Advertisement
July 6, 2022
TO UPDATE
Apple extends its industry-leading commitment to protecting users from highly targeted mercenary spyware
Apple announces a breakthrough security feature that provides special additional protection for users who may be at risk from highly targeted cyberattacks from private companies developing government-sponsored mercenary spyware. Apple also announces details of its $10 million grant to support research uncovering such threats.
Apple today detailed two initiatives designed to help protect users who may be personally targeted by some of the most sophisticated digital threats, such as: B. those of private companies that develop government-sponsored mercenary spyware. Lockdown mode — the first major feature of its kind coming this fall with iOS 16, iPadOS 16, and macOS Ventura — is extreme, optional protection for the very small number of users who face serious, targeted threats to their digital security. Apple also shared details of the $10 million cybersecurity grant it announced last November to support civil society organizations that conduct commercial spyware threat research and advocacy.
“Apple makes the most secure mobile devices on the market. Lockdown mode is a game-changing feature that reflects our unwavering commitment to protecting users from even the rarest and most sophisticated attacks,” said Ivan Krstić, Apple’s head of security engineering and architecture. “While the vast majority of users will never fall victim to targeted cyberattacks, we will work tirelessly to protect the small number of users that are. This includes continuing to develop countermeasures specifically for these users, as well as supporting researchers and organizations around the world who are doing the vital work to uncover mercenary companies creating these digital attacks.”
Lockdown mode offers an extreme, optional level of security for the very few users who, by their very nature or job, may personally become the target of some of the most sophisticated digital threats, such as. B. those of the NSO Group and other private companies development of state-sponsored mercenary spyware. Enabling lockdown mode in iOS 16, iPadOS 16, and macOS Ventura further strengthens device defenses and severely restricts certain functions, greatly reducing the attack surface that could potentially be exploited by highly targeted mercenary spyware.
At startup, lockdown mode includes the following protections:
- Messages: Most types of message attachments except images are blocked. Some features like link previews are disabled.
- Web browsing: Certain complex web technologies, such as just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted website from blocking mode.
- Apple Services: Incoming invitations and service requests, including FaceTime calls, are blocked unless the user has previously sent the initiator a call or request.
- Cable connections to a computer or accessory are blocked when iPhone is locked.
- Configuration profiles cannot be installed and the device cannot enroll in mobile device management (MDM) while lockdown mode is enabled.
Apple will continue to strengthen lockdown mode and add new protections to it over time. To invite feedback and collaboration from the security research community, Apple has also created a new category within the Apple Security Bounty program to reward researchers who find lockdown mode bypasses and help improve protection. Awards are doubled for qualifying results in lockdown mode, up to a maximum of $2,000,000 – the highest maximum award payout in the industry.
Apple is also awarding a $10 million grant, in addition to any claims for damages in the lawsuit filed against NSO Group, to support organizations investigating, detecting and preventing highly targeted cyberattacks, including those created by private companies that are government-run develop sponsored mercenary spyware. The grant goes to the Dignity and Justice Fund, established and advised by the Ford Foundation – a private foundation dedicated to advancing justice around the world – which aims to pool philanthropic resources to advance social justice worldwide. The Dignity and Justice Fund is a tax-sponsored project of the New Venture Fund, a 501(c)(3) public charity.
“The global spyware trade targets human rights defenders, journalists and dissidents; it facilitates violence, strengthens authoritarianism and supports political repression,” said Lori McGlinchey, director of the Ford Foundation’s Technology and Society program. “The Ford Foundation is proud to support this extraordinary initiative to strengthen civil society research and advocacy on the fight against mercenary spyware. We must build on Apple’s commitment and invite companies and donors to join the Dignity and Justice Fund and contribute additional resources to this common fight.”
The Dignity and Justice Fund is expected to make its first grants in late 2022 or early 2023, initially funding approaches designed to help uncover mercenary spyware and protect potential targets, including:
- Build organizational capacity and enhance field coordination of new and existing civil society cybersecurity research and advocacy groups.
- Support the development of standardized forensic methods to detect and confirm spyware injections that meet evidentiary standards.
- Empowering civil society to more effectively collaborate with device manufacturers, software developers, commercial security firms, and other relevant organizations to identify and remediate vulnerabilities.
- Raising awareness of the global mercenary spyware industry among investors, journalists and policy makers.
- Building human rights defenders’ ability to detect and respond to spyware attacks, including security audits for organizations facing increased threats to their networks.
The Dignity and Justice Fund’s grant strategy for investigating, tracking and accountability for the expanded cyberweapons trade is advised by an independent, global Technical Advisory Board. Initial members are:
- Ron Deibert, Professor of Political Science and Director of the Citizen Lab at the Munk School of Global Affairs & Public Policy, University of Toronto
- Ivan Krstić, Head of Apple Security Engineering and Architecture
“There is now indisputable evidence from research by Citizen Lab and other organizations that the mercenary surveillance industry facilitates the spread of authoritarian practices and gross human rights abuses around the world,” said Ron Deibert, director of the Citizen Lab, a research group at the University of Toronto. “I applaud Apple for establishing this important grant that will send a strong message and help advance independent researchers and advocacy groups that hold mercenary spyware vendors accountable for the harm they inflict on innocent people.”
Press Contacts
Scott Radcliffe
Apple
Apple Media Helpline
(408) 974-2042
