Can you steal $10,000 from a locked iPhone?

- I'm here with MKBHD, and we're gonna try to steal $10,000 from his locked iPhone. - Really hope it doesn't work. Really hope it doesn't work. - I'm gonna get you to put that phone down on top of this device. - [Marques] Okay. - Just put it down there. - Just put it on a, all . - I feel I'm a bit of a magician, but I'm - - Yeah. - I haven't changed anything, ? - Okay. Yeah. - It's still locked. - It's locked.

but I'm - - Yeah. - I haven't changed anything, ? - Okay. Yeah. - It's still locked. - It's locked. - Nothing else. - Yeah. - This is just a regular payment terminal. - Yeah. - Nothing weird about that. - Seen these. - And we'll start with a little, , maybe 100. No, maybe $5? Let's start with something - - Yeah, five. Five. - Start with five. - That sounds great. - Yeah. Five bucks. Do you think that we can take, , will we be able to get this out of your phone?

Do you think that we can take, , will we be able to get this out of your phone? - I hope not, but I kinda feel you will. Let's see. - So, now I'm gonna charge $5 on this device. Your phone's still locked, ? - Yep. - I haven't done anything. - It's a David Blaine.

Your phone's still locked, ? - Yep. - I haven't done anything. - It's a David Blaine. - [Henry] It's the nerdiest David Blaine. - Yeah. (chuckles) - Sweet, so. Just try to tap. We'll go. (phone chimes) - What just happened on my phone? Approved? Whoa, whoa, approved.

Approved? Whoa, whoa, approved. (coins clinking) So, okay. I heard something happen on my phone while you tapped this on this. - Yes. We got a little receipt for you. - Credit verified on device, $5. So, I'm gonna check my phone.

So, I'm gonna check my phone. , , I have a new $5 charge. And it's time stamped now. I don't that at all. So, that's concerning.

I don't that at all. So, that's concerning. , so my phone had to be on this thing? - [Henry] Yes. - Did it have to be on this thing? Or , near it, I guess? - So the way, well, I could explain how it works- - Yeah. - But maybe before that, $5, it's not very much. - Yeah.

- Yeah. - But maybe before that, $5, it's not very much. - Yeah. - Do we want to try upping it a bit? - I... - I'm gonna enter a slightly larger amount. - Careful. Careful with that. Careful. That's a lot of zeros. Careful with that. my God. Okay.

That's a lot of zeros. Careful with that. my God. Okay. - Do you even think it's possible? Firstly, $10,000. - , the credit, the limit on the card is above that. I don't know if Apple Pay will let you do that. - The question is also are you used to spending this amount of money on this card, ?

- The question is also are you used to spending this amount of money on this card, ? - Not from my phone. It's a big screen activity. - Yeah. - , $10,000 purchase, I gotta be checking everything. So, yeah, no. This would be unusual. - Let's see it. Let's see if it works. Okay, I'm gonna do it again. - Okay. - We're just, all we gotta do again.

- Let's see it. Let's see if it works. Okay, I'm gonna do it again. - Okay. - We're just, all we gotta do again. Put your phone locked. Phone- - On this device. - Locked on that device. - [Henry] Yes, exactly. And okay, we're gonna start the script again. Okay.

Okay. (suspenseful music) (phone chimes) - [Marques] - . (coins clinking) - . No. - No? (laughs) - It's just green. Approved.

- No? (laughs) - It's just green. Approved. - Print that out. Print that. (receipt sprinting) That is crazy. - my God. So, so, yeah, I'm gonna need that back. - Yeah. (laughs) - For sure, I'm gonna need that back.

- Yeah. (laughs) - For sure, I'm gonna need that back. But also, did that just? Yeah, wow. It worked. - $10,000. - All . I believe you. I definitely believe you. How do we get this back? We do a little Venmo or PayPal? How do we even? - ,

We do a little Venmo or PayPal? How do we even? - , do we give it back though? - Reverse the transaction. I don't even know. Do I call my company? Yeah, that's crazy. - Yeah, exactly. You can keep this if you wanna- - Yeah. - Get it framed. - Yeah. A receipt of the damage. I never unlock my phone. I never put in a password. I never did what I would normally do to verify a transaction on my phone.

I never did what I would normally do to verify a transaction on my phone. - Yes. - It just happened to be on top of that. - So, how did we do it? Well, we teamed up with two cybersecurity experts, Professors Ioana Boureanu and Tom Chothia. And we went to visit them at the University of Surrey, where they ran us through a unique hack that they developed

And we went to visit them at the University of Surrey, where they ran us through a unique hack that they developed to bypass the phone's lock screen and then to drain funds from inside its mobile wallet. - Without unlocking my phone is the real magic part. That's crazy. - And the craziest thing of all is that this hack was made public back in 2021. So, people have known that it's possible

was made public back in 2021. So, people have known that it's possible to take money from locked phones in this way for five years. So, what amounts does this? - The only limit is how much someone has in their bank account. (suspenseful music) - Yet the loophole still hasn't been fixed. So, how does it work?

So, how does it work? Well, whenever you use Tap to Pay, your phone and the reader exchange information about the transaction. But they send this information through the air by a shared magnetic field, so we can intercept the communication and alter it. All we need to do is to insert our own devices in between the phone and the reader.

in between the phone and the reader. First, we tap Marques's phone against this. It's an NFC device called the Proxmark. To Marques's phone, the proxmark looks a typical card reader. So, it happily sends over its transaction data. That proxmark then sends that data straight to our laptop, where we run a Python script to modify it.

where we run a Python script to modify it. Next, the laptop sends the data to our burner phone, which I tap on the actual card reader. To the reader, my phone looks just Marques's. So, both Marques's phone and the card reader think they're talking directly to each other, when in fact all their communication goes through our series of devices.

when in fact all their communication goes through our series of devices. This is a classic man-in-the-middle attack. Now, getting in the middle to intercept the data is the easy part. The hard part is what you need to do to that data to trick the phone and the reader into authorizing the transaction.

to trick the phone and the reader into authorizing the transaction. See, to steal money using this attack, you have to get past three layers of defense on both systems. And to do that, we have to tell three lies. Two to the phone, and one to the reader. So, the first layer of defense is the simplest.

So, the first layer of defense is the simplest. The phone is locked. And in an ordinary transaction, you have to unlock your phone to pay. But this is no ordinary transaction. So, , if you ever go to the subway, there's a feature that Apple's created where , when you walk through, they don't want a bunch of people lining up and having to unlock their face. And , maybe they're wearing a coat

they don't want a bunch of people lining up and having to unlock their face. And , maybe they're wearing a coat and glasses and stuff. - . Express Transit Mode. - Apple introduced express transit mode in 2019 to let you make transit transactions without having to unlock your phone. The way this works is that the payment terminals on the subway or on the bus broadcast a message

The way this works is that the payment terminals on the subway or on the bus broadcast a message that identifies them as a transit terminal. Then, when you tap your phone to pay, it looks for whatever card is in the transit slot of its mobile wallet and it pays without needing to unlock. This is super convenient, but we can also abuse it. - We found out how this worked

This is super convenient, but we can also abuse it. - We found out how this worked by going to the London Underground with our laptops and our equipment, and scanning the signals and seeing what the gate was saying to the phone. And that's how we discovered this code the gate send

And that's how we discovered this code the gate send which unlocked the phone. - We used the proxmark to broadcast that same code, which fools Marques's phone into thinking that it's a transit reader. So, when we tap Marques's phone against the proxmark, it's now expecting to receive another message with the details about the transit transaction.

with the details about the transit transaction. Here's what that message would typically look in binary code. Each of these bits carries important information about the transaction. Now, the important part of this message for us is this bit. An authentic transit transaction would have a 1 here. This tells the phone that the reader may be offline.

This tells the phone that the reader may be offline. if it's underground on the subway. In which case the phone would need to send an extra layer of authentication. So, when Marques's phone receives the transaction request from what it thinks is a transit reader, it's gonna be expecting that value to be set to 1. But in reality, the device sending the request

But in reality, the device sending the request is our retail reader, and this reader is online, which means that bit is currently set to zero. Therefore, to trick the phone into accepting the transaction, we intercept the message from the reader, pass it through our computer, and we change that 0 to a 1. So by the time the message gets to Marques's phone,