If your iPhone was stolen, how much money could the thief take from your locked phone? The answer is:You can spend as much money as you have in your bank account. Well-known science channels Veritasium(Host Henry) with Tech YouTuber MKBHD（Marques Brownlee） teamed up to conduct a shocking field test, successfully skimming Marques’ Apple Pay while his iPhone remained locked and no password or Face ID was entered. US$10,000 (approximately NT$325,000). And the most astonishing fact is: this Express Transit Mode The vulnerability dates back to It has been publicly revealed in 2021, but it has not been completely patched to this day.
Apple Pay security myth busted! A locked iPhone can still be stolen
What is Express Transit Mode?
Apple launched in 2019 Express Transit Mode, allowing users to deduct money directly by approaching the gate sensor without unlocking their phone or Face ID when taking the subway or bus. This design is to allow commuters to pass quickly when queuing. Many countries directly bind transportation card micropayments to credit cards.
The working mechanism behind it is:The traffic terminal will broadcast a special identification code, after receiving the phone, it knew “this is a traffic gate” and automatically enabled unlock-free payment. This mechanism is the entry point of the entire attack.
Attack principle: three layers of lies + man-in-the-middle attack
Henry and two network security professors from the University of Surrey demonstrated a classic Man-in-the-Middle. The attack device chain is:
Victim’s iPhone → Proxmark (NFC interceptor) → Laptop (Python script to modify data) → Attacker’s mobile phone → Real credit card machine
To successfully complete an attack, three lines of defense must be deceived:
The first lie: Disguising as a traffic terminal (bypassing the lock screen)
Attackers used Proxmark devices to spoof identification codes for London Underground traffic gates. After receiving the signal, the victim’s iPhone thought he was swiping the subway gate, automatically enabled the unlock-free payment mechanism, and waited to receive transaction data.
When the real credit card machine sends transaction data, one of the bits indicates “whether the terminal is offline.” If the traffic terminal cannot receive signals underground, this bit should be 1. But the retail card machine has a network connection, so this bit is 0. The attacker changes this 0 to 1 on the laptop: the phone then thinks it is communicating with the traffic terminal.
The second lie: Forging low-amount tags (bypassing large-amount verification)
Even if the lock screen is bypassed, credit cards have a second layer of protection for contactless payments:“High Amount vs Low Amount” Classification. In the UK, transactions over £100 (approximately NT$4,200) require PIN, fingerprint or Face ID verification.
But the key is: when the mobile phone determines whether the transaction is a “high amount”,What you are looking at is not the actual amount., but abit tag: 1 represents high amount, 0 represents low amount. This design is to allow countries to customize high/low thresholds and communicate uniformly using this label.
As long as the attacker changes this bit from 1 to 0 on the laptop, the phone will think “this is just a small transportation fee of $10”, and no additional user verification is required.
The third lie: Forging verified labels (deceiving credit card machines)
After the mobile phone agrees to the payment, it will send back an “authorized” message to the card machine. But the phone will also honestly mark: “This transaction has not been user verified (no password, no fingerprint, no Face ID).” The card machine saw the $10,000 transaction but did not verify it.Of course I will refuse。
Therefore, the attacker needs to intercept the phone’s reply again in the third step and change the “unverified” bits to “verified”. The card swiping machine feels relieved after receiving it – it thinks that the user has completed the verification on the mobile phone, so it sends the transaction information to the bank, and the bank approves it.$10,000 successfully transferred out。
Why does Visa + iPhone work?
This is not a vulnerability that applies to all iPhones or all credit cards. It requires three conditions to be met at the same time:
- Must be an iPhone: Samsung mobile phones will check the actual amount in transportation mode and only accept transactions of $0 (subsequent accumulation of payment by the transportation provider), and transportation fees of $10,000 will be directly rejected.
- The transportation card slot must contain a Visa card: MasterCard’s transaction process has an extra layerasymmetric cryptography, that is, digital signature verification. The card swiping machine checks whether the signature returned by the mobile phone is consistent with the transaction information.
- The card machine must be online: Because Visa only requires a digital signature when the terminal is offline. The attacker ensures that the card swipe machine is fully connected so that the signature check will not be triggered.
In other words, MasterCard requires digital signature verification in any situation, which will directly block attacks because the signature is generated for “high-value retail transactions” and does not match the “low-value transportation transactions” tampered by the attacker. But Visa only checks the signature when the transaction may be offline. Ironically, the attacker tricked the mobile phone by saying “this is a transportation transaction and the terminal may be offline”, so the mobile phone did send the signature; but because the card machine was actually online,Choose not to check this signature, even if you check it, you will find the problem.
Apple and Visa’s response
When Veritasium asked Apple and Visa why they hadn’t patched it for five years, the response from both parties was a classic “kicking ball”:
- Apple “This is a problem with Visa’s system,” he said, noting that Visa does not believe this type of fraud is likely to occur on a large scale in reality.
- Visa Said: “This vulnerability is relatively a product of a controlled environment, and it is very unlikely that it will occur on a large scale in reality. And if consumers are really affected, they have the right to file a dispute and get a refund.”
Henry accurately countered in the video: “For every one hundred dollars of credit card transactions, only 10 cents are lost to fraud. If it is a physical transaction, it is as low as 2 cents. But if this happens in the aviation industry, airlines will not accept that ‘a small number of air crashes are inevitable costs’. As long as there is an air crash, they will thoroughly investigate and do their best to prevent it from happening again.”
How to protect yourself?
The good news is that protecting against these types of attacks is easy. According to the professors, just do one of two things:
- Turn off Express Transit Mode: Settings → Wallet & Apple Pay → Express Transit Settings → Select Off
- Don’t put your Visa card in the transportation card slot of Apple Pay: Use MasterCard or other cards instead, or put no cards in the traffic slot
If you are using a Samsung or other Android phone, you are not affected at all as their traffic mode checks the actual transaction amount.
After watching the whole video, I feel that neither Apple nor VISA seem to be taking any active actions. Although there are not many such incidents of fraud at present, if consumers are worried, it is recommended to change the credit card of the bound transportation card to a MASTER card. It is currently the easiest way. If you want to learn more about the relevant content, you can also watch this video directly. It is very exciting and detailed:
Conclusion: The eternal tug of war between convenience and security
The existence of this vulnerability highlights the profound contradiction between convenience and security in the payment system. Express Transit Mode is designed to make commuting smoother, just as the popularity of contactless payment makes checkout faster, but when these “convenient shortcuts” are reversely exploited by malicious people, they become security holes.
The most worrying thing is that this vulnerability was privately reported to Apple and Visa by scholars as early as 2021. Five years later, technical patching has still not been fully implemented. While both parties say consumers “won’t lose money” (because the bank will refund it), imagine how terrible it would be to wake up one day and find that a large amount of money is missing from your account? Even if the loss will eventually be refunded after appeal, the user does not need to bear that kind of panic and pressure. Convenience should not come at the expense of security, and this five-year vulnerability is the best reminder.
Source: KOCPC Chinese