[whitepoplar]

How much do you think Lockdown Mode + MIE/eMTE helps? Do you believe state actors work with manufacturers to find/introduce new attack vectors?

[walterbell]

My iOS devices have been repeatedly breached over the last few years, even with Lockdown mode and restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator. Since moving to 2025 iPad Pro with MIE/eMTE and Apple (not Broadcom & Qualcomm) radio basebands, it has been relatively peaceful. Until the last couple of weeks, maybe due to leakage of this zero day and PoC as iOS 26.3 was being tested.

[FireBeyond]

> restrictive (no iCloud, Siri, Facetime, AirDrop ) MDM policy via Apple Configurator

MDM? That doesn't surprise me. Do you want to know how _utterly_ trivial MDM is to bypass on Apple Silicon? This is the way I've done it multiple times (and I suspect there are others):

Monterey USB installer (or Configurator + IPSW)

Begin installation.

At the point of the reboot mid-installation, remove Internet access, or, more specifically, make sure the Mac cannot DNS resolve: iprofiles.apple.com, mdmenrollment.apple.com, deviceenrollment.apple.com.

Continue installation and complete.

Add 0.0.0.0 entries for these three hostnames to /etc/hosts (or just keep the above "null routed" at your DNS server/router.

Tada. That's it. I wish there was more to it.

You can now upgrade your Mac all the way to Tahoe 26.3 without complaint, problem, or it ever phoning home. Everything works. iCloud. Find My. It seems that the MDM enrollment check is only ever done at one point during install and then forgotten about.

Caveat: I didn't experiment too much, but it seems that some newer versions of macOS require some internet access to complete installation, for this reason or others, but I didn't even bother to validate, since I had a repeatable and tested solution.

[whitepoplar]

Are you a person of high interest? I was under the impression that these sorts of breaches only happen to journalists, state officials, etc.

[UqWBcuFx6NV4r]

Just to save everyone the read, reading through the replies, this person is very clearly paranoid and has no clear evidence of an actual breach. I have zero idea why people are actually engaging with this.

[j45]

It appears the iPhone Air and iPhone 16e are the only devices with the Apple radio basebands so far.

https://theapplewiki.com/wiki/C4000

[drakenot]

How can you tell that you were breached?

[Melatonic]

I don't think that proves they've been breached. Are you sure your not just seeing keep alive traffic or something random you haven't taken into account ?

[commandersaki]

How did you identify you were breached. Were they known attacks and would you be willing to elaborate which ones?

[drnick1]

Sounds like it is time to drop Apple devices and move to Graphene.

[8cvor6j844qw_d6]

> Do you believe state actors work with manufacturers to find/introduce new attack vectors?

Guaranteed. I find it hard to believe state actors will not attempt this.

Flash paper is king when it comes to secrets I guess.

[saagarjha]

They might but it’s currently easier to just find exploits.