For what in particular? You can read about Pegasus [0], although that page doesn't even remotely deal full justice to the extent of how widely it's deployed (e.g. basically all Russian opposition was/is tapped with it and somehow it doesn't even mention this). LEA of a lot of countries have some way to break into locked iPhones, such as Cellebrite's tools [1] or GrayKey [2]. I mean, even the popular US body cam channels on YouTube casually mention unlocking perpetrator's iPhone using the "forensics methods available to the police" like it's no big deal.
Operation Triangulation [3-8] had two separate attack chains, one of which is redundant, implying it's here just because it's a part of a bigger modular suite and the attacker can waste decades old 0-days just like that, having a ton more in reserve, and also something that looks awfully like an intentional hardware backdoor. What's fascinating about this attack is that it should have obliterated any vendor's reputation as being highly secure or government-resistant, yet we still have people thinking iOS is secure, and Apple had worldwide media coverup and multiple credible hardware experts unrelated to either Apple or ARM saying the backdoor is not intentional but more like a "genuinely forgotten debugging feature" (guess how a good backdoor should look like...), see the HN discussion [9] and . Despite Steve Jobs passing away long ago, the reality distortion field around Apple still seems as strong as ever.
Obviously this is just a tip of the iceberg, and how many of these are in the wild or how many backdoors the hardware still has is unknown. I'm sure that with better AI capabilities closed source vendors have many big surprises coming in 2027-2028. The availability of public jailbreaks is unrelated matter, they're necessary to support third-party stores against Apple's will but that's clearly not feasible. Samsung phones didn't have custom ROMs for the same reason, for example.
Operation Triangulation [3-8] had two separate attack chains, one of which is redundant, implying it's here just because it's a part of a bigger modular suite and the attacker can waste decades old 0-days just like that, having a ton more in reserve, and also something that looks awfully like an intentional hardware backdoor. What's fascinating about this attack is that it should have obliterated any vendor's reputation as being highly secure or government-resistant, yet we still have people thinking iOS is secure, and Apple had worldwide media coverup and multiple credible hardware experts unrelated to either Apple or ARM saying the backdoor is not intentional but more like a "genuinely forgotten debugging feature" (guess how a good backdoor should look like...), see the HN discussion [9] and . Despite Steve Jobs passing away long ago, the reality distortion field around Apple still seems as strong as ever.
Obviously this is just a tip of the iceberg, and how many of these are in the wild or how many backdoors the hardware still has is unknown. I'm sure that with better AI capabilities closed source vendors have many big surprises coming in 2027-2028. The availability of public jailbreaks is unrelated matter, they're necessary to support third-party stores against Apple's will but that's clearly not feasible. Samsung phones didn't have custom ROMs for the same reason, for example.
[0] https://en.wikipedia.org/wiki/Pegasus_(spyware)
[1] https://en.wikipedia.org/wiki/Cellebrite_UFED
[2] https://en.wikipedia.org/wiki/Grayshift
[3] https://en.wikipedia.org/wiki/Operation_Triangulation , however I recommend reading OG writeups below because they reveal more pecularities that make this attack special.
[4] https://securelist.com/operation-triangulation/109842/
[5] https://securelist.com/operation-triangulation-catching-wild...
[6] https://securelist.com/triangulation-validators-modules/1108...
[7] https://securelist.com/triangledb-triangulation-implant/1100...
[8] https://securelist.com/operation-triangulation-the-last-hard...
[9] https://news.ycombinator.com/item?id=38783112