Abstract:
Apple's "Lockdown Mode" for high-risk users has always been regarded as one of the strongest security protection mechanisms for the iPhone, but the latest demonstration shows that even if this mode is enabled, the device may still be jailbroken.
After successfully jailbreaking the iPhone Duo on the first day of sale not long ago, the security research team Calif once again announced new research results. This time, the team showed how an iPhone 18 Pro with lock mode enabled was successfully jailbroken, and the jailbreak status was still retained after the system was updated.
According to the video released by the team, the researchers first completed the jailbreak on the iPhone 18 Pro with locked mode turned on, and then installed the iOS 27.2 update for the device. After the update, the device remains jailbroken and has not been automatically removed due to system upgrades. This means that the attack chain it exploits has strong persistence. However, it is unclear whether this jailbreak method can be directly applied to devices already running iOS 27.2.
Lockdown Mode is a security feature designed by Apple specifically for users who may be targets of advanced spyware attacks. Apple describes this as an "extreme protection" mechanism. When enabled, the system will close or limit a large number of potential attack surfaces, including blocking most message attachment types, restricting some web technologies, intercepting FaceTime calls from strangers, disabling some Apple service invitation functions, and removing location information from photos.
Judging from the video released by Calif, the researchers triggered the jailbreak process by sending a malicious PDF file to the target device. The file is transferred to the target iPhone using AirDrop, and the attack is launched after the user accepts the file. However, the team has not disclosed specific technical details, so the outside world is still unable to confirm the type of vulnerability it exploits and the complete attack path.
This demonstration also triggered discussions about the protection capabilities of lock mode. Just earlier this year, Apple told the media that the company was not aware of any successful commercial spyware attacks on iPhones with Lockdown Mode enabled. This public display shows that even Apple’s most stringent security protection mechanism is not absolutely impossible to break through.
It is worth noting that Calif has previously stated that they are submitting relevant vulnerability information to Apple in accordance with the principle of responsible disclosure and have no intention of releasing directly usable jailbreak tools to ordinary users. Therefore, this research is currently regarded more as a security research result rather than a jailbreak solution that will soon be available to the public.
Just a few weeks ago, Calif demonstrated jailbreak results for iPhone Duo and iPhone 18 Pro. Some of these jailbreaks can even retain access after the device is restarted, showing that the research team has made significant progress in researching the security mechanism of the latest version of iOS.
As Apple continues to strengthen the iOS security system, and security researchers continue to look for new breakthroughs, the offensive and defensive competition between the two parties around mobile device security continues. This demonstration of being able to bypass the lock mode and maintain the jailbreak state after system updates once again highlights the importance of advanced security research in discovering potential system weaknesses.
Comments