He Stole Hundreds of iPhones and Looted People’s Life Savings. He Told Us How.
Kanebridge News
    HOUSE MEDIAN ASKING PRICES AND WEEKLY CHANGE     Sydney $1,630,107 (-0.64%)       Melbourne $993,269 (-0.02%)       Brisbane $1,042,360 (-1.79%)       Adelaide $930,845 (-1.38%)       Perth $915,565 (-0.55%)       Hobart $755,926 (-0.53%)       Darwin $719,519 (+0.64%)       Canberra $977,431 (+0.32%)       National $1,064,602 (-0.64%)                UNIT MEDIAN ASKING PRICES AND WEEKLY CHANGE     Sydney $758,442 (-0.87%)       Melbourne $497,155 (-0.57%)       Brisbane $633,818 (+0.55%)       Adelaide $498,038 (+0.46%)       Perth $514,535 (+1.19%)       Hobart $536,446 (-0.13%)       Darwin $382,540 (-0.82%)       Canberra $486,457 (+0.33%)       National $558,956 (-0.07%)                HOUSES FOR SALE AND WEEKLY CHANGE     Sydney 12,022 (+769)       Melbourne 16,764 (-534)       Brisbane 9,178 (-1,672)       Adelaide 3,138 (-13)       Perth 8,405 (+14)       Hobart 1,262 (-41)       Darwin 243 (-18)       Canberra 1,273 (-75)       National 52,285 (-1,570)                UNITS FOR SALE AND WEEKLY CHANGE     Sydney 9,330 (-482)       Melbourne 8,988 (-321)       Brisbane 1,846 (-48)       Adelaide 486 (+9)       Perth 1,854 (+37)       Hobart 227 (-2)       Darwin 301 (-13)       Canberra 1,216 (-16)       National 24,248 (-836)                HOUSE MEDIAN ASKING RENTS AND WEEKLY CHANGE     Sydney $800 ($0)       Melbourne $600 ($0)       Brisbane $650 (+$10)       Adelaide $620 ($0)       Perth $680 (+$5)       Hobart $560 ($0)       Darwin $743 (+$20)       Canberra $690 (-$10)       National $676 (+$3)                UNIT MEDIAN ASKING RENTS AND WEEKLY CHANGE     Sydney $750 ($0)       Melbourne $570 ($0)       Brisbane $640 (+$15)       Adelaide $495 ($0)       Perth $630 ($0)       Hobart $450 (+$20)       Darwin $578 (-$3)       Canberra $580 ($0)       National $599 (+$3)                HOUSES FOR RENT AND WEEKLY CHANGE     Sydney 6,980 (+299)       Melbourne 8,334 (+76)       Brisbane 4,452 (-15)       Adelaide 1,580 (+13)       Perth 2,385 (-16)       Hobart 241 (0)       Darwin 150 (+6)       Canberra 633 (-9)       National 24,755 (+354)                UNITS FOR RENT AND WEEKLY CHANGE     Sydney 11,521 (+132)       Melbourne 8,107 (-13)       Brisbane 2,361 (+13)       Adelaide 432 (-17)       Perth 682 (-8)       Hobart 90 (-9)       Darwin 271 (-13)       Canberra 720 (+2)       National 24,184 (+87)                HOUSE ANNUAL GROSS YIELDS AND TREND       Sydney 2.55% (↑)      Melbourne 3.14% (↑)      Brisbane 3.24% (↑)      Adelaide 3.46% (↑)      Perth 3.86% (↑)      Hobart 3.85% (↑)      Darwin 5.37% (↑)        Canberra 3.67% (↓)     National 3.30% (↑)             UNIT ANNUAL GROSS YIELDS AND TREND       Sydney 5.14% (↑)      Melbourne 5.96% (↑)      Brisbane 5.25% (↑)        Adelaide 5.17% (↓)       Perth 6.37% (↓)     Hobart 4.36% (↑)      Darwin 7.85% (↑)        Canberra 6.20% (↓)     National 5.57% (↑)             HOUSE RENTAL VACANCY RATES AND TREND         Sydney 1.3% (↓)     Melbourne 1.3% (↑)        Brisbane 1.1% (↓)       Adelaide 1.0% (↓)       Perth 0.9% (↓)       Hobart 0.9% (↓)       Darwin 0.6% (↓)       Canberra 1.8% (↓)       National 1.1% (↓)            UNIT RENTAL VACANCY RATES AND TREND         Sydney 1.7% (↓)     Melbourne 2.6% (↑)        Brisbane 1.5% (↓)     Adelaide 1.0% (↑)        Perth 0.7% (↓)       Hobart 1.7% (↓)     Darwin 1.2% (↑)        Canberra 3.2% (↓)       National 1.7% (↓)            AVERAGE DAYS TO SELL HOUSES AND TREND       Sydney 30.5 (↑)        Melbourne 30.8 (↓)     Brisbane 31.8 (↑)      Adelaide 25.2 (↑)        Perth 36.5 (↓)     Hobart 30.1 (↑)        Darwin 31.3 (↓)       Canberra 29.2 (↓)       National 30.7 (↓)            AVERAGE DAYS TO SELL UNITS AND TREND       Sydney 31.3 (↑)        Melbourne 31.6 (↓)       Brisbane 29.4 (↓)       Adelaide 24.9 (↓)       Perth 36.8 (↓)       Hobart 26.4 (↓)       Darwin 41.1 (↓)     Canberra 40.1 (↑)        National 32.7 (↓)           
Share Button

He Stole Hundreds of iPhones and Looted People’s Life Savings. He Told Us How.

A convicted iPhone thief explains how a vulnerability in Apple’s software got him fast cash—and then a stint in a high-security prison

By JOANNA STERN
Thu, Dec 21, 2023 8:37amGrey Clock 5 min

RUSH CITY, Minn.—Before the guards let you through the barbed-wire fences and steel doors at this Minnesota Correctional Facility, you have to leave your phone in a locker. Not a total inconvenience when you’re there to visit a prolific iPhone thief.

I wasn’t worried that Aaron Johnson would steal my iPhone, though. I came to find out how he’d steal it.

“I’m already serving time. I just feel like I should try to be on the other end of things and try to help people,” Johnson, 26 years old, told me in an interview we filmed inside the high-security prison where he’s expected to spend the next several years.

For the past year, my colleague Nicole Nguyen and I have investigated a nationwide spate of thefts, where thieves watch iPhone owners tap their passcodes, then steal their targets’ phones—and upend their financial and digital lives.

Johnson, along with a crew of others, operated in Minneapolis for at least a year during 2021 and 2022. In and around bars at night, he would befriend young people, slyly learn their passcodes and take their phones. Using that code, he’d lock victims out of their Apple accounts and loot thousands of dollars from their bank apps. Finally, he’d sell the phones themselves.

It was an elaborate, opportunistic scheme that exploited the Apple ecosystem and targeted trusting iPhone owners who figured a stolen phone was just a stolen phone.

Last week, Apple announced Stolen Device Protection, a feature that likely will protect against these passcode-assisted crimes.

Yet even when you install the software, due in iOS 17.3, there will be loopholes. The biggest loophole? Us. By hearing how Johnson did what he did, we can learn how to better secure the devices that hold so much of our lives.

How he got started

Johnson isn’t a sophisticated cybercriminal. He said he got his start pickpocketing on the streets of Minneapolis. “I was homeless,” he said. “Started having kids and needed money. I couldn’t really find a job. So that’s just what I did.”

Soon he realised the phones he was nabbing could be worth a lot more—if only he had a way to get inside them. Johnson said no one taught him the passcode trick, he just stayed up late one night fiddling with a phone and figured out how to use the passcode to unlock a bounty of protected services.

“That passcode is the devil,” he said. “It could be God sometimes—or it could be the devil.”

According to the Minneapolis Police Department’s arrest warrant, Johnson and the other 11 members of the enterprise allegedly accumulated nearly $300,000. According to him, it was likely more.

“I had a rush for large amounts at a time,” he said. “I just got too carried away.”

In March, Johnson, who had prior robbery and theft convictions, pleaded guilty to racketeering and was sentenced to 94 months. He told the judge he was sorry for what he did.

How he did it

Here’s how the nightly operation would go down, according to interviews with Johnson, law-enforcement officials and some of the victims:

Pinpoint the victim. Dimly lit and full of people, bars became his ideal location. College-age men became his ideal target. “They’re already drunk and don’t know what’s going on for real,” Johnson said. Women, he said, tended to be more guarded and alert to suspicious behaviour.

Get the passcode. Friendly and energetic, that’s how victims described Johnson. Some told me he approached them offering drugs. Others said Johnson would tell them he was a rapper and wanted to add them on Snapchat. After talking for a bit, they would hand over the phone to Johnson, thinking he’d just input his info and hand it right back.

“I say, ‘Hey, your phone is locked. What’s the passcode?’ They say, ‘2-3-4-5-6,’ or something. And then I just remember it,” Johnson described. Sometimes he would record people typing their passcodes.

Once the phone was in his hand, he’d leave with it or pass it to someone else in the crew.

Lock them out—fast. Within minutes of taking the iPhones, Johnson was in the Settings menu, changing the Apple ID password. He’d then use the new password to turn off Find My iPhone so victims couldn’t log in on some other phone or computer to remotely locate—and even erase—the stolen device.

Johnson was changing passwords fast—“faster than you could say supercalifragilisticexpialidocious,” he said. “You gotta beat the mice to the cheese.”

Take the money. Johnson said he would then enrol his face in Face ID because “when you got your face on there, you got the key to everything.” The biometric authentication gave Johnson quick access to passwords saved in iCloud Keychain.

Savings, checking, cryptocurrency apps—he was looking to transfer large sums of money out. And if he had trouble getting into those money apps, he’d look for extra information, such as Social Security numbers, in the Notes and Photos apps.

By the morning, he’d have the money transferred. That’s when he’d head to stores to buy stuff using Apple Pay. He’d also use the stolen Apple devices to buy more Apple devices, most often $1,200 iPad Pro models, to sell for cash.

Sell the phones. Finally, he’d erase the phone and sell it to Zhongshuang “Brandon” Su who, according to his arrest warrant, sold them overseas.

While Johnson did steal some Android phones, he went after iPhones because of their higher resale value. At bars, he’d scope out the scene—looking for iPhone Pro models with their telltale trio of cameras. He said Pro Max with a terabyte of storage could get him $900. Su also bought Johnson’s purchased iPads.

Su pleaded guilty to receiving stolen property and was sentenced to 120 days at an adult corrections facility in Hennepin County, Minn. Neither Su nor his lawyer responded to requests for comment.

On a good weekend, Johnson said, he was selling up to 30 iPhones and iPads to Su and making around $20,000—not including money he’d taken from victims’ bank apps, Apple Pay and more.

How you can prevent it

A week after my trip to Minnesota, Apple announced Stolen Device Protection. The security setting will likely foil most of Johnson’s tricks, but it won’t be turned on automatically.

If you don’t turn it on, you’re as vulnerable as ever. Switching it on adds a line of defence to your phone when away from familiar locations such as home or work.

To change the Apple ID password, a thief would need Face ID or Touch ID biometric scans—that is, your face or your finger. The passcode alone won’t work. And the process has a built-in hourlong delay, followed by another biometric scan. This same slow process is also required for adding a new Face ID and disabling Find my iPhone.

Some functions, such as accessing saved passwords in iCloud Keychain or erasing the iPhone, are available without the delay but still require Face ID or Touch ID.

A criminal might still be motivated to kidnap a person with lots of money, then slowly break through these layers of security. However, the protections will likely dissuade thieves who just want to grab phones and flee the scene.

So what loopholes remain? A thief who gets the passcode could still buy things with Apple Pay. And any app that isn’t protected by an additional password or PIN—like your email, Venmo, PayPal and more—is also vulnerable.

That’s why you should also:

  • Add a distinct passcode to money apps, like Venmo and Cash App.
  • Delete any notes or photos that include personal information such as passwords or Social Security numbers. Store that stuff in a secure note inside a third-party password manager, such as Dashlane or 1Password.
  • Create a stronger iPhone passcode—one that uses letters and numbers.

The most obvious is Johnson’s advice: Watch your surroundings and don’t give your passcode out.

If this crime has taught us anything, it’s that a single device now contains access to our entire lives—our memories, our money and more. It’s on us to protect them.

Nicole Nguyen contributed to this article.



MOST POPULAR
11 ACRES ROAD, KELLYVILLE, NSW

This stylish family home combines a classic palette and finishes with a flexible floorplan

35 North Street Windsor

Just 55 minutes from Sydney, make this your creative getaway located in the majestic Hawkesbury region.

Related Stories
Money
This Company Won Big With Bitcoin and AI. Why It’s Now Favoring One Over the Other
By Avi Salzman 02/12/2024
Money
Hong Kong Is Becoming Hub for Financial Crime, U.S. Lawmakers Say
By RICHARD VANDERFORD 27/11/2024
Money
The exclusive club more Australians are joining
By KANEBRIDGE NEWS 26/11/2024
This Company Won Big With Bitcoin and AI. Why It’s Now Favoring One Over the Other
By Avi Salzman
Mon, Dec 2, 2024 3 min

Austin, Texas, company Core Scientific went from bankruptcy to stock market darling this year by betting on two technologies: Bitcoin mining and AI data centers. Shares are up 400%.

But if given the choice of whether to invest more in one business over the other, executives answer without hesitating: the data centers.

“We really just value long-term, stable cash flows and predictable returns,” Chief Operating Officer Matt Brown said in an interview. The company began life as a Bitcoin miner. Even though Bitcoin has been a great asset lately, it’s very volatile. By comparison, Core Scientific can earn steady profits for years by hosting servers owned by companies that sell cloud services to AI providers, Brown said.

This year, you couldn’t go wrong betting on either. Bitcoin is up 116%, and data centers are in high demand because tech companies need them to power their AI applications.

The two technologies seem to have little in common, but they both depend on the same thing: access to reliable power. Core Scientific has a lot of it, operating nine grid-connected warehouses in six states with access to so much electricity they could serve several hundred thousand homes. Other Bitcoin miners have similarly transitioned to data center hosting , but few with quite so much success.

Core Scientific’s business didn’t look quite so good at the start of the year. The company started 2024 under the shadow of bankruptcy protection. It had too much debt on its balance sheet after going public through the SPAC process in 2022 and succumbed to a Bitcoin price crash. But the company’s fortunes quickly turned around after it emerged from bankruptcy on Jan. 23 with $400 million less debt.

The company started the year focused entirely on crypto mining, but quickly pivoted as it saw demand surge for electricity for AI data centers.

In June, the company signed a deal with a company called Coreweave to lease data center space for AI cloud services. Coreweave has since agreed to lease 500 megawatts worth of space. Core Scientific says it will get paid $8.7 billion over 12 years under the deal.

Privately held Coreweave is one of the fastest-growing companies behind the AI revolution. It was once a cryptocurrency miner, but has since transitioned to offering cloud services, with a particular focus on artificial intelligence. It’s closely connected to Nvidia , which has invested money in Coreweave and given the company access to its top-end chips. Coreweave expects to be one of the first customers for Nvidia ’s upcoming Blackwell GPUs.

Core Scientific’s quick success in this new world has surprised even the people who are driving it.

“Every once in a while I need to pinch myself, to see I’m actually not dreaming,” Brown said.

Core Scientific’s success does create a high bar for the stock to keep rising. The company is expected to lose money this year, largely because of a change in the value of stock warrants—an accounting shift that doesn’t reflect underlying earnings. Analysts see the company becoming profitable in 2025, when more of its data center deals start to hit the bottom line. They see EPS jumping tenfold by 2027. Shares trade at about 13 times those 2027 estimates.

The data center opportunity should only grow from here, as tech companies build more powerful AI systems. Of the 1,200 megawatts worth of gross power capacity Core Scientific has contracted, about 800 megawatts are going to data center computing deals and 400 megawatts toward Bitcoin mining.

Brown said the company has good relationships with its power suppliers and can potentially add more capacity without having to buy more real estate. It expects to be able to secure about 300 more megawatts worth of power at existing sites, perhaps by the end of the year.

It’s also in the hunt for new sites, including at “distressed” conventional data centers that have lost their tenants. Core Scientific has figured out how to quickly spiff up bare-bones data centers and turn them into high-tech sites with resources like liquid cooling equipment and much higher levels of electricity.

A single server rack in a standard data center might need 6 or 7 kilowatts of power. A high-performance data center can use as much as 130 kilowatts per rack; Core Scientific is working on increasing capacity to 400 kilowatts. The company likens the process of upgrading the warehouses to turning a ho-hum passenger vehicle into a Formula One racing car.

Core Scientific’s transformation from a broken-down jalopy to a hot rod has been a wild story. Its fate next year will depend on just how quickly the AI revolution unfolds.

MOST POPULAR
11 ACRES ROAD, KELLYVILLE, NSW

This stylish family home combines a classic palette and finishes with a flexible floorplan

35 North Street Windsor

Just 55 minutes from Sydney, make this your creative getaway located in the majestic Hawkesbury region.

Related Stories
Property
The ‘new frontier’ in Australian property is not where you think
By KANEBRIDGE NEWS 04/12/2024
Money
This Company Won Big With Bitcoin and AI. Why It’s Now Favoring One Over the Other
By Avi Salzman 02/12/2024
Lifestyle
Chinese EV Demand Sets Record. December Should Be Huge
By Al Root 02/12/2024
0
    Your Cart
    Your cart is emptyReturn to Shop