TID: Mystic BBS 1.12 A47
MSGID: 1:229/664 8266b113
REPLY: 2:221/1.58@fidonet f4effcaa
TZUTC: -0400
On 30 Sep 2021, August Abolins said the following...
 
 AA> Ah.. So, this problem only pertained to "transit" payments and  
 AA> that transit users were able to get free rides?

Yup, the user would have to enable the feature:

"Express Transit is an Apple Pay feature that enables commuters to make quick
contactless payments without unlocking their phone."


Here's how an attack would work:

"A small commercially available piece of radio equipment is placed near the
iPhone, which tricks it into believing it is dealing with a ticket barrier.

At the same time, an Android phone running an application developed by the
researchers is used to relay signals from the iPhone to a contactless payment
terminal. Because the iPhone thinks it is paying a ticket barrier, it doesn't
need to be unlocked."


So it sounds like an attacker would need close proximity to an iPhone for this
to work, though if the attack was setup in a busy area (like a transit
station) they could walk away with a pretty penny:

"In a demonstration video seen by BBC News, security researchers have shown
how they were able to make a Visa payment of 1,000 British Pounds using Apple
Pay without unlocking the iPhone or authorizing the payment."


Jay

... It was completely quiet in the stadium - but noisy.

--- Mystic BBS v1.12 A47 2021/09/29 (Raspberry Pi/32)
 * Origin: Northern Realms (1:229/664)
SEEN-BY: 221/6 229/426 664 292/854 770/1
PATH: 229/664 426