iOS Internals · Staying Safe on iPhone · Lesson 4 of 5

Spyware & Lockdown Mode

Learn how mercenary spyware works, who it targets and how Lockdown Mode helps.

Spyware for hire

Mercenary spyware is surveillance software built by private companies and sold, usually to governments, for spying on particular people. The best-documented example is Pegasus, made by NSO Group. Once it's on a phone, it can reach messages, photos, location and more.

The scariest versions use a zero-click exploit, an attack that needs no tap or reply from the victim. In September 2021, Citizen Lab, a research group at the University of Toronto, found one called FORCEDENTRY on the iPhone of a Saudi activist. It arrived through iMessage as a booby-trapped file. Apple fixed the flaw in iOS 14.8. Earlier that year, Amnesty International's Security Lab found signs of Pegasus on an Indian journalist's iPhone 12 that was fully up to date on iOS 14.6. Amnesty also released a free tool, the Mobile Verification Toolkit, that experts use to look for traces of infection.

If attacks like this exist, why isn't everyone infected? Apple says these attacks cost millions of dollars and often have a short shelf life, because once a flaw is discovered it gets patched. So they're aimed at a very small number of people, often journalists, activists, politicians and diplomats. Most people will never be targeted.

When Apple's own investigations detect this kind of attack, it sends an Apple threat notification. It has done so several times a year since 2021, to people in over 150 countries. The alert appears on the iPhone's Lock Screen and in Settings. Apple also emails the addresses on the Apple Account, from threat-notifications@email.apple.com, and shows a banner at the top of account.apple.com after you sign in.

Scammers copy these alerts, so remember what a real one never does. It never asks you to click links, open files, install apps or profiles, or give your password or verification code. Apple suggests anyone who gets a real one seek expert help, such as the free, round-the-clock Digital Security Helpline run by the nonprofit Access Now.

Lockdown Mode, updates and restarts

For people who might really be targeted, Apple built Lockdown Mode, added in iOS 16. It's an optional, extreme protection. The idea is to shrink the attack surface, the set of features an attacker could try to exploit, by switching off things that are complicated or rarely needed. Apple is clear that your iPhone won't work the way it usually does.

With Lockdown Mode on:

• In Messages, most attachment types other than certain images, video and audio are blocked, and links and link previews don't work.
• Some complex web technologies are blocked, so some websites load slowly or break.
• FaceTime calls are blocked unless you've called that person in the past 30 days, and shared albums are removed from Photos.
• The iPhone must be unlocked to connect to an accessory or computer, it won't automatically join non-secure Wi-Fi, and 2G and 3G are turned off.
• Configuration profiles can't be installed, and the iPhone can't be enrolled in MDM.

Phone calls, plain text messages and emergency SOS calls still work. You turn it on in Settings, Privacy & Security, Lockdown Mode, and the iPhone restarts. An iPad or Mac needs it turned on separately. You can exclude a trusted app or website, but Apple warns this weakens the protection.

It has a track record. In 2023, Citizen Lab found a zero-click Pegasus attack called BLASTPASS that worked on iOS 16.6, delivered through iMessage. Citizen Lab and Apple believed Lockdown Mode blocked it.

Two habits help everyone. First, install iOS updates quickly, since both FORCEDENTRY and BLASTPASS were fixed by updates. Second, restart now and then. Amnesty reported in 2021 that newer Pegasus versions no longer stayed on iPhones after a restart, so attackers had to break in again. The US National Security Agency suggests turning your phone off and on weekly, while noting this only sometimes helps.