44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.3 iPhone / iOS Security Model – App Store, Sandbox, Lockdown Mode
iOS defaults push users toward the App Store, app sandbox, and hardware-backed encryption when a passcode is set. That does not mean "unhackable" – it means everyday malware volume is lower; targeted spyware and phishing still matter.
Blue hardening:
- Keep iOS updated – Settings → General → Software Update
- Strong device passcode (not
000000); prefer Face ID / Touch ID with a real passcode fallback - iCloud Find My + Activation Lock awareness for lost devices
- Review app permissions (Camera, Mic, Photos, Local Network)
- Avoid unsupervised configuration profiles from random links
- Know Lockdown Mode exists (iOS 16+) for people at elevated risk of mercenary spyware – optional, extreme, reduces features
Apple documents Lockdown Mode as protection for a very small set of users who may be personally targeted by sophisticated threats (mercenary spyware class). Most students / SME staff do not need it daily – but SOC / journalist / activist awareness interview question is fair. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Phishes Apple ID; steals iCloud session | MFA on Apple ID; revoke sessions; passkey / trusted devices review |
| Tricks install of malicious profile / MDM | Avoid unknown profiles; supervised devices via real IT only |
| Uses rare zero-click against high-value targets | Updates; Lockdown Mode if risk profile fits; specialist IR |
Ravindra Bagale's Tip
Students "iPhone = never hacked" mhantat. Account takeover + phishing + rare spyware still real. Interview: sandbox + App Store + Lockdown Mode awareness – without claiming magic immunity. Ghabru naka.
Lab
On OWN iPhone / iOS Simulator notes (or paper walkthrough): list where to check Software Update, Screen Time app limits, and Privacy → Microphone. Write 5-line Lockdown Mode "when to consider" memo for owner Rani (journalist cousin story – fictional). No stalkerware tools.
Real incident: Apple Lockdown Mode rationale (2022)
In July 2022, Apple announced Lockdown Mode (shipping with iOS 16 / iPadOS 16 / macOS Ventura) as an optional, extreme hardening mode for users who may be personally targeted by sophisticated mercenary spyware. Apple's own newsroom and support pages describe reduced attack surface: limits on message attachments, complex web technologies, FaceTime invitations from unknowns, wired connections while locked, and blocking new configuration-profile / MDM enrollment while the mode is on. Lesson: vendors now ship defence modes aimed at rare high-risk users – Blue should know the control exists and when it is (and is not) appropriate. Source: Apple Newsroom "Apple expands commitment to protect users from mercenary spyware" (2022); Apple Support "About Lockdown Mode" (verify).