iPhone Thief Explains How He Breaks Into Your Phone

That passcode is the devil. Sometimes it feels like divine intervention, while other times it's the consequence of my own reckless actions. And it's this passcode that has led me to this predicament. Aaron Johnson, now serving several years in a high-security prison, found himself in this situation because he exploited a vulnerability in Apple's software, stealing hundreds of iPhones and pocketing hundreds of thousands of dollars. This is the same vulnerability I've been investigating for the past year.

Johnson, depicted here in red, targeted individuals in and around bars in Minneapolis to pilfer their phones and unlock them by obtaining their passcodes. Watching them input the code or occasionally asking them directly, he exploited the vulnerability in Apple's security system. Thieves were using iPhone passcodes to gain access to stolen phones, pilfer victims' bank accounts, and lock them out of their Apple accounts.

Following our investigation into these widespread crimes, Apple introduced new security software. However, turning on the stolen device protection setting is crucial. Even then, some loopholes persist, and you play a significant role in securing your device.

In my conversation with Johnson, he shared insights into his methodology and how he turned Apple's security vulnerability into a lucrative business. His initial involvement in stealing phones began with pickpocketing them, eventually evolving into a more sophisticated scheme. Targeting individuals in bars, he would initiate conversations, often pretending to have drugs or offering fake merchandise, all while discreetly acquiring their passcodes.

Victims, typically men under 30, recounted encounters with Johnson. Some fell for his drug-related ruse, while others believed he was a rapper wanting to connect on Snapchat. Johnson, skilled at distraction, would swiftly input the stolen passcodes, ensuring he could later exploit them.

His theft operation involved collaboration, and his arrest warrant alleged the use of trickery and violence to acquire phones. Johnson, now 26, pleaded guilty to racketeering and received a 94-month prison sentence.

With the stolen phones and passcodes in hand, Johnson moved quickly to change Apple ID passwords, enroll his own face for Face ID, and gain access to saved passwords on bank apps. He demonstrated how he could navigate settings, add his face to Face ID, and swiftly change Apple ID passwords in a matter of seconds.

Johnson's goal was to take control swiftly, leaving victims helpless. He erased iPhones and sold them after ensuring they were wiped clean. His operation extended beyond iPhones, using Apple products, including iPads, to generate cash.

In response to these crimes, Apple introduced the stolen device protection setting. However, users must activate it in IOS 17.3, as it remains off by default. Turning it on adds an extra layer of defense, requiring a thief to have the victim's biometrics to change an Apple ID password.

Johnson, reflecting on his actions, expressed remorse and acknowledged the impact on victims' lives. While he understands the need for Apple to do more to protect users, he emphasized personal responsibility in safeguarding devices. Apple's ongoing efforts and user vigilance are essential in mitigating such vulnerabilities.

As you navigate the digital landscape, practicing caution, utilizing advanced passcodes, and staying informed about security features will contribute to a more secure mobile experience.