7 ms·

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think App

It does make iOS slightly more inconvenient, such as when adding each other on iMessage. And it severely reduces JavaScript performance in Safari. I think Apple wants to avoid making iOS feel slower or clunkier than Android. And zero-day spyware is usually targeted towards important individuals, not used for mass surveillance, so it indeed is a smaller risk to individual people. I'd prefer a third mode that compromises between the two, perhaps letting you lower your security for a few minutes when you need the extra functionality. For example, Safari could detect when JavaScript is being slow and pop up an offer to re-enable JIT.

webninja 3y ago
The only bothersome issue I see on lockdown mode is not being able to search through text messages anymore :’( Please bring that back (safely) if you can, Apple.
- bobbylarrybobby 3y ago
  Wait, seriously? Do you know what the rationale is?
joshspankit 3y ago
> Apple wants to avoid making iOS feel slower or clunkier than Android Then they should let us selectively disable all background processes
barryrandall 3y ago
I’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.
- jiofj 3y ago
  YES! Current lockdown mode proposition of all-or-nothing is inconvenient.
  - klausa 3y ago
    Why increase your security bug surface 2x when you can increase it exponentially!
  - bonestamp2 3y ago
    I assume that inconvenience is intentional -- otherwise everyone would enable it.
  - sneak 3y ago
    You can leave lockdown off, and disable iMessage.
    - runeks 3y ago
      I don't want to disable iMessage, just attachments from unknown contacts.
      - cj 3y ago
        Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box
        sneak 3y ago
        AFAIK all iMessage attachments (since iOS 14) are quarantined via BlastDoor, any such full system takeover must include at least two escapes: one from BlastDoor, and another from the application sandbox. They also need to cope with ASLR. It's pretty heavy duty even in the most basic default configuration. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html?m=1 https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... Upon re-reading this, it seems like crashes in BlastDoor are reported to Apple in real-time. I think this qualifies as "clientside scanning", tbh.
kbenson 3y ago
I think attackers would just try to make the system offer to disable security whenever possible then. Anything as easy as clicking an already offered option by the OS itself will be used often enough to negate most of the security benefits of that mode IMO, meaning you deal with it being slower be default and probably not as secure as you think because people will opt out often for convenience, so the worst of both worlds. As I understand it this was a real problem with earlier versions of Windows where it kept asking for admin privileges all the time for simple things, and people got conditioned to just authorize it. They made a concerted effort to provide APIs that didn't require it for most actions to combat this.
Obscurity4340 3y ago
I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.
- lloeki 3y ago
  > I would argue that iMessage is way to problematic to be used safely, at all. Maybe I'm missing something but every single time the only part of iMessage (actually Messages.app) that is insecure is the bit that automatically unfurls attachments and the payload is exploiting a vulnerability elsewhere. So any other app unfurling the attachment thus triggering the payload would be equally vulnerable. Imagine ping had a privilege escalation vulnerability and someone does ssh foomachine ping <payload> to get root, it'd be a bit weird to call out ssh as being unsafe because it can execute commands, one of them being able to privesc. Disabling ssh would be a mitigation, and I do wish Messages would disallow unfurling for senders not in the recipient's contact list.
  - TheDong 3y ago
    > So any other app unfurling the attachment thus triggering the payload would be equally vulnerable. What you're missing is that iPhone's app sandboxing applies to other apps, not to iMessage. Sure, imessage does have blastdoor and some sandboxing, but it also still has imagent: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... imagent runs as root and processes incoming messages. whatsapp or signal or whatever cannot ship an unsandboxed always on daemon like imagent. signal/whatsapp/etc have to parse incoming messages inside the app sandbox. iMessage doesn't. (I'm saying this all very confidently because the quickest way to get the right answer is to be confident about the wrong one and get corrected by a techbro)
    - lloeki 3y ago
      > imagent [...] processes incoming messages does it? IIUC (from a cursory look) according to the diagram it delegates all message processing to MessageBlastDoorService/IM{Transfer,Transcoder,Persistence}Agent, relying only on locally computed boolean-ish metadata replies from these services, and merely transparently forwarding actual data between those.
n8cpdx 3y ago
You can turn off lockdown mode per site and per-app in safari. I had to do that to get Obsidian to work, but I also use it for specific trusted sites.
- vladvasiliu 3y ago
  What do you mean "per-app in safari"? I'd like to turn it on globally, with a single exception: I want to be able to continue using shared photos albums with my two best friends. I don't care enough about JS performance or, more generally, the mobile web, to want to disable it on safari, or even parts of it.
  - n8cpdx 3y ago
    You can disable lockdown mode in web views for specific apps. You do it in settings because those apps don’t have the usual Safari UI for configuring that.
RetpolineDrama 3y ago
>And zero-day spyware is usually targeted towards important individuals, Yeah but have you ever had someone ImportantTM's old phone number? What about their IP?

webninja 3y ago

The only bothersome issue I see on lockdown mode is not being able to search through text messages anymore :’( Please bring that back (safely) if you can, Apple.

bobbylarrybobby 3y ago
Wait, seriously? Do you know what the rationale is?

joshspankit 3y ago

> Apple wants to avoid making iOS feel slower or clunkier than Android Then they should let us selectively disable all background processes

barryrandall 3y ago

I’d settle for being able to toggle the individual controls (specifically iMessage attachments) instead of full lockdown mode.

jiofj 3y ago
YES! Current lockdown mode proposition of all-or-nothing is inconvenient.
- klausa 3y ago
  Why increase your security bug surface 2x when you can increase it exponentially!
- bonestamp2 3y ago
  I assume that inconvenience is intentional -- otherwise everyone would enable it.
- sneak 3y ago
  You can leave lockdown off, and disable iMessage.
  - runeks 3y ago
    I don't want to disable iMessage, just attachments from unknown contacts.
    - cj 3y ago
      Another idea for Apple would simply be quarantining attachments from unknown contacts. E.g. display that an attachment exists but don't download it to the device until a user accepts a "attachment from unknown sender" warning box
      - sneak 3y ago
        AFAIK all iMessage attachments (since iOS 14) are quarantined via BlastDoor, any such full system takeover must include at least two escapes: one from BlastDoor, and another from the application sandbox. They also need to cope with ASLR. It's pretty heavy duty even in the most basic default configuration. https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html?m=1 https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... Upon re-reading this, it seems like crashes in BlastDoor are reported to Apple in real-time. I think this qualifies as "clientside scanning", tbh.

kbenson 3y ago

I think attackers would just try to make the system offer to disable security whenever possible then. Anything as easy as clicking an already offered option by the OS itself will be used often enough to negate most of the security benefits of that mode IMO, meaning you deal with it being slower be default and probably not as secure as you think because people will opt out often for convenience, so the worst of both worlds. As I understand it this was a real problem with earlier versions of Windows where it kept asking for admin privileges all the time for simple things, and people got conditioned to just authorize it. They made a concerted effort to provide APIs that didn't require it for most actions to combat this.

Obscurity4340 3y ago

I would argue that iMessage is way to problematic to be used safetly, at all. By anyone. Full-stop. It also seems to be the primary attack vector of NSO related zero-days as well and its become known that phone country/area codes have relevance to its chance of succes in past exploits, which suggests a phone/messaging type attack vector.

lloeki 3y ago
> I would argue that iMessage is way to problematic to be used safely, at all. Maybe I'm missing something but every single time the only part of iMessage (actually Messages.app) that is insecure is the bit that automatically unfurls attachments and the payload is exploiting a vulnerability elsewhere. So any other app unfurling the attachment thus triggering the payload would be equally vulnerable. Imagine ping had a privilege escalation vulnerability and someone does ssh foomachine ping <payload> to get root, it'd be a bit weird to call out ssh as being unsafe because it can execute commands, one of them being able to privesc. Disabling ssh would be a mitigation, and I do wish Messages would disallow unfurling for senders not in the recipient's contact list.
- TheDong 3y ago
  > So any other app unfurling the attachment thus triggering the payload would be equally vulnerable. What you're missing is that iPhone's app sandboxing applies to other apps, not to iMessage. Sure, imessage does have blastdoor and some sandboxing, but it also still has imagent: https://googleprojectzero.blogspot.com/2021/01/a-look-at-imessage-in-ios-14.html https://googleprojectzero.blogspot.com/2021/01/a-look-at-ime... imagent runs as root and processes incoming messages. whatsapp or signal or whatever cannot ship an unsandboxed always on daemon like imagent. signal/whatsapp/etc have to parse incoming messages inside the app sandbox. iMessage doesn't. (I'm saying this all very confidently because the quickest way to get the right answer is to be confident about the wrong one and get corrected by a techbro)
  - lloeki 3y ago
    > imagent [...] processes incoming messages does it? IIUC (from a cursory look) according to the diagram it delegates all message processing to MessageBlastDoorService/IM{Transfer,Transcoder,Persistence}Agent, relying only on locally computed boolean-ish metadata replies from these services, and merely transparently forwarding actual data between those.

n8cpdx 3y ago

You can turn off lockdown mode per site and per-app in safari. I had to do that to get Obsidian to work, but I also use it for specific trusted sites.

vladvasiliu 3y ago
What do you mean "per-app in safari"? I'd like to turn it on globally, with a single exception: I want to be able to continue using shared photos albums with my two best friends. I don't care enough about JS performance or, more generally, the mobile web, to want to disable it on safari, or even parts of it.
- n8cpdx 3y ago
  You can disable lockdown mode in web views for specific apps. You do it in settings because those apps don’t have the usual Safari UI for configuring that.

RetpolineDrama 3y ago

>And zero-day spyware is usually targeted towards important individuals, Yeah but have you ever had someone ImportantTM's old phone number? What about their IP?