Word Notes
Ep 116 | 9.13.22
Apple Lockdown Mode (noun)
Rick Howard: The word is: Apple Lockdown Mode.
Rick Howard: Spelled: Apple as in the technology company that produces Macs, iPhones, and iPads. Lockdown as in a state of restricted access and mode as in a way of operating.
Rick Howard: Definition: An optional security mode for macOS and iOS that reduces the attack surface of the operating system by disabling certain commonly attacked features.
Rick Howard: Example sentence: Lockdown Mode prevented the spyware from exploding the zero-day vulnerability in Facetime.
Rick Howard: Origin and context: As of this episode, Lockdown Mode is an upcoming security feature that will be included with iOS 16, iPadOS 16, and macOS 13 Ventura. The mode is disabled by default, but can be enabled in settings under privacy and security. Lockdown Mode is intended for a small number of users who believe they are more at risk than the general purpose internet user of being targeted by cyber adversary groups. Examples might include dissidents, company executives, senior government officials, and journalists, like Jamal Khashoggi The Washington Post journalist who was tracked using the NSO Group's Pegasus software by unknown parties. On October 2nd, 2018 assassins murdered Khashoggi when he walked into the Saudi Consulate in Istanbul, Turkey.
Rick Howard: According to apple, quote, Lockdown Mode offers an extreme, optional level of security for the very few users who, because of who they are or what they do, may be personally targeted by some of the most dangerous digital threats, such as those from the NSO Group and other private companies developing state-sponsored mercenary spyware. Turning on Lockdown Mode, further hardens device defenses, and strictly limits certain functionalities, sharply reducing the attack surface that potentially could be exploited by that software end quote.
Rick Howard: Nerd reference: In July, 2021, Frontline, a PBS news program, published their investigation of the Pegasus software.
Frontline Narrator: On October 2nd, 2018 journalist, Jamal Khashoggi walked into the Saudi consulate in Turkey and never came back out. Around the time of his murder, a powerful spyware may have been used to surveil his family.
Jamal Khashoggi: Activists journalists all are said to have been hacked by spyware developed by the Israeli company called the NSO Group.
Frontline Narrator: A consortium of news outlets from around the world, including Frontline have been investigating the use of the spyware called Pegasus and the Israeli company NSO Group that sells it to foreign governments.
Jamal Khashoggi: The government can see anything on the phone, including pictures, contacts. Into calls.
Frontline Narrator: As part of the investigation into Pegasus Washington Post reporter Dana Priest traveled to Istanbul, working with the journalism, nonprofit forbidden stories. The reporters were given access to 50,000 phone numbers, concentrated in countries known to be NSO clients. They included journalists, politicians, human rights, activists and Jamal Khashoggi fiance, Hatice Cengiz. Deni priest and a producer working for Frontline and forbidden stories met with Hatice to verify if her phone had, in fact been hacked.
Jamal Khashoggi: On the 6th of October of 2018, seems to have been a first compromise, which was followed by some additional traces on the 9th and then on the 12th.
Rick Howard: Word notes is written by Tim Nodar, executive produced by Peter Kilpe, and edited by John Petrik and me, Rick Howard. The mix, sound design, and original music have all been crafted by the ridiculously talented Elliott Peltzman. Thanks for listening.
HOST(S):
Rick Howard is CSO, Chief Analyst, and Senior Fellow at the CyberWire. Past lives include CSO at Palo Alto Networks, TASC, iDefense GM, Counterpane SOC Director, and the Army's Computer Emergency Response Team (CERT) Commander. Rick served 25 years in the Army, taught computer science at West Point, and edited two books. Rick is regularly joined by the CyberWire's Hash Table experts.
Follow Rick Howard
Schedule: Tuesdays
Creator: CyberWire, Inc.
Sponsored by KnowBe4
KnowBe4, the provider of the world's largest integrated security awareness training and simulated phishing platform. KnowBe4 helps organizations address the human element of security by raising awareness of social engineering tactics through a new-school approach to security awareness training. Learn more at KnowBe4.