On the way to your iPhone: “NSO mode”

After being previously burned by the Israeli cyber company NSO – Apple is introducing an increased security situation that will reach its devices later this year and will protect against attacks by offensive cyber companies

Source: Apple

Apple has been careful in recent years to emphasize the issue of user privacy – and the protection of it. Not in this case one of her main arguments when trying to protect her “locked garden” from installing apps outside of Appstore. But after some weaknesses and vulnerabilities that the Israeli NSO allegedly exploited on iPhones, Apple is now introducing a new situation designed to prevent just such exploitation.

Tightens security

Apple announced last night (Wednesday) that it will add to the next versions of its mobile operating system – iOS 16 and iPadOS 16 – and to its operating system for Mac – macOS Ventura – a new mode called Lockdown Mode that will provide its users with increased security. This is in an attempt to inflict possible harm on them from what Apple defines as “spyware developed by state-supported cyber companies.”

The new situation, according to Apple, will be aimed primarily at users who are at risk for personal-directed cyberattacks, such as journalists, human rights activists and government employees – all people who were previously claimed to have been victims of attacks using a very specific offensive cyber tool.

The new Lockdown mode will keep users from threats on several fronts once activated. Among other things, the mode will prevent receiving attachments to messages other than pictures; Disables link preview; Will block web pages that include complex technologies such as JIT JavaScript, other than sites that the user chooses to exclude in advance; Invitations to join services or FaceTime calls will be blocked; Access to the iPhone through the computer will be blocked by connecting with a cable – as long as the device is locked; Apple will also not allow its devices to be “managed” by third-party tools as long as Lockdown mode is enabled.

Apple has announced that the new mode will not be enabled by default on all devices that will be updated to the new versions of its operating systems, which are expected to arrive later this year, but any user who wants to play with the settings or disable it can do so through the “Privacy and Security” tab. It is important to note that if you want to change the settings of the device – logging in and out of Lockdown mode will require you to restart the device and unlock it with your password.

The bad blood between Apple and the NSO Group

As mentioned, the new situation may be called Lockdown, and not “NSO Mode”… but given Apple’s history with the Israeli offensive cyber company NSO Group – it seems that this is a development designed mainly to block its powerful cyber tool – Pegasus.

Apple has previously pushed for urgent security updates after cases of using Pegasus against iPhone users were discovered. The new feature is going to address, among other things, a very specific attack vector that was discovered last year – which included the use of a malicious GIF file sent as a message attachment – which would not be possible in Lockdown mode.

In announcing the new situation, Apple refers to the Israeli cyber company and says that “Lockdown mode offers a very high level of security and options for users, who because of who they are or what they do, may be exposed to attacks by the most sophisticated digital threats, such as those from NSO Group and private companies. Others develop cyber tools that serve as mercenaries. ‘

Apple, it will be recalled, even sued NSO last November and announced with the announcement of Lockdown status that it is setting up a $ 10 million fund (+ compensation it will receive from the lawsuit against NSO, if and when) to support organizations exposing targeted cyberattacks like those done with tools like Pegasus.