The phone on our leadership team

“Is this the kind of thing I should care about, or the kind of thing you care about?”

That was one of our co-founders, Thursday evening, replying to a message I’d sent the leadership channel with a link to Citizen Lab’s write-up and the words “please update your phones tonight”. It was a fair question, and my honest answer was “mostly the second, but tonight, the first”, because they were flying to a conference overseas at 7 the next morning.

What was in the news

Citizen Lab found an exploit chain on the iPhone of someone working at a civil society organization in Washington, DC, and attributed it to NSO Group, the company behind Pegasus. They’re calling it BLASTPASS. It worked against iOS 16.6, the current version at the time, and it was zero-click: the attacker sends an iMessage with a PassKit attachment containing malicious images, and the phone gets compromised without the owner doing anything at all, not even opening the message. Apple shipped iOS 16.6.1 the same day, fixing two CVEs (CVE-2023-41064 in the image handling and CVE-2023-41061 in Wallet).

The other detail in the write-up that mattered to me was a single sentence: Lockdown Mode blocks this particular attack. Apple’s security team confirmed that to them.

I want to be clear about the threat model, because it’d be easy to read this post as me thinking NSO is after a SaaS startup. I don’t. Exploits like this are sold to governments, cost a fortune per use, and get burned the moment someone like Citizen Lab finds them, which is why they get pointed at journalists, activists and dissidents. Nobody is spending one on our sales pipeline. But once a chain like this is patched and written up, the window between “only a government can do this” and “a commodity version exists for older iOS” isn’t something I’d bet on, and a phone that’s two updates behind is a phone that’s exposed to whatever comes next, not just this one.

Thursday night

Seven people are on the leadership team. I asked everyone to reply with their iOS version, which is the cheapest audit there is. Five were updated within an hour. One is on Android and pointed that out, with a little more pleasure than necessary. The co-founder who was traveling was on 16.5.1, because their phone had been asking to update for weeks and they’d been tapping “Later”. 16.6 had come out in July, so they were two releases behind going onto an international flight.

Their update took about twenty minutes on their home Wi-Fi, and then we talked about Lockdown Mode.

Lockdown Mode, for someone who isn’t a target

Apple added Lockdown Mode in iOS 16 last year, and it’s explicitly for the very small number of people who might be personally targeted. It turns off a lot of attack surface: most message attachment types other than images are blocked, link previews in Messages go away, some web technologies (just-in-time JavaScript compilation, among others) are disabled unless you exclude a site, FaceTime calls from people you haven’t called before are blocked, and wired connections to computers and accessories are blocked while the phone is locked.

It also does something that matters for a company: while Lockdown Mode is on, the device can’t install configuration profiles or enroll in MDM. Phones that were already enrolled stay enrolled, as far as I can tell from Apple’s documentation, but it’s a strong sign of who Apple thinks the feature is for, and it isn’t the IT department.

We decided our co-founder would turn it on for the trip. They’re not a target. But the downside for the length of a conference is small (some link previews and a couple of websites that misbehave), and the trip is exactly when you’re on unfamiliar Wi-Fi, talking to people you’ve just met who are sending you things. It was on before midnight. The first thing they texted me from the conference was that a restaurant’s menu site wouldn’t load properly, which I’ll take as a sign it was working.

The travel policy we didn’t have

The bigger gap was on paper. We had a policy for laptops, with full-disk encryption and our endpoint agent both enforced through MDM. We had nothing for phones, because phones are personal devices with a work Slack and email on them, and we’d never wanted to manage them. We had nothing about travel either, beyond the expense policy.

So this week I wrote a page. It says that anyone traveling internationally for work updates their phone and laptop before they leave, and keeps them updated while they’re away (meaning: don’t tap “Later” for a week). For leadership and anyone with admin rights to production, Lockdown Mode is recommended for the trip, not required, and they get a short explanation of what it breaks. For a few destinations, where we’d assume devices might be inspected at the border, there’s a loaner laptop with nothing on it but a browser and our SSO, and we’d rather people not take their personal phone with work accounts at all. It’s a page and a half. It took longer to agree on than to write.

What I can’t make my mind up about is the everyday version. The traveling co-founder is home on Friday, and the obvious question is whether Lockdown Mode should stay on, and whether it should be on for all seven of us all the time. My instinct says no: most of us aren’t targets, and a security setting that makes your phone annoying is one people quietly switch off. But the case for it is the same case I made on Thursday night, which is that we don’t get to choose when we become interesting, and the cost is mostly broken link previews. I’ve also noticed that I haven’t turned it on my own phone, which probably tells you how I really feel about it.