Can you steal $10,000 from a locked iPhone?

Quick Overview

A locked iPhone can be used to steal $10,000 by exploiting a vulnerability in Apple Pay's 'Express Transit' mode, which allows transactions to proceed without unlocking the device or requiring biometric authentication. By using a Proxmark device to simulate a transit terminal and a laptop to modify the transaction's data fields, hackers can trick the iPhone into authorizing a high-value purchase as a low-value transit fare, bypassing security protocols.

Key Points: A locked iPhone authorizes a $10,000 transaction by misidentifying a retail payment terminal as a transit reader. Apple Pay's 'Express Transit' mode intentionally bypasses Face ID and passcode requirements to facilitate quick transit fare payments. Attackers use a Proxmark device to broadcast a transit terminal signal, causing the iPhone to enter an insecure transaction state. A custom Python script running on a laptop modifies the transaction data, flipping bits that tell the iPhone the transaction is low-value and transit-related. The attack succeeds because the iPhone does not verify the actual dollar amount of the transaction, only its classification as low or high value. Visa's payment system is susceptible to this exploit because it does not always require the same level of asymmetric cryptographic verification for transit transactions as it does for retail purchases.

Context: The video demonstrates a sophisticated man-in-the-middle attack developed by cybersecurity researchers Ioana Boureanu and Tom Chothia from the University of Surrey and the University of Birmingham. The researchers highlight a flaw in the implementation of contactless payments on iPhones, specifically when using Visa cards, which allows for unauthorized transactions even when the device is locked.

Detailed Analysis

The video details a successful $10,000 theft from a locked iPhone, made possible by a design flaw in Apple Pay's 'Express Transit' feature. By tricking the phone into believing a retail payment terminal is a transit reader, the attack bypasses the need for Face ID or a passcode. The process involves three distinct 'lies' or manipulations: first, the iPhone is convinced it is interacting with a transit terminal; second, the transaction is falsely labeled as a low-value fare; and third, the reader is tricked into believing the customer has already verified the transaction on their device. Because the iPhone does not verify the actual monetary amount of the transaction, it authorizes the payment. This vulnerability is specific to Visa cards, as Mastercard requires more stringent asymmetric cryptographic checks that would detect the data tampering. Visa has stated that such fraud is unlikely in real-world settings and that cardholders are protected by zero-liability policies, yet the researchers emphasize that the underlying technical vulnerability remains unpatched.