The Hidden Flaw in iPhone Security. How $10,000 Can Be Stolen via Apple Pay

Critical Vulnerability in Express Transit Mode

A recent investigation by Veritasium has exposed a significant security hole involving iPhone and Visa cards. By exploiting the ‘Express Transit’ feature, which allows payments without unlocking the device, attackers can remotely trigger transactions for thousands of dollars. This vulnerability highlights a lack of coordination between tech giants and payment networks, leaving users potentially exposed to high-stakes theft.

The Anatomy of the Attack

Using a ‘Man-in-the-Middle’ setup, researchers demonstrated that they could intercept communication between a standard payment terminal and an iPhone. By spoofing the transit terminal’s ID, they tricked the iPhone into authorizing a $10,000 payment as if it were a low-cost subway fare. While Mastercard uses RSA-based asymmetric encryption to prevent such data tampering, Visa’s protocol in specific online scenarios lacks this secondary safeguard.

Corporate Response and User Safety

Apple points to Visa, while Visa claims the attack is unlikely in the real world. Despite this, the flaw remains unpatched since 2021. Users are advised to disable Express Transit or switch to a different card provider for transit payments to ensure their funds remain secure. In the digital age, convenience often comes at the cost of security, and this case is a prime example.