How easy is it to steal $10,000 from a locked phone?

Overview

This episode explores the vulnerabilities of Tap to Pay systems, demonstrating how a sophisticated hack can bypass security measures to steal money from locked iPhones. Using a combination of cybersecurity techniques, the team reveals how Express Transit Mode and Visa's verification process create a loophole that allows unauthorized high-value transactions.

Notable Quotes

- I never unlock my phone. I never put in a password. I never did what I would normally do to verify a transaction on my phone. It just happened to be on top of that. - Marques Brownlee, on the unsettling ease of the hack.

- Imagine waking up to see $10,000 gone from your account. Even if the refund does come, the stress before is gonna be very real. - Henry van Dyck, on the real-world implications of this vulnerability.

- You can stop it by turning transit mode off—or not have a Visa card in transit mode on an Apple. - Professor Ioana Boureanu, offering a practical solution to prevent the hack.

🪄 Demonstrating the Hack

- Henry van Dyck and Marques Brownlee test whether $10,000 can be stolen from a locked iPhone using Tap to Pay.

- The hack exploits Express Transit Mode, allowing transactions without unlocking the phone.

- A man-in-the-middle attack intercepts and modifies transaction data to bypass security layers.

🔐 How the Hack Works

- The hack uses a Proxmark NFC device to mimic a transit terminal, tricking the phone into initiating payments.

- Three lies are told to bypass security:

- Fooling the phone into thinking it’s interacting with a transit terminal.

- Labeling high-value transactions as low-value to avoid customer verification.

- Convincing the reader that customer verification has occurred.

- Visa’s lack of asymmetric cryptography checks in certain scenarios enables the hack.

🚇 The Role of Express Transit Mode

- Apple’s Express Transit Mode allows payments without unlocking the phone for convenience in public transit.

- Hackers abuse this feature by mimicking transit terminals to initiate unauthorized transactions.

- The vulnerability is specific to iPhones with Visa cards in transit mode.

💳 Visa’s Security Loophole

- Unlike MasterCard, Visa doesn’t always require asymmetric cryptography between the card and reader, leaving transaction data vulnerable to tampering.

- Visa argues the hack is unlikely to scale in real-world scenarios and emphasizes its zero liability policy for cardholders.

- Critics, including Henry van Dyck, question why Visa hasn’t implemented technical changes to eliminate the vulnerability entirely.

🛡️ Preventing the Hack

- Practical advice includes disabling Express Transit Mode or avoiding Visa cards in transit mode on iPhones.

- Apple and Visa have been aware of the vulnerability since 2021 but have not made significant changes to address it.

- The episode highlights the importance of proactive security measures over reactive refund policies.