Can you steal $10,000 from a locked iPhone?
MKBHD and cybersecurity researchers demonstrate how to steal $10,000 from a locked iPhone using a sophisticated man-in-the-middle NFC attack. The hack exploits vulnerabilities in Apple's Express Transit Mode combined with Visa's payment verification system, and has been publicly known since 2021 but remains unfixed.
Summary
The video demonstrates a sophisticated cybersecurity attack where researchers successfully steal $10,000 from MKBHD's locked iPhone without him ever unlocking it or authorizing the transaction. The hack was developed by University of Surrey professors and works through a man-in-the-middle attack using NFC devices. The attack specifically targets iPhones with Visa cards in Express Transit Mode, exploiting three key vulnerabilities. First, they trick the phone into thinking it's communicating with a transit terminal by broadcasting the appropriate code, bypassing the lock screen. Second, they modify transaction data to make a $10,000 charge appear as a low-value transaction, avoiding customer verification requirements. Third, they alter the response to make the card reader believe the customer has verified the payment. The hack requires specific equipment including a Proxmark NFC device, laptop with Python scripts, and a burner phone, but the underlying vulnerability has been public knowledge since 2021. Apple points to this being a Visa system issue, while Visa argues the attack is unlikely to scale in the real world and that their zero liability policy protects customers. However, the researchers and narrator argue that technical prevention would be better than after-the-fact refunds, comparing it to airline safety standards where crashes are prevented rather than just compensated.
Key Insights
- The hack exploits Apple's Express Transit Mode by broadcasting a code that makes the phone think it's communicating with a subway terminal, bypassing the lock screen entirely
- The attack works by flipping specific bits in transaction data - changing a 0 to 1 to make the phone think it's a transit transaction, and another bit to make $10,000 appear as a low-value transaction
- The vulnerability specifically requires an iPhone with a Visa card, as Samsung phones only accept $0 transit transactions and MasterCard uses additional asymmetric cryptography that would detect the tampering
- This cybersecurity vulnerability has been publicly known since 2021, yet both Apple and Visa have chosen not to implement technical fixes, with Apple saying it's Visa's problem and Visa arguing it's unlikely to scale
- Visa's representative argues that fraud represents only 2 cents per $100 of in-person transactions and that their zero liability policy adequately protects customers rather than implementing technical prevention
Topics
Transcript
[0:00] - I'm here with MKBHD, and we're gonna try to steal $10,000 from his locked iPhone. - Really hope it doesn't work. Really hope it doesn't work. - I'm gonna get you to put that phone down on top of this device. - [Marques] Okay. - Just put it down there. - Just put it on like a, all right. - I feel like I'm a bit of a magician, but I'm like- - Yeah. - I haven't changed anything, right? - Okay. Yeah. - It's still locked. - It's locked. - Nothing else. - Yeah. - This is just a regular payment terminal. - Yeah. - Nothing weird about that. - Seen these. - And we'll start with…
Full transcript available for MurmurCast members
Sign Up to AccessMore from Veritasium
How Dangerous Are Non-Stick Pans?
Non-stick pans present three main concerns: Teflon itself is chemically inert and harmless if ingested, but overheating above 300°C can release harmful fumes; the chemicals used to manufacture the coating (PFAs or 'forever chemicals') are more dangerous and can leak into the environment; and research on whether these manufacturing chemicals end up on pans and their health effects as microplastics remains incomplete.
We're trying something new...
Veritasium launches a new channel called Ingenious focused on social science stories. The first video explores how Malcolm McLean's shipping container invention revolutionized global commerce, starting with his observation of inefficient cargo loading in 1954 and leading to the creation of the SS Ideal X in partnership with engineer Keith Tantinger.
What happens to these balloons when you open the valve?
A demonstration shows that when a valve opens between a large and small balloon, the large balloon gets bigger while the small one gets smaller—counterintuitively because the smaller balloon actually has higher pressure. This occurs because polymer chains in rubber are tangled when the balloon is small and unexpanded, making it stiffer, but relax as the balloon inflates, resulting in lower pressure in larger balloons.
The Insane Real Engineering of the Nazis' Enigma
This video explains how the Enigma encryption machine worked, why it was initially unbreakable, and how British codebreakers at Bletchley Park—led by Alan Turing—developed the Bombe machine to systematically crack Nazi messages by exploiting mathematical principles and human operator errors. The breakthrough intelligence shortened World War II by an estimated two years.
How An Orbit Can Heat A Moon
Europa's eccentric orbit around Jupiter, caused by orbital resonance with Io and Ganymede, results in constant tidal flexing that generates internal heat through friction. This tidal heating mechanism is strong enough to keep Europa's subsurface ocean liquid, with the effect being even more pronounced closer to Jupiter, explaining Io's extreme volcanic activity.