NEWS  Security  December 7, 2023  Reading time: 2 Minute(s)

Max (RS editor)

Cybersecurity researchers at Jamf Threat Labs have identified a novel technique allowing malware to circumvent Lockdown Mode on iOS devices, compromising the security features introduced by Apple in iOS 16.

Lockdown Mode, designed to fortify iOS devices against potential breaches, faced scrutiny as researchers found its vulnerability lay in user-space components rather than deep integration into the iOS kernel. This flaw opens the door for malware to exploit Lockdown Mode's controls by tampering with the user's default database or utilizing method hooking techniques.

Jamf Threat Labs' researchers demonstrated the potential for creating a Fake Lockdown Mode that visually mimics the original without providing any of its security features. Crucially, this technique requires an already compromised device for successful implementation.

When a user activates Lockdown Mode through the Settings app, the method initiates a series of actions, including disabling various features and setting the LDMGlobalEnabled key to indicate Lockdown Mode is active. However, on a compromised device, a hacker can manipulate this process, rendering the user's perception of a secure device false.

In a compelling demo video, researchers showcased how malware intercepts Lockdown Mode activation, creates a fake file, initiates a user space reboot, and tricks the system into believing Lockdown Mode is active. Even after the user believes their device is secure, the malware can persistently monitor and control the device.

Jamf Threat Labs went further to manipulate Lockdown Mode within Safari, highlighting the vulnerability even in widely-used applications. By hooking into Safari's code, researchers could force the system to erroneously believe Lockdown Mode was enabled.

Although Apple addressed this vulnerability in iOS 17 by elevating Lockdown Mode to kernel level, users are advised to remain vigilant. The researchers caution users to strengthen their device security by employing robust passwords and regularly updating their devices with the latest security patches. This revelation underscores the need for ongoing diligence in safeguarding iOS devices against evolving cybersecurity threats.