After several espionage affairs, in which journalists, civil rights activists and even high-profile politicians, among others, were bugged via the manufacturer's devices, Apple wants to do significantly more for security.
Off to lockdown
With the next operating system versions for iPhone (iOS 16), iPad (iPadOS 16) and Mac (macOS 13 Ventura) there should be a new mode that seals the devices from the outside if you perceive yourself as a particularly vulnerable person. This is intended to make it less easy to exploit possible yet unknown security gaps in the operating systems, so-called zero days.
Safari without JIT
In the Safari browser, which is also inevitably found in every alternative web surfboard (e.g. Chrome and Firefox) on the iPhone and iPad as the WebKit engine, "certain complex web technologies such as just-in-time JavaScript compilation (JIT)" should no longer be used to run. This should reduce attack surfaces. However, there will be a whitelisting for trusted sites.
In the case of Apple services, "incoming invitations and service requests" from third parties with whom there has not yet been any communication should no longer be let through – this is apparently intended to make possible gaps in FaceTime unexploitable. Communication with another party is only allowed if a connection has already been established by the user. It is still unclear which apps this affects.
USB interface tight
Apple wants to ward off dangers from physical connections via a USB-to-Lightning cable with a standard blockade in lockdown mode. Computers and accessories are no longer allowed to connect to the iPhone when it is "locked". (The latter is somewhat confusing, however, because these actually have to be released now – details are likely to follow here as well.)
In addition, Apple has defused mobile device management (MDM), which is increasingly being misused as a gateway, in lockdown mode: no configuration profiles may then be installed and MDM registration is prohibited in lockdown. All in all, these are certainly sensible measures that Apple advises people "who are at risk from targeted cyber attacks by private companies with state-sponsored spy software". But they also make using the device more uncomfortable.
Money for non-profit, high bug bounty
In addition to the lockdown mode, which Apple describes as "extreme, optional protection for the very small number of users who are exposed to serious, targeted threats to their digital security", the group also wants it put more money into security research – and donate money.
In addition to possible compensation payments from a lawsuit against the spyware company NSO Group, 10 million US dollars are to go to non-profit organizations. According to Apple, the first donation will go to the "Dignity and Justice Fund" set up by the Ford Foundation. The private foundation is committed to "promoting justice in the world," according to Apple. Furthermore, a new bug bounty under Apple's program of the same name will only be suspended for attacks on the lockdown mode: The sum is 2 million dollars, according to Apple "the highest bounty payout sum in the industry".
