EXPLORINEER
en

DE — heise online

Lockdown Mode Bypassed: How Calif.io's Latest Exploit Works

Security2 min read

A security researcher from the team Calif.io says he built a working iPhone jailbreak that gets past Apple's Lockdown Mode, a special high-security setting. The exploit also survives a software update, and he says Apple has not yet fixed that weak point.

A jailbreak that works in Lockdown Mode

Stefan Esser, a long-time IT security researcher, has shown a jailbreak for recent iPhones. A jailbreak is a hack that gives someone deep control over a phone that the owner did not intend. Esser's version works even when Lockdown Mode is turned on. Lockdown Mode blocks many common ways that malware can get onto a device, such as some message and email features. The attack in his demo used a booby-trapped PDF file. The file was opened through Safari or AirDrop, and the user only had to open it.

Key facts

  • The jailbreak works on all current iPhones up to iOS 27.0.1.
  • The exploit stays on the phone after an update to iOS 27.2, which closes the flaws it used.
  • Lockdown Mode was turned on during the whole demo, but Esser did not show this in his video.
  • Apple's memory protection (MTE, which Apple calls MIE) is active in the Preview app only when Lockdown Mode is on. Calif.io's team still got around it.

What Lockdown Mode is

Apple introduced Lockdown Mode to protect people who may be targeted by very advanced spyware, often sold to governments. It shuts off features that attackers often use. Last spring, Apple said that no mercenary spyware had ever gotten past it. Esser says such claims should be treated with caution and are mostly marketing. He also says Lockdown Mode does not stop attacks completely. It makes them more costly for attackers, because they need more steps.

Why it matters

The story shows that even a strong security mode can have gaps. Esser says devices still read huge amounts of media and file types, and PDF files are hard to parse safely. If the update fix does not close the weak point, the exploit can stay on phones after users install new software. Until Apple fixes it, the risk remains for people who are targeted by advanced attacks.

What to watch

  • Whether Apple fixes the persistence weakness after Calif.io sends the technical details.
  • Whether Apple changes when memory protection (MTE/MIE) is turned on outside Lockdown Mode.
  • Whether Apple responds to Esser's claim that its marketing about Lockdown Mode is misleading.

Glossary

Lockdown Mode
An optional high-security setting from Apple that turns off features often used in attacks.
Calif.io
An IT security team that Stefan Esser is part of; it does security research and testing.
MTE
Memory Tagging Extension, a protection that helps stop programs from misusing memory. Apple calls its version MIE.
AirDrop
Apple's feature for sending files between nearby Apple devices.

Same story, different eyes

Ad

Add 150 words. Learn 10 a day.

Dicter word books send only the words you learn to your review notes.

More in this topic

SecurityITmedia

Government Warns Businesses After Series of Data Leaks, Citing Multiple Cases of Insufficient Basic Security Measures

Japan's National Cyber Office issued a warning on November 5 to businesses running websites and mobile apps after a series of personal data leaks in the country. The office said it confirmed multiple cases where the leaks appeared to stem from insufficient basic security measures, and it outlined countermeasures covering system operation, design and development, and supply chain risks.

SecurityZDNet Korea

Joshin President Apologizes Over Possible Leak of 6 Million Personal Records

Joshin, a Japanese electronics retailer based in Osaka, has apologized after an unauthorized third party accessed its member information database server, potentially exposing more than 6 million customer records, including names and addresses. The company also said driver's license images, a My Number card record, and five bank account numbers may have been leaked. To prevent recurrence, Joshin plans to stop holding unnecessary customer information and has begun deleting it.

SecurityThe Register

Hospital gave very sick doctor a special PC for his personal, erm, pleasure

In this On Call column, a reader named Mason recounts supporting a hospital research lab run by a prominent organ transplant researcher who repeatedly caused malware infections by visiting adult sites on his office PCs. Management did not discipline him after a worm outbreak; instead, the IT department gave him a designated PC for personal use, and Mason's boss told him to comply or find another job. Mason later learned that the PC was cited as evidence in a lawsuit filed by the doctor's graduate students.

SecurityITmedia

Unauthorized Access Hits Security Awareness Group; Up to 15,000 Personal Records Possibly Leaked

The Japan Network Security Association (JNSA) said a third party gained unauthorized access to its "Information Security Comprehension Check Service," possibly leaking up to 15,128 personal records, including user IDs and hashed passwords. The service has been suspended while JNSA and external specialists investigate the cause and scope; the entry route is not yet known. JNSA plans to notify affected individuals once identified and report to the Personal Information Protection Commission, and warns users to beware of phishing emails that may use the leaked information.