Comment by r_lee
17 days ago
right, so you'd have to know the store with your victims upfront, know which ones to give these highly expensive implanted iPhones to (or have a lot of units), be able to always bring enough for the specific colors the customers want....
I'm especially amused at all the different iPhone SKUs you'd have to stock your crooked phone salesman with. 4 storage tiers, Pro and Pro Max, and 4 colors. So that's 32 boxed phones, a good-sized duffel bag full, to smuggle into the Apple Store, to keep on-hand but avoid anyone finding them, in anticipation of the victim's visit, just to cover the Pro range. Imagine you spent $75,000 on those phones and about as much on the technicians' time to open them all up, install the implants, and perfectly re-seal them. Your salesman has successfully kept the phones hidden for a month, and the target walks into that store and says "You know, I really like the color the non-pro model has this year."
So you both thought about it for about 10 seconds and came up with some surface-level objections. Doesn't really prove anything when dedicated attackers with 10s of millions in potential profits are in play. Probably you would've written very similar dismissals about the idea of implanting a mini esim modem in a hardware wallet if someone would've brought it up back then.
Would be good if Apple (or anyone) could have some kind of user-verifiable supply chain integrity thing, if they don't already.
planting some very cheap microchips in a hw wallet that is mostly used by those who want to protect their wealth is a whole different thing from what you're suggesting
I would've not dismissed the esim thing
like you do realize the Apple store scenario isn't on the same level, at all? like, you'd have to bascially stalk your target figure out when they're gonna go buy an iphone at some specific store and have all the SKUs ready, all for that one job vs. this where you can buy and resell these things and the cost is materials + labor for implanting the thing and shipping costs, and you don't really have to even identify your victims because your customers are likely wealthy (to a degree at least)
1 reply →