Security Expert: Apple's Lockdown Mode Still Defeats Commercial Spyware

pcmag.com:

There aren’t many easy jobs in information security, but protecting people against nation-state attackers is the hardest of them all. And yet security researcher Runa Sandvik did not sound hopeless during a talk at a conference about the threat of intelligence agencies targeting commercial spyware at reporters, activists, and opposition politicians.

One reason: The Lockdown Mode that Apple shipped with iOS 16 still seems to block the worst sorts of commercial spyware. 

“I am not aware of any compromise of a device using Lockdown Mode today,” Sandvik said in the keynote that opened Mitre Corp.’s ATT&CKcon conference in Virginia. “It is the best defense that we have today for Pegasus and Predator.”

Pegasus is the name of the notorious Android and iOS spyware developed by NSO Group, an Israeli firm that has drawn widespread scorn for selling this tool to such oppressive regimes as Saudi Arabia; Predator, a spyware tool with similar capabilities, is the work of Cytrox, a firm with operations in Israel and Hungary. 

(Reports have revealed that US government agencies such as the Drug Enforcement Administration and the FBI had considered and then rejected using Pegasus as late as 2021. The government has more recently put NSO, Cytrox, and other commercial spyware developers on export blocklists, and in March a Biden administration executive order banned most government use of these tools.)  

Both Pegasus and Predator have been able to infect targeted phones without any action by the user, what’s called a “zero-click” attack. Sandvik—founder of the security consultancy Granitt with experience that includes helping develop the Tor anonymity network and hacking a “smart” rifle—outlined some especially creepy cases.

In one, New