Researchers from the University of Birmingham and the University of Surrey in the United Kingdom conducted the study. They observed that if an iPhone is set up to utilize Apple Pay with a Visa card in “transit mode,” an attacker can steal money from a victim without requiring any authentication or authorization – the attack works even on locked iPhones. “Express Transit” or “Express Travel” is an Apple Pay function that allows users to swiftly pay for trips on select public transportation networks without having to utilize Face ID or Touch ID to authorize the payment, as is generally necessary when Apple Pay is used. Although this functionality is quite beneficial, researchers discovered that it also poses significant security dangers. An EMV reader, an NFC-enabled Android phone that acts as a card emulator, and a reader emulator (they utilized a Proxmark device in their testing) are all required for the assault. The attacker must keep the reader emulator close to the targeted iPhone, which can be done while it is still in the victim’s possession or when the device is lost or stolen. It’s a “active man-in-the-middle replay and relay attack,” according to the researchers, and it utilizes “magic bytes,” a sequence of bytes used by Apple Pay to detect whether a transaction is being done with a transit EMV reader. The attack is possible, according to them, because of a combination of weaknesses in Apple Pay and Visa systems. Normally, contactless card transactions have a limit, but the researchers have discovered a technique to steal money in excess of this restriction. They showed this by “stealing” £1,300 from a locked phone. Both Visa and Apple have been warned about the attack, and the researchers have provided mitigation recommendations, but neither has deployed any updates. The companies feel that executing this type of attack at scale in the real world is impracticable, and that attacks are complicated by the various layers of security in place. Samsung Pay and MasterCard cards were also tested, however they did not appear to be affected. The attack only works on Apple Pay and Visa-enabled devices; it won’t work if Apple Pay is used with MasterCard cards, for example. If you use Apple Pay with a Visa card and fear you are at risk, you can prevent assaults by blocking the transit mode.
