Private Orchards

iPhone Lockdown Mode: What It Blocks and What Breaks

Calif showed a new iPhone jailbreak at Hexacon. How message attacks reach an iPhone, who needs Lockdown Mode, what it turns off, and the USB setting to check.

Lockdown Mode Diagram of Lockdown Mode as a shield blocking zero-click, one-click, and cable attack paths on an iPhone. Lockdown Mode Zero-click One-click Cable Lockdown Mode Extreme protection iPhone

On October 16, at the Hexacon security conference in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1, live on stage. Hours later it posted clips teasing a “Signal 1-click” attack and an iMessage one, with a single line: “Everything will be released in due time.”

Update: iOS 27.2, released October 26, is the update to install. Apple’s iOS 27.2 security notes credit Calif researchers on six fixes, and Calif’s Stefan Esser has said most of the bugs in the jailbreak are fixed in 27.2. Most isn’t all: Apple doesn’t say which fixes belong to the demo chain, and the Signal and iMessage attacks aren’t public yet, so we can’t confirm every piece is closed. Update today, and keep the settings below in place. It’s a good time to learn how these attacks get in, and which settings close the doors.

Checked against iOS 27.2: Apple’s iOS 27.2 security notes, support pages and Platform Security Guide, Calif’s posts and statements, Hexacon’s program, Citizen Lab and Signal. Updated October 27, 2026.

The basics, in four lines

  • Updates on automatic: Settings → General → Software Update → Automatic Updates, plus Background Security Improvements in Settings → Privacy & Security.
  • Check today: Wired Accessories in Settings → Privacy & Security. Ask for New Accessories suits most people.
  • Likely target? Turn on Lockdown Mode, with few exclusions.
  • Update to iOS 27.2 now: Settings → General → Software Update. It fixes most of the jailbreak’s bugs. If Apple ships more fixes after Calif publishes, install those the same day.

How a message becomes a hack

  • Zero-click: a booby-trapped message hacks the phone with no tap at all. Citizen Lab caught one, BLASTPASS, in 2023.
  • One-click: you tap one link or file. Calif’s Signal demo is labeled 1-click.
  • The cable: a charging port is also a data port. More on that below.

Apple screens incoming iMessage data in a sandbox called BlastDoor, so an attacker needs one bug to get in and more to break out. That’s why these attacks come as chains.

Message protection layers Diagram comparing zero-click and one-click message attacks, with BlastDoor isolating, parsing, transcoding, and validating untrusted data. How a message becomes a hack Zero-click Nothing to tap FORCEDENTRY “.gif” files that were PDFs BLASTPASS PassKit attachments One-click You tap one thing Signal 1-click Calif demo, Oct 2026 Details not public yet. For iMessage: BlastDoor handles untrusted data Incoming iMessage BlastDoor isolates · parses transcodes · validates iPhone A sandbox adds a layer of defense; attack chains may need more than one bug.
Zero-click needs no tap and one-click needs one. BlastDoor sits only in the iMessage path, so an attacker has to get in and then break out.

Defense 1: updates, on automatic

  • Settings → General → Software Update → Automatic Updates, turn on Automatically Install.
  • Settings → Privacy & Security → Background Security Improvements, keep Automatically Install on. These are small patches for Safari, WebKit and system libraries between full updates.

Updates fix a bug for everyone. Lockdown Mode is for the bugs nobody has fixed yet.

Defense 2: Lockdown Mode

Who needs it

Apple calls it “extreme protection” for “the very few individuals who, because of who they are or what they do, might be personally targeted.” Its threat notification page says these attacks “cost millions of dollars” and target people who are “often journalists, activists, politicians, and diplomats.”

Turn it on if:

  • You got an Apple Threat Notification on your Lock Screen, in Settings or by email. Apple recommends Lockdown Mode and points to Access Now’s Digital Security Helpline.
  • Your work is worth that kind of money to someone: sensitive sources, activism, legal work on those cases, public office.

Most people don’t, and it has a cost.

Turn it on, and what it blocks

Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then Turn On & Restart and enter your passcode. Your paired Apple Watch turns on with it. iPad and Mac need it separately.

Per Apple, it:

  • Messages: blocks most attachments “other than certain images, video, and audio.” Links and link previews are unavailable.
  • Safari: blocks “certain complex web technologies.”
  • FaceTime: blocks incoming calls unless you’ve called that person in the past 30 days.
  • Invitations: blocks invites to Apple services, like managing a home, unless you invited that person first.
  • Photos: strips location when you share. Shared albums disappear, and new invites are blocked.
  • Cables: the iPhone must be unlocked to connect to an accessory or computer.
  • Networks: no auto-joining non-secure Wi-Fi, and 2G and 3G are off.
  • Profiles: no new configuration profiles or MDM enrollment. A phone already enrolled “remains managed.”
What Lockdown Mode blocksChecklist of restrictions for Messages, Safari, FaceTime, invitations, Photos, cables, networks and profiles. What Lockdown Mode blocks Protection with practical tradeoffs MessagesMost attachments; no linksor link previews. SafariCertain complex web technologiesare restricted. FaceTimeIncoming calls limited unlessyou called in the past 30 days. InvitationsApple-service invites limitedunless you invited first. PhotosLocation stripped when sharing;shared albums disappear. CablesUnlock to connect an accessoryor computer. NetworksNo auto-join of non-secure Wi-Fi;2G and 3G are off. ProfilesNo new profiles or MDM enrollment.Existing enrollment remains managed.
Each restriction above closes one route in, and each one costs a little everyday convenience.

The OSINT win: strangers lose easy ways in. No FaceTime from new numbers, no surprise album invites, no location in the photos you send.

Does it stop Calif’s demos? Nobody outside Calif knows yet. In 2023, Apple’s security team confirmed to Citizen Lab that Lockdown Mode blocked BLASTPASS.

Lockdown Mode gets fixes too. iOS 27.2 closes a WebKit bug that let a website use a media format Lockdown Mode should restrict, so it works best on the latest iOS. Keep it on, and keep updating.

What breaks

  • Some websites load slowly or look off, with missing fonts or images.
  • Shared albums vanish from Photos (they still show on devices without it).
  • FaceTime from new people doesn’t come through, and SharePlay and Live Photos are off.
  • Game Center is disabled, and Focus status won’t work as expected.
  • Calls won’t ring on your Apple Watch.

Phone calls, plain texts and Emergency SOS still work.

Exclusions, and what each one costs

Apple warns that excluding something “reduces Lockdown Mode’s protections and may increase your security risk.”

  • A website: in Safari, tap the Page Menu button, then Website Settings, and turn off Lockdown Mode. The list lives in Settings → Privacy & Security → Lockdown Mode → Customize Web Sites.
  • An app: on that same Customize Web Sites screen, turn off the app. That lifts web content limits for that app. Apps appear only after you’ve opened them with Lockdown Mode on.
  • A contact (new in iOS 27): Customize Contacts → Add Contact removes messaging limits for one person. If their number or email changes, limits return and you’re notified. Remember BLASTPASS came from an iMessage account. A trusted contact’s account can be stolen.

Defense 3: the Wired Accessories setting

Everyone should check this one. Settings → Privacy & Security, scroll to Security, tap Wired Accessories. On a USB-C iPhone:

  • Always Ask: approve every accessory, every time.
  • Ask for New Accessories: approve each new one once.
  • Automatically Allow When Unlocked: the default.
  • Always Allow: skip this one.
Wired AccessoriesDiagram of the four Wired Accessories options, recommending Ask for New Accessories for most people and Always Ask if using Lockdown Mode. Wired Accessories Settings → Privacy & Security → Wired Accessories Always AskApprove every accessory, every time. Ask for New AccessoriesApprove each new one once.RIGHT TRADE FOR MOST PEOPLE Automatically Allow When UnlockedThe default. Always AllowSkip this one. Using Lockdown Mode? Pick Always Ask. Lightning iPhones only get the last two options. A USB power adapter charges either way.
The four Wired Accessories options on a USB-C iPhone. Ask for New Accessories suits most people, and Always Ask suits anyone using Lockdown Mode.

Lightning iPhones only get the last two. A USB power adapter charges either way. For most people, Ask for New Accessories is the right trade. If you’d turn on Lockdown Mode, pick Always Ask.

New to all this? Start with the Basics.

All posts · RSS feed