Name: iPhone 用戶小心了！就算有密碼，iPhone 大盜還是可以入侵你的手機，竊取你的個資！ (iPhone Thief Explains How He Breaks Into Your Phone | WSJ)
Uploaded: 2023-12-28T21:01:10.000Z
Duration: 9 min 47 s

頻率副詞

It could be God sometimes or it could be the power.

這有時候可能是上帝，或者是力量。

我淪落到這裡是因為我做得太過分。

And sometimes when you do that, you end up places like this.

有時當你這樣做，就會淪落到這種地方。

Aaron Johnson is due to spend the next several years at this high-security prison because he stole hundreds of iPhones and from them hundreds of thousands of dollars.

亞倫·強森將在這所高度安全的監獄中度過未來的幾年，因為他偷了數百部 iPhone，從中盜取了數十萬美元。

He exploited a vulnerability in Apple's software.

他利用了蘋果軟體中的一個漏洞。

The same vulnerability I've been investigating for the last year.

這也是我去年一直在調查的漏洞。

He grabbed the phone and then disappeared.

Along with others, Johnson seen here in red would target people in and around bars in Minneapolis to get their phones and their passcodes.

與其他人一起，這裡穿著紅色的約強森會在明尼阿波利斯的酒吧周圍找尋目標，偷取他們的手機和解鎖密碼。

In cities across the country, these are using the iPhone passcode to get into stolen phones and loot their victims' bank accounts and money apps and lock them out of their Apple accounts. Sometimes for good.

在全國各地的城市中，這些人使用 iPhone 密碼登入被偷的手機，搶奪受害者的銀行帳戶和金融應用程式，並封鎖他們的蘋果帳戶。有時甚至是永久性的。

Following our investigation into these widespread crimes, Apple created new security software,

在我們對這些大規模犯罪的調查後，蘋果公司推出了新的安全軟體。

but you'll have to turn on the stolen device protection setting and even then some loopholes remain the biggest loophole you.

但你必須打開被盜設備保護設定，即便如此，仍然存在一些漏洞，其中最大的漏洞是你。

That's why I sat down with Johnson to learn how he tricked victims and turned Apple's security vulnerability into a lucrative business.

這就是為什麼我坐下來與強森交談，了解他如何欺騙受害者，將蘋果的安全漏洞變成一個有利可圖的事業。

How did you get involved with stealing phones?

So, at first I just started pickpocket the phones.

I didn't get the passcode or nothing. I just got the phone.

我沒拿到密碼什麼的。我只是偷手機。

Let's say it's Friday night, we meet at a bar.

比方說，星期五晚上我們在酒吧見面。

I have an iPhone 15 Pro Max. What happens?

我有一部 iPhone 15 Pro Max。會發生什麼？

They say they want the drugs and I tell them to take my information down. The whole time, I don't have any drugs.

他們說他們要毒品，我告訴他們記下我的信息。整個過程中，我其實根本沒有毒品。

So as soon as the phone's in my hand, I just ask them, what's the code or I watch them put it in before they give it to me.

所以一旦拿到手機，我就問他們密碼是什麼，或者我在他們交給我的時候看他們輸入密碼。

And then I kind of just talk about other things.

Is there an age of person you're looking for when you're out?

你在作案時是否會尋找特定年齡的人？

Because they're more partying and they are already drunk and don't know what's going on for real.

因為他們更喜歡狂歡，他們已經喝醉了，不知道什麼是是真的。

I interviewed a number of Johnson's victims.

I was approached by two men who seemed very ecstatic.

我被兩個看起來非常興奮的男人接近。

Some told me Johnson approached them, offering drugs,

有些受害者告訴我約強森接近他們，提供毒品，

They were like, "Do you want to buy some?"

Others told me Johnson would say he was a rapper and wanted to add them on Snapchat.

還有人告訴我，強森會說自己是一位饒舌歌手，想要 在Snapchat 上加他們為朋友。

Like that's just, that just seems normal. When I open up the phone and I hand it to him to...

好像那只是，那只是看起來很正常。當我打開手機並把它遞給他...

I lock the phone and then I tell him that it's locked or something's wrong with your phone, it locked on me.

我鎖上手機，然後告訴他它被鎖住了，或者你的手機出現了問題，被我鎖住了。

And then that's when they, "Ok. No problem. 2664 something, something."

然後他們就會說：「好的，沒問題。密碼是 2664 什麼的。」

Never did this and people say, "Hey, you took my phone."

難道你這樣做的的時後，沒有人說過：「嘿，你拿了我的手機。」嗎？

Yeah, but by that time it's already, I don't have it no more.

有啊，但那時它已經太遲了，已經不在我身上了。

This wasn't a one man job, a police investigation alleged that Johnson worked with others.

這不是單獨作案，警方的調查聲稱強森與其他人合作。

According to his arrest warrant, he used trickery and violence to get the phones.

根據他的逮捕令，他用詭計和暴力拿到了手機。

Johnson who's now 26, pled guilty to racketeering and was sentenced to 94 months in prison.

現年 26 歲的強森承認犯有敲詐勒索罪，並被判處 94 個月監禁。

You've got the phone, you've got the passcode, what do you do next?

你拿到手機，拿到密碼，下一步會怎麼做？

It's kind of like a, like a bank robbery.

You gotta be quick, you gotta go to the settings and go to iCloud, click reset password and put the six-digit code in and make my own password.

你得快點，你必須進入設定，然後進入 iCloud，點擊「重置密碼」，輸入六位數的密碼，然後創我自己的密碼。

And then I turn on Find My iPhone and then that completely locks them off the phone.

然後我就打開「尋找我的 iPhone」，然後就能完全將他們從手機上鎖定。

This was the bit that was so crazy to me when I first started reporting on this crime.

就是這一點，當我剛開始報導這一罪行時，我覺得這太瘋狂了。

With just the passcode to an iPhone, a thief can change someone's Apple ID password and do a host of other things to your account and phone.

只要有iPhone的密碼，竊賊就能更改某人的 Apple ID 密碼，對你的帳戶和手機進行各種其他操作。

How fast were you changing Apple ID passwords?

你換 Apple ID 的密碼速度有多快？

Faster than you could say supercalifragilisticexpialidocious.

比你說的「用易碎的美麗補償可教育性的缺失」這個字還要快。

I got to that fast where I can do it just right there.

So that I can take control and they don't have access to it anymore.

這樣我就可以掌控手機，他們就無法再登入了。

And you got to beat the mice to the cheeses.

而且你要比老鼠更快地抵達乳酪。

With the passcode Johnson removed the owner's face from face ID and enrolled his own, making it easier to gain access to saved passwords to bank apps.

使用密碼，強森將所有者的臉從 Face ID 中刪除並加入了自己的臉，這樣就更容易登入保存在銀行應用程序中的密碼。

You've got into my settings. Where are you going from here?

你已經進到我的設置。接下來會怎麼做？

So then I go add my face on there on the face ID verification.

然後我就去加入我的臉，進行Face ID驗證。

Now when you got your face on there, you got the key to everything. Things that people thought were safe.

現在，當你的臉存入手機時，你就擁有了所有東西的鑰匙。人們認為是安全的東西。

Like? - Savings, checkings, cryptocurrency apps.

像什麼？ - 儲蓄，支票，加密貨幣應用程式。

Yeah, you don't need face for none of that.

是啊，這些都不需要臉部識別。

If Johnson couldn't unlock the apps with his face, he'd look elsewhere on the phone.

如果強森不能用他的臉解鎖應用程式，他就會在手機裡找別的地方。

I go through their notes and the password to everything is in there.

我會翻看他們的記事本，所有東西的密碼都在裡面。

While victims were sleeping, Johnson would be draining money from their bank accounts.

在受害者睡覺時，強森會從他們的銀行帳戶中提取資金。

Before 5 am, I would have everything transferred out of the bank.

在早上5點之前，我會將所有資金轉出銀行。

But then if some people have, like, credit line or something, that's when I would go shopping with it, go get, you know, nice stuff.

但如果有人有信用額度之類的東西，那時我就會去購物，買一些好東西。

Yeah, just by beeping my face on, that's all I got to do is put my face on it and beep and I can swipe for thousands of dollars, clothes, shoes, you know, all type of stuff, kids stuff.

是的，只要用我的臉一掃，我只需把我的臉加入，發出嗶的聲音，我就可以刷上千美元，衣服，鞋子，各種各樣的東西，還有兒童用品。

There was one more trick to this scheme. Ater stealing the money, Johnson would erase the iPhone.

這個計畫還有一個技巧。在偷了錢之後，強森會刪除 iPhone 上的所有數據。

Yes. Using the passcode and password and sell it.

是的，使用密碼和密碼，然後將其出售。

Was there an average selling price of an iphone that you would sell?

你賣 iPhone 的平均售價是多少？

If it's a iPhone 14 Pro Max with one terabyte, I probably get like $900.

如果是擁有 1 TB的 iPhone 14 Pro Max，我可能能賣到約 900美元。

Johnson said he'd typically look for those iphone Pros with their telltale three cameras.

強森表示，他通常會尋找那些帶有明顯三個攝像頭的 iPhone Pro。

For a 128 gigabyte or 256 gigabyte iPhone Pro or Pro Max, he'd get about $650.

一部 128G 或 256G 的 iPhone Pro 或 Pro Max，他可能能賣到約 650 美元。

For a regular non Pro iPhone, he'd get $300 to $400.

一部普通，非 Pro 系列的 iPhone，他可能能賣到 300 至 400 美元。

Probably get like 5 to 10 phones a night.

我可能每晚拿偷五到十部手機。

So 10, 20, 30. 30 phones from Friday to Sunday.

所以，從星期五到星期天可能有 30 部手機。

He said he could make up to $20,000 a weekend just from selling the phones.

他說他每週末賣手機可以賺取高達 $20,000。

And while he did steal some Android phones,

雖然他確實偷了一些安卓手機，

But here's the kicker. Johnson was using stolen Apple products and their Apple pay function to buy more Apple products.

令人驚訝的是，強森使用被盜的蘋果產品及其 Apple Pay 功能來購買更多的蘋果產品。

It was an extensive scheme of profiting off of Apple's vulnerabilities and products.

這是一個利用蘋果的漏洞和產品謀利的廣泛計畫。

I go to Target, probably get like 3, 4 iPad Pros.

我去 Target，可能會買三到四台的 iPad Pro。

Yeah, brand new in the pack, like $1200, $1300.

是啊，全新包裝，大概 $1200，$1300。

字幕列表影片播放

iPhone 用戶小心了！就算有密碼，iPhone 大盜還是可以入侵你的手機，竊取你的個資！ (iPhone Thief Explains How He Breaks Into Your Phone | WSJ)

stuff

vulnerable

approach

access