It looks so legitimate, almost as if “The Matrix” is written all over its face.
Today is April 24th, and a quick search online reveals it happens to be China Space Day.
While watching the news reports about various launches of the nation’s major space projects, I was instead worrying about a fellow Shandong native’s iPhone.
A while ago, he lost his newly bought phone on the subway during the morning rush hour.
The young guy reacted pretty fast. He immediately borrowed a colleague’s phone to log into iCloud, remotely locked the device, and wiped all the data in passing.
At the time, we all thought the phone was effectively bricked.
But guess what?
A Titanium Safe Tossed into the “Seafood Market”
He had already accepted his bad luck, thinking that even if he couldn’t get it back, it would just be a piece of scrap metal to whoever took it.
But a few days later, he came to me, saying that while browsing Xianyu (China’s leading second-hand marketplace, nicknamed the “Seafood Market”), he found a bunch of posts advertising “Apple Official Unlock” and “Remote Instant ID Unlock.”
The prices were pretty surreal. The cheap ones were 300 RMB (about $40), and the expensive ones were only around 800 RMB.
The seller’s promotional image: the fewer the words, the shadier the deal.
To be honest, as a Build-Girl who usually loves to roll around in piles of code, my first reaction was disbelief.
Let’s first look at Apple’s underlying architecture. What level of a tough nut is the Secure Enclave chip inside the phone? It’s a titanium safe that Tim Cook would fiercely defend even if the FBI showed up with a search warrant.
By the way, during the highly publicized California shooting case years ago, the US police ultimately spent over a million dollars hiring third-party hackers just to barely bypass the passcode on an older iPhone.
And now, some random dude on Xianyu can crack it just by typing on a keyboard?
Impressive indeed. But it’s not that simple.
Bypassing the Safe and Tricking You Out of the Key
I specially created a burner account and went undercover to chat with a few sellers.
I discovered they have a highly standardized, industrialized set of scripts. They don’t ask for the phone’s specific serial number, nor do they ask if it’s a Chinese or US model.
They only ask one question: “Did you leave a contact number on the screen of this device?”
Here comes the question. If they were truly technical wizards cracking the system, why would they need a phone number?
This is the legendary Lost Mode pop-up: it guards against honest people but not thieves.
This is actually the most chilling link in the entire underground industry chain.
This is not the legendary “official unlock” at all. To put it bluntly. This is merely beautifully packaged phishing.
Think about it. When we lose our phones and turn on “Lost Mode,” our first reaction is definitely to leave a friend or family member’s backup number on the screen.
And we usually add, “Will reward generously, please contact me.”
Well, well. This number instantly becomes the perfect breakthrough point in the eyes of scammers.
When sellers get this kind of locked device, they don’t even bother wrestling with Apple’s servers. They directly send an SMS or call the number on the screen.
“Hello, this is Apple Official Support. Someone has brought in a suspected lost phone for repair. Please log in to the link below to verify your identity.”
You can probably guess what happens next. The owner, already anxious, gets excited, clicks into that incredibly realistic fake “iCloud official website,” and obediently enters their Apple ID and password.
As soon as the password is in hand, the scammer swiftly logs into the system. They simply remove the device from the account.
The titanium safe was indeed never breached.
Instead, these guys just called the owner of the safe and had them mail over the keys.
Dimensional Strike and the Art of Laziness
Let’s compare this kind of “soft unlock” horizontally with proper hardware cracking.
In the mobile phone circle, there used to be a concept called “hard unlocking.” That involved tearing the phone apart into eight pieces and replacing the CPU, baseband, and logic EEPROM altogether—essentially performing a head transplant on the phone.
This is like bringing in a heavy excavator to forcefully tear down a wall just to open a safe.
Not only is the cost extremely high, but one careless move could completely ruin the motherboard.
Hard unlocking is too risky; nothing brings in cash faster than sending a text message.
To put it harshly.
Compared to hackers fiercely battling encryption algorithms, breaching an anxious human looking for their phone is just incredibly cheap.
The cost of a disguised SMS is only about a dime. The encrypted closed loop that Apple spent hundreds of millions of dollars and thousands of top engineers to build is thus shattered by a ten-cent spam message.
30%—according to some unofficial data I’ve seen before, as long as the sent phishing messages hit this conversion rate, this business is highly lucrative.
This is typical Social Engineering.
It doesn’t attack system vulnerabilities.
It only attacks humanity’s emotional blind spots and trust inertia.
You can’t find its flaws in the code, because it runs in the real, physical society.
The Dead Knot of Kindness
Sometimes I wonder if Apple engineers were also quite conflicted when they originally designed the “Lost Mode.”
If they didn’t allow leaving contact info, a kind-hearted person who found the phone and wanted to return it wouldn’t be able to find the owner at all.
But leaving contact info is equivalent to handing a knife to the underground industry. Does this count as a cognitive blind spot?
Once you fall for it, your phone becomes someone else’s merchandise.
This is probably an eternal dead knot that the tech industry can never untie.
We code desperately.
We add layer upon layer of verification to the system, use dynamic keys, implement the most complex hash algorithms, and even wish we could bind the user’s fingerprints and eyeballs entirely to it.
(o_O)
But as long as one end of the system is connected to a living, breathing human being, absolute security does not exist.
Or maybe I’m overthinking it.
Often, no matter how good the system is, it can’t stop people from willingly handing over their passwords.
If someday in the future, an on-device large AI model could automatically help us intercept and identify all phishing messages disguised as official ones, would it be a bit better?
However, when that day comes, scammers will likely use AI to generate their scripts too. Magic defeats magic; in the end, it all comes down to a battle of computing power.
I just went to the bar to pour some water.
I noticed that the pour-over coffee beans today seem a bit over-roasted.
The taste is slightly bitter.
References:
—— Lyra Celest @ Turbulence τ.
