8 ms·

How much do you think Lockdown Mode + MIE/eMTE helps? Do you believe state actors work with manufacturers to find/introduce new attack vectors?

walterbell 7mo ago
My iOS devices have been repeatedly breached over the last few years, even with Lockdown mode and restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator. Since moving to 2025 iPad Pro with MIE/eMTE and Apple (not Broadcom & Qualcomm) radio basebands, it has been relatively peaceful. Until the last couple of weeks, maybe due to leakage of this zero day and PoC as iOS 26.3 was being tested.
- whitepoplar 7mo ago
  Are you a person of high interest? I was under the impression that these sorts of breaches only happen to journalists, state officials, etc.
  - walterbell 7mo ago
    Who knows? Does HN count as journalism :) I would happily pay Apple an annual subscription fee to run iOS N-1 with backported security fixes from iOS N, along with the ability to restore local data backups to supervised devices (which currently requires at least 2 devices, one for golden image capture and one for restore, i.e. "enterprise" use case). I accept that Apple devices will be compromised (keep valuable data elsewhere), but I want fast detection and restore for availability. GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. USB with custom Debian Live ISO booted into RAM is useful for generic terminal or web browsing.
    - Melatonic 7mo ago
      First idea if great honestly - lots of vendors do this. I use Firefox long term stable and Chrome offers this for enterprise customers. Windows even offers multiple options of this (LTSC being the best by far). Would also make a great corporate / government product - I doubt they care about charging the average consumer for such a subscription (not enough revenue) but I can see risk averse businesses and especially government sectors being interested.
    - MichaelZuo 7mo ago
      You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line.
      - walterbell 7mo ago
        You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line What's the name of the feature for Apple Enterprise customers that would allow iOS 18 to be installed on a newly provisioned device today? Downgrades are not supported by Apple Business Manager MDM and there's no reference to downgrades on the Enterprise page, https://www.apple.com/business/enterprise/ https://www.apple.com/business/enterprise/
        MichaelZuo 7mo ago
        By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. Because you will be paying the full unsubsidized rate for any support needed for features not available to the mass market. Its like how IBM will gladly send a team of senior engineers to help enterprise clients resolve every last possible request. Edit: As compared to mass market features, where the economics dont work unless they’re close to 100% certain most users wont require any costly support.
        walterbell 7mo ago
        Would the following be possible, in principle? - Signup for Apple Enterprise account with direct billing - Buy one hardware device direct via Enterprise account - Buy one MDM license for the hardware device - Sign contract for support at $500/hr, no minimum commitment - Get access to docs & tools for iOS 18 on new hardware (don't need support) Apple Enterprise Developer account requires 100 employees minimum, but Apple Enterprise does not.
        walterbell 7mo ago
        > By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. If you're an Apple Enterprise customer, can you install iOS 18 on a new device today? It appears that enterprises can delay upgrade to iOS 18 post-enrollment, but cannot roll back to or provision iOS 18 on new hardware.
    - throawayonthe 7mo ago
      could you please elaborate on how you determine that your devices have been breached? e.g. referring to "anomaly free" makes it sound like you might witnessing non-security related unexpected behaviour? sorry for the doubt, i'm curious
      - walterbell 7mo ago
        Explained at length below: after subjective indicator of possible breach, by monitoring, allowlisting and then deleting outbound network traffic sources (i.e. apps) on the device, then look closely at any remaining, non-allowlisted traffic, which should be zero. apps: https://news.ycombinator.com/item?id=46993016 https://news.ycombinator.com/item?id=46993016 | https://news.ycombinator.com/item?id=46997970 https://news.ycombinator.com/item?id=46997970 Apple: https://news.ycombinator.com/item?id=46994394 https://news.ycombinator.com/item?id=46994394
- drakenot 7mo ago
  How can you tell that you were breached?
  - walterbell 7mo ago
    Presence of one or more: unexpected outbound traffic observed via Ethernet, increased battery consumption, interactive response glitching, display anomalies ... and their absence after hard reset key sequence to evict non-persistent malware. Then log review.
    - avazhi 7mo ago
      [flagged]
    - nickburns 7mo ago
      To where?
      - walterbell 7mo ago
        Usually a generic cloud provider, not unique, identifying or stable.
        Someone1234 7mo ago
        So how did you identify this as a breach? I'm struggling to find this credible, and you've yet to provide specifics. Right now it comes across as "just enough knowledge to be dangerous"-levels, meaning: you've seen things, don't understand those things, and draw an unfounded conclusion. Feel free to provide specifics, like log entry lines, that show this breach.
        walterbell 7mo ago
        Please feel free to ignore this sub-thread. I'm merely happy that Apple finally shipped an iPad that would last (for me! no claims about anyone else!) more than a few weeks without falling over. To learn iOS forensics, try Corellium iPhone emulated VMs that are available to security researchers, the open-source QEMU emulation of iPhone 11 [1] where iOS behavior can be observed directly, paid training [2] on iOS forensics, or enter keywords from that course outline into web search/LLM for a crash course. [1] https://news.ycombinator.com/item?id=44258670 https://news.ycombinator.com/item?id=44258670 [2] https://ringzer0.training/countermeasure25-apple-ios-forensics/ https://ringzer0.training/countermeasure25-apple-ios-forensi...
- j45 7mo ago
  It appears the iPhone Air and iPhone 16e are the only devices with the Apple radio basebands so far. https://theapplewiki.com/wiki/C4000 https://theapplewiki.com/wiki/C4000
  - walterbell 7mo ago
    + iPad Pro.
  - whitepoplar 7mo ago
    16e still uses a Broadcom chip for WiFi + Bluetooth, though. iPhone Air is currently the only iPhone that uses both Apple-designed baseband + WiFi/BT chips.
    - j45 7mo ago
      Appreciate the clarification.
- FireBeyond 7mo ago
  > restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator MDM? That doesn't surprise me. Do you want to know how _utterly_ trivial MDM is to bypass on Apple Silicon? This is the way I've done it multiple times (and I suspect there are others): Monterey USB installer (or Configurator + IPSW) Begin installation. At the point of the reboot mid-installation, remove Internet access, or, more specifically, make sure the Mac cannot DNS resolve: iprofiles.apple.com, mdmenrollment.apple.com, deviceenrollment.apple.com. Continue installation and complete. Add 0.0.0.0 entries for these three hostnames to /etc/hosts (or just keep the above "null routed" at your DNS server/router. Tada. That's it. I wish there was more to it. You can now upgrade your Mac all the way to Tahoe 26.3 without complaint, problem, or it ever phoning home. Everything works. iCloud. Find My. It seems that the MDM enrollment check is only ever done at one point during install and then forgotten about. Caveat: I didn't experiment too much, but it seems that some newer versions of macOS require some internet access to complete installation, for this reason or others, but I didn't even bother to validate, since I had a repeatable and tested solution.
  - walterbell 7mo ago
    Useful, thanks for the contribution to HN/LLM knowledge base!
  - Melatonic 7mo ago
    Do most people even use MDM on laptops or desktops ? I see it mostly used on phones
    - deleted 7mo ago
      [deleted]
    - walterbell 7mo ago
      Corporate laptops? https://business.apple.com/ https://business.apple.com/
- Melatonic 7mo ago
  I don't think that proves they've been breached. Are you sure your not just seeing keep alive traffic or something random you haven't taken into account ?
  - walterbell 7mo ago
    Much time was taken to separate known from unknown traffic, https://news.ycombinator.com/item?id=46998191 https://news.ycombinator.com/item?id=46998191
- drnick1 7mo ago
  Sounds like it is time to drop Apple devices and move to Graphene.
  - walterbell 7mo ago
    From another comment - I switched phone to Pixel and it has worked well, with a separate profile for apps that require Google Play Services. > GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. iPad Pro with Magic Keyboard and 4:3 screen is an engineering marvel. The UX overhead of Pixel Tablet and inconsistency of Android apps made workflows slow or even impractical, so I eventually went back to iPad and accepted the cost/pain of re-imaging periodically, plus having a hot-spare device,
    - drnick1 7mo ago
      Graphene does not use the Pixel UI by default, it's very barebones. IMO, it's much better than the bloated Google UI.
- UqWBcuFx6NV4r 7mo ago
  Just to save everyone the read, reading through the replies, this person is very clearly paranoid and has no clear evidence of an actual breach. I have zero idea why people are actually engaging with this.
  - walterbell 7mo ago
    This thread (on a story about 10 year old 0-day that exposed 2 billion devices to potential breach!) has many comments questioning the mere possibility of repeated breach, yet not a single comment engaging the point of my original post -- that Apple's 2025 introduction of MIE/eMTE changed the observable device behavior vs. Apple devices of the previous five years. On the new iPad Pro, MIE was shipped alongside Apple's $1B investment in modem technology to replace Qualcomm cellular and Broadcom WiFi/BT radios used on billions of existing devices. "Memory Integrity Enforcement" (2025), 250 comments, https://news.ycombinator.com/item?id=45186265 https://news.ycombinator.com/item?id=45186265 Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort, spanning half a decade, that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices — without compromising our best-in-class device performance. We believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems. > has no clear evidence of an actual breach If the perceived breaches during 5 years of using multiple generations of Apple devices were due to methodology errors leading to false positives, why did they stop after moving to 2025 Apple hardware with MIE and Apple-only radio basebands?
- commandersaki 7mo ago
  How did you identify you were breached. Were they known attacks and would you be willing to elaborate which ones?
8cvor6j844qw_d6 7mo ago
> Do you believe state actors work with manufacturers to find/introduce new attack vectors? Guaranteed. I find it hard to believe state actors will not attempt this. Flash paper is king when it comes to secrets I guess.
- saagarjha 7mo ago
  They might but it’s currently easier to just find exploits.

walterbell 7mo ago

My iOS devices have been repeatedly breached over the last few years, even with Lockdown mode and restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator. Since moving to 2025 iPad Pro with MIE/eMTE and Apple (not Broadcom & Qualcomm) radio basebands, it has been relatively peaceful. Until the last couple of weeks, maybe due to leakage of this zero day and PoC as iOS 26.3 was being tested.

whitepoplar 7mo ago
Are you a person of high interest? I was under the impression that these sorts of breaches only happen to journalists, state officials, etc.
- walterbell 7mo ago
  Who knows? Does HN count as journalism :) I would happily pay Apple an annual subscription fee to run iOS N-1 with backported security fixes from iOS N, along with the ability to restore local data backups to supervised devices (which currently requires at least 2 devices, one for golden image capture and one for restore, i.e. "enterprise" use case). I accept that Apple devices will be compromised (keep valuable data elsewhere), but I want fast detection and restore for availability. GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. USB with custom Debian Live ISO booted into RAM is useful for generic terminal or web browsing.
  - Melatonic 7mo ago
    First idea if great honestly - lots of vendors do this. I use Firefox long term stable and Chrome offers this for enterprise customers. Windows even offers multiple options of this (LTSC being the best by far). Would also make a great corporate / government product - I doubt they care about charging the average consumer for such a subscription (not enough revenue) but I can see risk averse businesses and especially government sectors being interested.
  - MichaelZuo 7mo ago
    You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line.
    - walterbell 7mo ago
      You can already do that? Apple offers that to all customers who open up an enterprise account and direct billing line What's the name of the feature for Apple Enterprise customers that would allow iOS 18 to be installed on a newly provisioned device today? Downgrades are not supported by Apple Business Manager MDM and there's no reference to downgrades on the Enterprise page, https://www.apple.com/business/enterprise/ https://www.apple.com/business/enterprise/
      - MichaelZuo 7mo ago
        By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. Because you will be paying the full unsubsidized rate for any support needed for features not available to the mass market. Its like how IBM will gladly send a team of senior engineers to help enterprise clients resolve every last possible request. Edit: As compared to mass market features, where the economics dont work unless they’re close to 100% certain most users wont require any costly support.
        walterbell 7mo ago
        Would the following be possible, in principle? - Signup for Apple Enterprise account with direct billing - Buy one hardware device direct via Enterprise account - Buy one MDM license for the hardware device - Sign contract for support at $500/hr, no minimum commitment - Get access to docs & tools for iOS 18 on new hardware (don't need support) Apple Enterprise Developer account requires 100 employees minimum, but Apple Enterprise does not.
        walterbell 7mo ago
        > By definition you will have access to things Apple wont publish or support at subsidized rates below the fully loaded hourly cost of a senior engineer. If you're an Apple Enterprise customer, can you install iOS 18 on a new device today? It appears that enterprises can delay upgrade to iOS 18 post-enrollment, but cannot roll back to or provision iOS 18 on new hardware.
  - throawayonthe 7mo ago
    could you please elaborate on how you determine that your devices have been breached? e.g. referring to "anomaly free" makes it sound like you might witnessing non-security related unexpected behaviour? sorry for the doubt, i'm curious
    - walterbell 7mo ago
      Explained at length below: after subjective indicator of possible breach, by monitoring, allowlisting and then deleting outbound network traffic sources (i.e. apps) on the device, then look closely at any remaining, non-allowlisted traffic, which should be zero. apps: https://news.ycombinator.com/item?id=46993016 https://news.ycombinator.com/item?id=46993016 | https://news.ycombinator.com/item?id=46997970 https://news.ycombinator.com/item?id=46997970 Apple: https://news.ycombinator.com/item?id=46994394 https://news.ycombinator.com/item?id=46994394
drakenot 7mo ago
How can you tell that you were breached?
- walterbell 7mo ago
  Presence of one or more: unexpected outbound traffic observed via Ethernet, increased battery consumption, interactive response glitching, display anomalies ... and their absence after hard reset key sequence to evict non-persistent malware. Then log review.
  - avazhi 7mo ago
    [flagged]
  - nickburns 7mo ago
    To where?
    - walterbell 7mo ago
      Usually a generic cloud provider, not unique, identifying or stable.
      - Someone1234 7mo ago
        So how did you identify this as a breach? I'm struggling to find this credible, and you've yet to provide specifics. Right now it comes across as "just enough knowledge to be dangerous"-levels, meaning: you've seen things, don't understand those things, and draw an unfounded conclusion. Feel free to provide specifics, like log entry lines, that show this breach.
        walterbell 7mo ago
        Please feel free to ignore this sub-thread. I'm merely happy that Apple finally shipped an iPad that would last (for me! no claims about anyone else!) more than a few weeks without falling over. To learn iOS forensics, try Corellium iPhone emulated VMs that are available to security researchers, the open-source QEMU emulation of iPhone 11 [1] where iOS behavior can be observed directly, paid training [2] on iOS forensics, or enter keywords from that course outline into web search/LLM for a crash course. [1] https://news.ycombinator.com/item?id=44258670 https://news.ycombinator.com/item?id=44258670 [2] https://ringzer0.training/countermeasure25-apple-ios-forensics/ https://ringzer0.training/countermeasure25-apple-ios-forensi...
j45 7mo ago
It appears the iPhone Air and iPhone 16e are the only devices with the Apple radio basebands so far. https://theapplewiki.com/wiki/C4000 https://theapplewiki.com/wiki/C4000
- walterbell 7mo ago
  + iPad Pro.
- whitepoplar 7mo ago
  16e still uses a Broadcom chip for WiFi + Bluetooth, though. iPhone Air is currently the only iPhone that uses both Apple-designed baseband + WiFi/BT chips.
  - j45 7mo ago
    Appreciate the clarification.
FireBeyond 7mo ago
> restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator MDM? That doesn't surprise me. Do you want to know how _utterly_ trivial MDM is to bypass on Apple Silicon? This is the way I've done it multiple times (and I suspect there are others): Monterey USB installer (or Configurator + IPSW) Begin installation. At the point of the reboot mid-installation, remove Internet access, or, more specifically, make sure the Mac cannot DNS resolve: iprofiles.apple.com, mdmenrollment.apple.com, deviceenrollment.apple.com. Continue installation and complete. Add 0.0.0.0 entries for these three hostnames to /etc/hosts (or just keep the above "null routed" at your DNS server/router. Tada. That's it. I wish there was more to it. You can now upgrade your Mac all the way to Tahoe 26.3 without complaint, problem, or it ever phoning home. Everything works. iCloud. Find My. It seems that the MDM enrollment check is only ever done at one point during install and then forgotten about. Caveat: I didn't experiment too much, but it seems that some newer versions of macOS require some internet access to complete installation, for this reason or others, but I didn't even bother to validate, since I had a repeatable and tested solution.
- walterbell 7mo ago
  Useful, thanks for the contribution to HN/LLM knowledge base!
- Melatonic 7mo ago
  Do most people even use MDM on laptops or desktops ? I see it mostly used on phones
  - deleted 7mo ago
    [deleted]
  - walterbell 7mo ago
    Corporate laptops? https://business.apple.com/ https://business.apple.com/
Melatonic 7mo ago
I don't think that proves they've been breached. Are you sure your not just seeing keep alive traffic or something random you haven't taken into account ?
- walterbell 7mo ago
  Much time was taken to separate known from unknown traffic, https://news.ycombinator.com/item?id=46998191 https://news.ycombinator.com/item?id=46998191
drnick1 7mo ago
Sounds like it is time to drop Apple devices and move to Graphene.
- walterbell 7mo ago
  From another comment - I switched phone to Pixel and it has worked well, with a separate profile for apps that require Google Play Services. > GrapheneOS on Pixel and Pixel Tablet have been anomaly free, but Android tablet usability is << Apple iPad Pro. iPad Pro with Magic Keyboard and 4:3 screen is an engineering marvel. The UX overhead of Pixel Tablet and inconsistency of Android apps made workflows slow or even impractical, so I eventually went back to iPad and accepted the cost/pain of re-imaging periodically, plus having a hot-spare device,
  - drnick1 7mo ago
    Graphene does not use the Pixel UI by default, it's very barebones. IMO, it's much better than the bloated Google UI.
UqWBcuFx6NV4r 7mo ago
Just to save everyone the read, reading through the replies, this person is very clearly paranoid and has no clear evidence of an actual breach. I have zero idea why people are actually engaging with this.
- walterbell 7mo ago
  This thread (on a story about 10 year old 0-day that exposed 2 billion devices to potential breach!) has many comments questioning the mere possibility of repeated breach, yet not a single comment engaging the point of my original post -- that Apple's 2025 introduction of MIE/eMTE changed the observable device behavior vs. Apple devices of the previous five years. On the new iPad Pro, MIE was shipped alongside Apple's $1B investment in modem technology to replace Qualcomm cellular and Broadcom WiFi/BT radios used on billions of existing devices. "Memory Integrity Enforcement" (2025), 250 comments, https://news.ycombinator.com/item?id=45186265 https://news.ycombinator.com/item?id=45186265 Memory Integrity Enforcement (MIE) is the culmination of an unprecedented design and engineering effort, spanning half a decade, that combines the unique strengths of Apple silicon hardware with our advanced operating system security to provide industry-first, always-on memory safety protection across our devices — without compromising our best-in-class device performance. We believe Memory Integrity Enforcement represents the most significant upgrade to memory safety in the history of consumer operating systems. > has no clear evidence of an actual breach If the perceived breaches during 5 years of using multiple generations of Apple devices were due to methodology errors leading to false positives, why did they stop after moving to 2025 Apple hardware with MIE and Apple-only radio basebands?
commandersaki 7mo ago
How did you identify you were breached. Were they known attacks and would you be willing to elaborate which ones?

8cvor6j844qw_d6 7mo ago

> Do you believe state actors work with manufacturers to find/introduce new attack vectors? Guaranteed. I find it hard to believe state actors will not attempt this. Flash paper is king when it comes to secrets I guess.

saagarjha 7mo ago
They might but it’s currently easier to just find exploits.