Smashing Security podcast #483: This AI helps thieves steal your iPhone

This episode of Smashing Security explores how AI is being used to facilitate iPhone theft, highlighting the growing risk of device theft around major product launches like Apple's new iPhones. The host recounts a personal experience of being mugged for his phone, emphasizing the stressful and disruptive impact of device theft and the need for robust security measures. The episode also touches on the broader issue of device security and the challenges of protecting sensitive data in an increasingly connected world, and is sponsored by Intruder, a pen testing tool.

Smashing Security, episode 483.

This AI helps thieves steal your iPhone with Graham Cluley and special guest James Ball.

Hello, hello, and welcome to Smashing Security episode 483. My name's Graham Cluley.

James, great to have you back on the show again. You've been keeping busy, out of mischief, I hope?

Horribly busy for an August, actually. I think when you're a freelancer, it's a much busier month than people realise, because when everyone else is on holiday, you're working.

Yeah, it's miserable, isn't it? Anyway, but at least we've had a little bit of rain, so that's good.

I'm hoping Finsbury Park will look less like, you know, the aftermath of a disaster movie and a bit more like a park, because it's usually lovely.

Yeah, less like the Kalahari, hopefully. Well, before we kick off, let's thank this week's wonderful sponsors, ThreatLocker, Intruder, and Vanta.

We won't be talking about how the hacker who leaked footage of GTA 6 cashed out his CyberLeak cryptocurrency for about $270,000 just hours before the game's launch.

You'll hear no discussion of malware hidden inside a Chinese wallpaper app that encouraged users to disable their antivirus.

And we won't even mention how an exposed API key helped hackers steal 86 gigabytes of customer data from Manchester Airports Group.

So James, what are you going to be talking about this week?

Well, I'm looking to zoom us back a little bit from a whole bunch of the sort of cybersecurity rows going on around AI models and just look into a bit of what it's telling us and how significant it is, because I've had a couple of interesting conversations around that.

And I'm gonna be finding out how AI is helping to steal Apple iPhones. All this and much more coming up on this episode of Smashing Security.

Now, Joe, quick quiz. How often does your team ship code?

Multiple times a week, maybe more if someone's had too much coffee.

And how often do you get a proper pen test?

Oof, once a year, if we remember.

Well, that's the problem right there. Software moves weekly. Pen testing moves yearly. So most of what you ship never actually gets tested properly.

Which is exactly the gap Intruder's AI pen testing closes. You get the depth of a real manual pen test, but on demand, whenever you need it.

No scoping calls, no 6-week wait, and it costs a fraction of the traditional price.

It's built by Intruder's own certified pen testers, so the agents catch the complex stuff human testers can miss. And every finding is validated against your actual app.

Real issues, not noise. You get an audit-ready report within hours.

It plugs straight into Intruder's full platform. Attack surface monitoring, cloud security, vulnerability management, all watching around the clock.

It flags what's exploitable, what to fix first, and how, so your team can act without waiting around for the security team.

Over 3,000 companies already trust Intruder with their attack surface.

You can kick off a pen test in minutes, and as a Smashing Security listener, get 25% off your first one.

So just head to intruder.io/smashing. That's intruder.io/smashing.

And thanks to Intruder for supporting the show.

Now, chums, we are just days away. I don't know how excited you are about this, James, but we are just days away from Apple announcing a new version of its iPhone.

It is widely expected that on Wednesday, September the 9th, Apple is going to announce not just the iPhone 18 Pro, presumably with about 17 cameras stuck on the back of it, but also the iPhone Ultra, the first foldable iPhone.

Yeah, I'm still not sold on foldable phones, but I am an absolute certified Apple fanboy.

I think I've got every bit of tech they've put out in the last decade except the VR headset.

So I am very much a mark for this, and if anyone is going to get me to buy a foldable phone, it's going to be Apple.

I mean, the thing with Apple is they're not always the first with a technology.

I think Samsung, and there's lots of Android phones which have been foldable for probably years by now, but Apple, sometimes its implementation can be better or bring something new, which makes everyone change in their wake, doesn't it?

They've had a good habit of waiting till a technology is actually ready so that it's not the finicky thing that only an early adopter could love, but everyone will just go, oh yeah, this is great.

And that does mean I do tend to sit and wait for them to do something, 'cause usually they've ironed out the kinks. There's been a few misses.

Hopefully there aren't too many kinks in their foldable iPhone.

But of course, it will mean that there will have never been a better time to have your phone stolen, because if you're going to have it stolen, have it stolen just before Apple comes out with a brand new one, especially one which has something a little bit different about it, which you can get excited about.

You know, it's the silver lining on the cloud, isn't it?

It is. Have you ever had a phone stolen, Graham?

I've had a phone lost before. I've lost my iPhone in the back of a cab in Edinburgh in the past, and I was able to track it for a few days as the taxi driver—

I did eventually manage to get it back, which was quite miraculous. Thank you to that taxi driver. But it is a very stressful situation, isn't it?

It's very stressful because your whole life is running off one of these things.

Yeah, I got mugged for my phone once.

There was a spate of muggings where people stopped stealing jewellery and stole phones hoping there were crypto wallets on them.

And clearly I had the look of someone who might have a crypto wallet on my phone because they didn't just steal the phone.

They kept beating me up to try and get the passwords and try and get into the banking apps.

And luckily for them, I keep my phone on such low battery that I gave them the passwords because they had a knife.

So they had the passwords, but the phone battery died and I'd managed to lock it.

I got home about 10 minutes after and locked it remotely before they could power it back up again, so they only got the phone.

But because I'd had to reset all the passwords and I didn't have the phone, I had about a month of admin work.

It was awful.

And there was a very stern woman on the bank call line who, when I said, well, no, I've had to give my security passwords out—oh, you're not supposed to give those out.

Yes, I know. As I told you, he had a knife on me when I gave it.

You weren't just skipping through the streets saying, my banking secret word is X.

Awful. That is a truly horrendous situation. I wonder if some people will actually begin carrying around 2 phones with them, so if they do get stopped, you give them the rubbish one.

You give them the old Nokia brick. That's all I've got, I'm afraid, but you're welcome to it.

Honestly, the crime I was sort of okay with, but the endless—right, I ended up writing it up in the Sunday Times.

So genuinely, I got about £650 for the Times article, which I worked out was my phone excess, the headphones, and worked out at being, for the time I'd spent, about half minimum wage on the calls.

So I sort of came out even-ish.