[jon-wood]

> Configuration profiles cannot be installed, and the device cannot enroll into mobile device management (MDM), while Lockdown Mode is turned on.

(From the article)

So this would have prevented Hermit as you'd need to install a new configuration profile to allow sideloading of applications from that source.

[Ansil849]

> So this would have prevented Hermit as you'd need to install a new configuration profile to allow sideloading of applications from that source.

Are you sure that's true? I haven't seen a Hermit sample firsthand, but from everything I've read about it targets did not need to install an MDM profile, they simply needed to click a link. Looking at Apple's distribution guidelines - https://support.apple.com/en-bw/guide/deployment/depce7cefc4... - MDM is listed as one option, and simply going to a link is listed as another:

> There are two ways you can distribute proprietary in-house apps: > > Using MDM > > Using a website

It seems like the latter was used, so I don't think installation of a custom profile was required, which brings me back to my original question of whether Lockdown would have prevented it.

[buran77]

An yet I wouldn't immediately jump to the conclusion that it's "security theater" because it only protects you from the vast majority of attacks and it may still be vulnerable to many 0-days. By this definition we have nothing but security theater in everything. And as the saying goes, if everything is security theater, nothing is security theater.

[Ansil849]

Lockdown is literally presented by Apple as being for people targeted by APTs like those developed by NSO Group, therefore I expect it to prevent attack vectors used by these APTs, like exploitation of the Developer program to facilitate sideloading malicious apps. I don't feel like this is an unrealistic expectation, and not having the mode actually do that amounts to security theater, which is a far cry from decrying everything as such.

[ylk]

> I expect it to prevent attack vectors used by these APTs

It does, it just doesn't close all attack vectors used by APTs.

They say[0]:

> Turning on Lockdown Mode [...] further hardens device defenses and strictly limits certain functionalities, sharply reducing the attack surface that potentially could be exploited by highly targeted mercenary spyware.

They don't say "turn this on and you'll be unhackable". They go on to say:

> Apple will continue to strengthen Lockdown Mode and add new protections to it over time.

So what they released in the current beta is just the start. They decided that releasing Lockdown mode with only some additional protections would be worthwhile to at-risk users and I personally agree. It's both true that Lockdown likely helps at-risk users (see reply by _kbh_) and still has lots of room for improvement.

[0]: https://www.apple.com/newsroom/2022/07/apple-expands-commitm...

[reaperducer]

It does, it just doesn't close all attack vectors used by APTs.

It's an ongoing problem with the pathological Apple-haters that they imagine that Apple says or promise something, and spread that falsehood all over the internet, when in realty Apple promised no such thing. They see what they want to see.

In addition to the thread above, another example is the dozens and dozens of times on HN where they claim that Apple promises that its app review process will keep 100% of malware out of the App Store. Apple doesn't make that claim. It says that app store reviews help prevent malware.

It's like discussing politics at the Thanksgiving table. People hear what they want to hear.

[_kbh_]

> Lockdown is literally presented by Apple as being for people targeted by APTs like those developed by NSO Group, therefore I expect it to prevent attack vectors used by these APTs, like exploitation of the Developer program to facilitate sideloading malicious apps. I don't feel like this is an unrealistic expectation, and not having the mode actually do that amounts to security theater, which is a far cry from decrying everything as such.

These APTs overwhelming use RCE vectors that are less obvious then side loading apps, iMessage is probably the most popular and I would hazard a guess that other popular messaging applications (WeChat, signal, telegram, etc) and safari would be next.

[olliej]

Running an enterprise app still is not a trivial single tap on iOS.

Obviously with the new EU legislation mandating support for unrestricted malware of this kind, that's kind of a moot factor in EU and EU-adjacent markets.

[Ansil849]

> Running an enterprise app still is not a trivial single tap on iOS.

Yes, but still successful, as Hermit demonstrated. So my question is whether Lockdown mode would have prevented APTs like Hermit which it claims to prevent against. If not, then the move is security theater which doesn't address the actual flaws (like poor vetting into the Enterprise Program) being successfully leveraged in the wild.

[olliej]

I had a more detailed reply to an earlier post you made - but the summary is "What constitutes an enterprise that should be allowed to have 'enterprise apps'"

[Ansil849]

> "What constitutes an enterprise that should be allowed to have 'enterprise apps'"

Apple has a list of requirements - https://developer.apple.com/programs/enterprise/ - for example, a company needs to have at least 100 employees. The issue, however, seems to be how stringently these requirements are enforced, or whether they are at all. In the case of Hermit, the Italian spyware company seems to have created a fake company and tricked Apple into granting the fake company access to the developer program. Now, the interesting question for me is whether the fake company actually managed to pass all of the requirements, like giving Apple a list of 100 fake employees, and whether Apple actually performed their due dilligence and checked whether the employee list was real, or whether they accepted it at face value, or didn't even require it.

In other words, I think a key takeaway from the latest incident is Apple needs to take accountability and harden their Enterprise program entry requirements, and I haven't seen anything about that being the case.

[reaperducer]

I haven't seen anything about that being the case.

So, if revisions to Apple's internal policies and review processes aren't posted in Techcrunch, then they didn't happen?

[tinus_hn]

I think you can also buy enterprise accounts on the black market, there used to programs with pirated apps that used this kind of distribution.