Can you steal $10,000 from a locked iPhone?
MKBHD and cybersecurity researchers demonstrate how to steal $10,000 from a locked iPhone using a sophisticated man-in-the-middle NFC attack. The hack exploits vulnerabilities in Apple's Express Transit Mode combined with Visa's payment verification system, and has been publicly known since 2021 but remains unfixed.
Summary
The video demonstrates a sophisticated cybersecurity attack where researchers successfully steal $10,000 from MKBHD's locked iPhone without him ever unlocking it or authorizing the transaction. The hack was developed by University of Surrey professors and works through a man-in-the-middle attack using NFC devices. The attack specifically targets iPhones with Visa cards in Express Transit Mode, exploiting three key vulnerabilities. First, they trick the phone into thinking it's communicating with a transit terminal by broadcasting the appropriate code, bypassing the lock screen. Second, they modify transaction data to make a $10,000 charge appear as a low-value transaction, avoiding customer verification requirements. Third, they alter the response to make the card reader believe the customer has verified the payment. The hack requires specific equipment including a Proxmark NFC device, laptop with Python scripts, and a burner phone, but the underlying vulnerability has been public knowledge since 2021. Apple points to this being a Visa system issue, while Visa argues the attack is unlikely to scale in the real world and that their zero liability policy protects customers. However, the researchers and narrator argue that technical prevention would be better than after-the-fact refunds, comparing it to airline safety standards where crashes are prevented rather than just compensated.
Key Insights
- The hack exploits Apple's Express Transit Mode by broadcasting a code that makes the phone think it's communicating with a subway terminal, bypassing the lock screen entirely
- The attack works by flipping specific bits in transaction data - changing a 0 to 1 to make the phone think it's a transit transaction, and another bit to make $10,000 appear as a low-value transaction
- The vulnerability specifically requires an iPhone with a Visa card, as Samsung phones only accept $0 transit transactions and MasterCard uses additional asymmetric cryptography that would detect the tampering
- This cybersecurity vulnerability has been publicly known since 2021, yet both Apple and Visa have chosen not to implement technical fixes, with Apple saying it's Visa's problem and Visa arguing it's unlikely to scale
- Visa's representative argues that fraud represents only 2 cents per $100 of in-person transactions and that their zero liability policy adequately protects customers rather than implementing technical prevention
Topics
Transcript
[0:00] - I'm here with MKBHD, and we're gonna try to steal $10,000 from his locked iPhone. - Really hope it doesn't work. Really hope it doesn't work. - I'm gonna get you to put that phone down on top of this device. - [Marques] Okay. - Just put it down there. - Just put it on like a, all right. - I feel like I'm a bit of a magician, but I'm like- - Yeah. - I haven't changed anything, right? - Okay. Yeah. - It's still locked. - It's locked. - Nothing else. - Yeah. - This is just a regular payment terminal. - Yeah. - Nothing weird about that. - Seen these. - And we'll start with…
Full transcript available for MurmurCast members
Sign Up to AccessMore from Veritasium
Why does this place get the most Total Solar Eclipses?
A deep dive into total solar eclipses featuring NASA observations during Spain's 2026 eclipse, explaining why the Northern Hemisphere experiences more total eclipses, the physics of eclipse phenomena like shadow bands and Bailey's beads, and the historical discovery of helium through eclipse observations.
How do submarines know where they are?
Submarines cannot use GPS underwater because radio waves are absorbed by seawater. Instead, they navigate using sonar mapping, fiber optic gyroscopes to determine orientation, and accelerometers to measure movement and distance traveled.
Can you actually swing from spider silk?
Spider silk is stronger than steel by weight and tougher than Kevlar due to its unique combination of rigid nanocrystals and stretchy amorphous regions. Scientists have successfully created transgenic silkworms that produce spider silk proteins, enabling the first-ever swing from artificial spider silk, though the material's thinness creates practical challenges.
How much LSD should you give an elephant?
The video explores why drug dosage doesn't scale linearly with animal mass, using the tragic case of Tusco the elephant to introduce scaling laws in biology. It explains Kleiber's law (metabolic rate scales as mass^3/4), the WBE theory that explains this through fractal network geometry, and how similar scaling principles apply to cities and human lifespans.
The Most Controversial Thought Experiment In Physics
This transcript explains Schrödinger's Cat, a famous quantum mechanics thought experiment where a cat in a sealed box exists in a superposition of being both alive and dead simultaneously until the box is opened and measured. The experiment illustrates the counterintuitive nature of quantum superposition when scaled up to macroscopic objects.