Researchers Stole $10,000 from MKBHD via Apple Pay.

$10,000 Apple Pay Heist: Researchers Exploit "Express Mode" Vulnerability to Rob MKBHD

In a chilling demonstration featured on the popular documentary channel Veritasium, researchers from the University of Surrey and the University of Birmingham successfully siphoned $10,000 from tech YouTuber MKBHD (Marques Brownlee). The most alarming part? The transaction was authorized while the iPhone remained locked, without any biometric confirmation or user interaction.

The Vulnerability: A Man-In-The-Middle (MITM) Flaw

The attack exploits Apple Pay "Express Mode" a feature designed for convenience in public transit, allowing small payments without unlocking the phone. The researchers identified a critical lack of verification in the communication between the iPhone and the card reader:

• Flag Manipulation: Apple Pay does not independently verify the transaction amount. Instead, it relies on a "flag" from the reader. Researchers intercepted this communication, tricking the iPhone into believing a $10,000 request was a low-value transit payment.

• The Visa Loophole: Unlike Mastercard, which requires a digital signature for every transaction, Visa’s protocol allows online card readers to skip signature verification if the system is connected to the internet. This "trust-based" approach allowed the researchers to modify the message data mid-transit without being detected by the security protocols.

Corporate Response: "Low Risk" vs. Consumer Safety

Although the researchers alerted both Apple and Visa as early as 2021, a permanent fix has yet to be implemented.

• Apple deferred to Visa’s "Zero Liability" policy, which protects customers from unauthorized charges.

• Visa’s Senior VP, Michael Jabbara, downplayed the threat, stating that such sophisticated attacks are difficult to scale globally and that fraud protection measures are already in place to refund affected users.

The Industry Dilemma: Compatibility over Security

This incident highlights a systemic issue in the banking industry. Financial institutions often prioritize backward compatibility with millions of legacy card readers over airtight security. For example, the phase-out of magnetic stripe technology has taken decades and is not expected to be complete until 2033. Currently, the industry tends to rely on liability policies (deciding who pays for the loss) rather than enforcing newer, more secure technologies that close vulnerabilities permanently.

The Express Mode feature is designed for a "frictionless experience," a core principle of Apple products. However, in terms of security, "friction is your friend." This incident highlights how user-friendly technology can be, and how deep its vulnerabilities may lie.

While Visa has policies to protect cardholders, the dispute process often is time-consuming and complicated for users. In MKBHD's case, $10,000 might not have a significant impact, but for the average user, the temporary loss of that amount could have a life-threatening consequence.

Even though Visa claims the attack is difficult to implement on a large scale, remember that attackers can use AI-driven automation to scan and intercept signals more quickly. If attackers place small devices at crowded public payment points, the damage could be immense before it's detected.

If you're concerned about this vulnerability, the simplest way to protect yourself is to disable Express Mode for credit/debit cards in Apple Wallet and only use it for transit cards with limited spending limits, or set up minimum spending alerts to notify you immediately when money is being withdrawn from your account.

 

EU Unified Age Verification App is Ready Privacy-First Child Safety.

 

Source: Veritasium 

💬 AI Content Assistant

Ask me anything about this article. No data is stored for your question.

$10,000 Apple Pay Heist: Researchers Exploit "Express Mode" Vulnerability to Rob MKBHD

In a chilling demonstration featured on the popular documentary channel Veritasium, researchers from the University of Surrey and the University of Birmingham successfully siphoned $10,000 from tech YouTuber MKBHD (Marques Brownlee). The most alarming part? The transaction was authorized while the iPhone remained locked, without any biometric confirmation or user interaction.

The Vulnerability: A Man-In-The-Middle (MITM) Flaw

The attack exploits Apple Pay "Express Mode" a feature designed for convenience in public transit, allowing small payments without unlocking the phone. The researchers identified a critical lack of verification in the communication between the iPhone and the card reader:

• Flag Manipulation: Apple Pay does not independently verify the transaction amount. Instead, it relies on a "flag" from the reader. Researchers intercepted this communication, tricking the iPhone into believing a $10,000 request was a low-value transit payment.

• The Visa Loophole: Unlike Mastercard, which requires a digital signature for every transaction, Visa’s protocol allows online card readers to skip signature verification if the system is connected to the internet. This "trust-based" approach allowed the researchers to modify the message data mid-transit without being detected by the security protocols.

Corporate Response: "Low Risk" vs. Consumer Safety

Although the researchers alerted both Apple and Visa as early as 2021, a permanent fix has yet to be implemented.

• Apple deferred to Visa’s "Zero Liability" policy, which protects customers from unauthorized charges.

• Visa’s Senior VP, Michael Jabbara, downplayed the threat, stating that such sophisticated attacks are difficult to scale globally and that fraud protection measures are already in place to refund affected users.

The Industry Dilemma: Compatibility over Security

This incident highlights a systemic issue in the banking industry. Financial institutions often prioritize backward compatibility with millions of legacy card readers over airtight security. For example, the phase-out of magnetic stripe technology has taken decades and is not expected to be complete until 2033. Currently, the industry tends to rely on liability policies (deciding who pays for the loss) rather than enforcing newer, more secure technologies that close vulnerabilities permanently.

The Express Mode feature is designed for a "frictionless experience," a core principle of Apple products. However, in terms of security, "friction is your friend." This incident highlights how user-friendly technology can be, and how deep its vulnerabilities may lie.

While Visa has policies to protect cardholders, the dispute process often is time-consuming and complicated for users. In MKBHD's case, $10,000 might not have a significant impact, but for the average user, the temporary loss of that amount could have a life-threatening consequence.

Even though Visa claims the attack is difficult to implement on a large scale, remember that attackers can use AI-driven automation to scan and intercept signals more quickly. If attackers place small devices at crowded public payment points, the damage could be immense before it's detected.

If you're concerned about this vulnerability, the simplest way to protect yourself is to disable Express Mode for credit/debit cards in Apple Wallet and only use it for transit cards with limited spending limits, or set up minimum spending alerts to notify you immediately when money is being withdrawn from your account.

 

EU Unified Age Verification App is Ready Privacy-First Child Safety.

 

Source: Veritasium