Cybersecurity researchers from the University of Surrey and the University of Birmingham developed the attack to bypass an iPhone’s locked status and steal funds from a mobile wallet. The exploit was first publicized in 2021, and it bypasses traditional limits on transaction size. Veritasium demonstrated the attack by collecting $10,000 from YouTuber Marques Brownlee’s locked iPhone.
The attack works using an NFC card reader that intercepts the communication between an iPhone and a tap-to-pay terminal when a payment is made. The card reader is connected to a laptop that collects payment data and sends it to a separate burner phone, which is then tapped on a legitimate card reader. The NFC device has to be tuned to the same transit terminal identifier as a legitimate transit reader.
The process requires the victim to have Express Transit Mode enabled for payments, and a Visa card linked for those payments, among other steps. As it turns out, it’s a Visa-related security loophole rather than an iPhone issue, and it doesn’t work with a Mastercard or an American Express card because other cards use different security methods. It also doesn’t work with Samsung Pay on Samsung devices, and it requires the specific combination of a Visa card and an iPhone. Apple told Veritasium that it’s an issue with the Visa system, but something unlikely to occur in the real world.
This is a concern with the Visa system, but Visa does not believe this kind of fraud is likely to take place in the real world. Visa has made it clear that their cardholders are protected by Visa’s zero liability policy.
Visa also told Veritasium that the exploit was very unlikely from a scaled real world setting, and any such transactions can be disputed. The researchers who shared the exploit said users can protect themselves by not using a Visa card on the iPhone for transit purposes.
This article, “Here’s How Researchers Stole $10,000 From MKBHD’s Locked iPhone” first appeared on MacRumors.com
Discuss this article in our forums