a browser and saying you don't understand why people always install Nvidia drivers.
    Whoah don’t get personal now. I just prefer open source.
    red369 3 hours ago
    Doesn't disabling lockdown mode for specific websites solve this though? Or do you think this partially defeats the purpose for enabling it in the first place?
    throawayonthe 13 hours ago
    i run Vanadium on GraheneOS with javascript JIT off (the default configuration) and it's fine basically everywhere
    so-gala-massey 1 day ago
    Send me a webpage that you can’t view in lockdown. I haven’t had a single problem. I guess I’m just not really relevant in your eyes.
    troyjfarrell 16 hours ago
    Turkish Airlines site does not load in Lockdown mode. Users cannot log in at rei.com with Lockdown mode on.
    sigmoid10 19 hours ago
    Breaking is not the issue (at least most of the time), but the performance loss is everywhere.
    ShinyLeftPad 1 day ago
    it's very rare that they break but there's some popular ones like booking.com
    in my experience like maybe <5% of the web break
  - shepherdjerred 1 day ago
    You lose a lot: https://support.apple.com/en-us/105120
    dilyevsky 1 day ago
    some sites don't work (you can explicitly whitelist them tho) but generally it's been fine. i would honestly prefer a phone that doesn't allow any comms to any non-contact list parties at this point.
    throwaway219450 1 day ago
    From what I can see in Apple docs, aside from web limitations it sounds great. Is there any real reason to not enable this? Like I would be deeply suspicious of a PDF sent via messages and no auto-connect to insecure WiFi is also common sense.
    dilyevsky 1 day ago
    been using it for years, haven't found a compelling reason not to yet
    Barbing 1 day ago
    The iPhone is so expensive, definitely want shared photo albums to be part of the ecosystem experience.
    I’ll admit I thought you lost out on more by enabling.
    Den_VR 13 hours ago
    If only they would let people turn things on and off when they want to
    prmoustache 1 day ago
    Doesn't seem like a lot according to the description and pretty much what I would set by default.
    dataflow 1 day ago
    > Web browsing: Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon.
    Images being replaced with a missing image icon doesn't seem like a lot according to the description, and it's what you would set by default?
    Gigachad 1 day ago
    “Might be” seems to carry a lot of weight. I’ve been running lockdown mode and I haven’t seen any images not load. Presumably it’s only images of a certain obscure kind.
    josh2600 1 day ago
    Yeah what I want is a configurable version of lockdown mode where I can have my agent sync my allowlist with my hardware.
    Like give me the list of what I can turn on and off, and then let me choose my lockdown sphere.
    That’s the future, and it’s coming.
    iririririr 1 day ago
    your future, ironically, is android 2.3, before google went full monopoly evil
  - HelloUsername 1 day ago
    > had my phone in lockdown for a year. I can’t: collaborate on notes
    That's your own mistake, because you can collaborate on Notes while your iPhone is in Lockdown
  - SomeUserName432 23 hours ago
    My only gripe with lockdown mode is that my banking app loads icons from some source that ends up being blocked.
    Quite annoying. I've tried to explain it to them, but to no avail.
  - gfto 23 hours ago
    I would still be using lockdown mode if the call notifications were send to my Apple Watch. Other than that lockdown mode was working pretty good for me.
    red369 3 hours ago
    Hmm - I'm sure I've had that working. I have also had problems with notifications on my Apple Watch, and I'm not sure what I did to solve that, and I've also turned Lockdown mode on and off at various times, so I'm not sure.
    Still - maybe take another look? I think it should work. I'll turn lockdown mode on again and test. I can't remember why I turned it off anyway.
  - m463 23 hours ago
    It works great for me too.
    But there are weirdnesses.
    For example, you can't add a person to phone favorites.
    red369 3 hours ago
    Wait - it looks like this is right! I was thinking that of course you could, but it doesn't seem like the option exists once Lockdown mode is turned on. Do you know why? I don't remember reading that in the list of effects.
    It seems as though it doesn't affect existing favourites in any way...
    m463 1 hour ago
    I believe folks in the favorites list have privileges to contact you, so this must prevent random people from doing that.
    To add to favorites, turn off lockdown mode, favorite someone, then turn it back on.
    diavolodeejay 22 hours ago
    Does the favorites added before enabling lockdown mode remain or they get removed as well?
    m463 1 hour ago
    Favorites exist, but lockdown just means you can't add/delete favorites.
    To change the list just turn off lockdown, add/remove people, then turn it back on.
  - lelandfe 1 day ago
    I can send my friends a PDF of a restaurant's menu over iMessage. I think that wouldn't work for you?
- Panino 1 day ago
  I use Lockdown Mode and the functionality I get is nothing like a $50 device. If you're being serious can you link to some $50 devices for sale that are on par with a recent iPhone Pro running in Lockdown Mode?
- rogerkirkness 16 hours ago
  N=1 from my own experience but other than occasionally disabling it in Safari for websites it seems to work flawlessly for me. I've had it on MacOS and iOS for about a year now.