Researchers point out that Apple's walled garden approach on iOS makes it virtually impossible to detect the presence of malware on iPhones, which does exist
The iPhone's locked-down approach to security is spreading, but advanced hackers have found that higher barriers are great for avoiding capture.
Context & Ripple Effects
This story is the latest turn in a long-running researcher critique of Apple's security model. Back in 2016, a researcher documented how Apple merely blacklisted programs exploiting the Gatekeeper vulnerability rather than fixing the underlying cause (blacklisting Gatekeeper exploits instead of patching them) — an early sign that the company's response to threats favored control over transparency.
By 2019, several security researchers were saying iOS controls made it effectively impossible to analyze whether an iPhone was compromised without jailbreaking it first (iOS too locked down to analyze without jailbreaking). The MIT Technology Review piece extends that argument: the same walls that keep casual attackers out also shield sophisticated malware from detection, so the platform's defenders can't see what its attackers can.
First-order effects
- Security researchers lose their primary window into iOS compromises: without jailbreaking, they cannot verify infections, which leaves victims of advanced spyware with no way to confirm they are compromised.
- Apple faces a growing credibility gap between its marketing of iOS as the secure platform and researchers' evidence that real malware exists there undetected.
Second-order effects
- Spyware operators gain asymmetric advantage: as later researcher calls for Apple and Google to open system internals to catch Pegasus-like attacks in real time make clear (researchers urging more access to catch Pegasus-like spyware), closed platforms let well-resourced attackers operate below the visibility threshold available to defenders.
- Pressure builds for regulators and enterprise buyers to weigh verifiability alongside security when assessing mobile platforms, since customers cannot independently audit devices they depend on.
Third-order effects
- If the pattern holds, mobile security splits into two tiers: platforms whose opacity protects users from common threats but also protects advanced attackers from discovery, forcing defenders toward side-channel detection techniques rather than on-device forensics.
- Sustained researcher pressure around iOS and Android data-access issues points toward structural demands that platform vendors expose auditable system internals — a governance question about who gets to verify a device's integrity, not just who builds it.
The trend: Mobile platforms are converging on locked-down architectures whose opacity increasingly serves sophisticated attackers as much as it protects ordinary users, pushing the security debate from features toward auditability.