How easy is it to steal $10,000 from a locked phone?

Veritasium

6 chapters7 takeaways11 key terms5 questions

Overview

This video demonstrates a sophisticated hack that allows for the theft of funds from a locked iPhone using a combination of specific phone and card types, exploiting vulnerabilities in contactless payment systems. Cybersecurity experts explain how a man-in-the-middle attack, combined with manipulating transaction data, can bypass security layers like Express Transit Mode and customer verification, enabling large sums to be transferred without the owner's explicit unlock or approval. The video highlights the roles of Apple and Visa in this vulnerability, their responses, and the broader implications for consumer security and trust in digital payments.

How was this?

Save this permanently with flashcards, quizzes, and AI chat

Chapters

A locked iPhone can be used to authorize payments without unlocking it.
The demonstration starts with a small $5 transaction, which is approved despite the phone being locked.
The hack is scaled up to $10,000, which is also successfully transferred from the locked phone.
The owner of the phone did not perform any unlock or verification steps for these transactions.

This chapter immediately establishes the core problem: a seemingly secure device can be compromised to steal money, raising immediate concerns about personal financial security.

A $10,000 payment is authorized and transferred from a locked iPhone to a payment terminal.

The hack involves a 'man-in-the-middle' attack where devices intercept and alter communication between the phone and the payment reader.
The first layer of defense bypassed is the phone's lock screen, achieved by tricking the phone into thinking it's interacting with a transit terminal using a specific code.
This bypass leverages Apple's 'Express Transit Mode,' which allows payments without unlocking.
The phone is fooled into believing it's a transit transaction, allowing it to process payments without requiring the usual unlock or verification.

Understanding the technical steps reveals the specific vulnerabilities exploited, moving beyond the 'magic' to the underlying mechanisms that enable the attack.

Using a Proxmark device to broadcast a code that mimics a transit terminal, tricking the iPhone into thinking it's in Express Transit Mode.

A second layer of defense, customer verification for high-value transactions, is bypassed.
The hack tricks the phone into classifying a large sum ($10,000) as a low-value transaction by altering a single bit of data.
This manipulation prevents the phone from requesting a PIN, fingerprint, or facial recognition.
The phone is convinced the transaction is low-value, allowing it to proceed without further user authentication.

This explains how the hack overcomes the system's safeguards against large, unauthorized purchases, demonstrating a critical flaw in how transaction values are interpreted.

Modifying a data bit from '1' (high value) to '0' (low value) in the transaction data to bypass customer verification for a $10,000 payment.

The third lie convinces the payment reader that the transaction has been verified by the customer.
The phone's response, indicating no customer verification was performed, is intercepted and altered.
A bit is flipped from '0' (not verified) to '1' (verified) in the response data.
This final manipulation ensures the reader forwards the transaction to the bank for approval, completing the fraudulent transfer.

This chapter details the final step in deceiving the payment network, showing how even the reader can be tricked into authorizing a fraudulent transaction.

Changing the data indicating 'customer verification not done' to 'customer verification done' in the communication between the phone and the reader.

The hack specifically requires an iPhone combined with a Visa card set up for Express Transit Mode.
iPhones, unlike some other phones (e.g., Samsung), do not re-verify the transaction amount when in transit mode.
Visa's transaction verification process, particularly the absence of mandatory asymmetric cryptography for online transactions, is crucial.
MasterCard's stricter verification protocols would prevent this specific hack.

This explains why this hack isn't universally applicable, pinpointing the exact combination of technologies that creates the loophole, which is essential for understanding the scope of the risk.

An iPhone with a Visa card in the transit slot, which by default enables Express Transit Mode, is susceptible.

Apple points to Visa as the source of the vulnerability, while Visa considers the fraud unlikely and offers zero liability protection.
Both companies state that while the hack is technically possible, it's unlikely to occur on a large scale in the real world.
The lack of mandatory encryption for certain transaction data makes tampering possible.
While refunds are offered, the stress and inconvenience of disputing fraudulent charges remain a concern for consumers.

This chapter addresses the critical question of who is responsible for fixing the vulnerability and what recourse consumers have, highlighting the ongoing debate about security versus convenience.

Visa's statement that cardholders are protected by their zero liability policy, implying that even if fraud occurs, the consumer will be refunded.

Key takeaways

1A locked iPhone can be tricked into authorizing payments using a man-in-the-middle attack that exploits Express Transit Mode.
2The hack bypasses multiple security layers, including the phone's lock screen and high-value transaction verification, by manipulating transaction data.
3The specific vulnerability relies on a combination of an iPhone, a Visa card, and the default settings of Express Transit Mode.
4While technically possible, Apple and Visa downplay the real-world likelihood of this fraud, emphasizing consumer protection policies.
5The lack of end-to-end encryption in certain parts of the contactless payment communication allows for data tampering.
6Consumers can mitigate this specific risk by disabling Express Transit Mode or ensuring a non-Visa card is used in that slot.
7The debate continues on whether consumer protection policies are sufficient or if technical fixes are needed to prevent such vulnerabilities entirely.

Key terms

Man-in-the-middle attackNFC (Near Field Communication)ProxmarkExpress Transit ModeContactless paymentHigh-value transactionLow-value transactionCustomer verificationAsymmetric cryptographySymmetric cryptographyZero liability policy

Test your understanding

1How does a man-in-the-middle attack enable unauthorized payments from a locked iPhone?
2What specific feature on iPhones is exploited to bypass the lock screen for payments, and why?
3Explain the two main lies told to the phone and the one lie told to the reader to successfully execute this hack.
4What combination of phone, card type, and payment mode is necessary for this particular hack to work, and why?
5What are the stated responses from Apple and Visa regarding this vulnerability, and what are the implications for consumers?