Hackers could have drained your Venmo account in minutes, thanks to Siri

Venmo’s flaw could have allowed anyone to use Siri on a locked iPhone to empty your account [Video]

Martin Vigo, a product security engineer for SalesForce recently discovered that by just using Siri, anyone could empty a Venmo account on a locked iPhone in less than two minutes, stealing as much as the weekly limit of $2999.99.
Venmo is a PayPal-owned money payment service app that allows users to transfer money between one another using a mobile phone or web interface. The users can link their bank accounts, debit cards, or credit cards to their Venmo account and use it to pay bills, friends with just a few taps. Besides sending money, you can also request people to pay you.
One of the app’s features is that it allows one user to “charge” other users for something, which results in an SMS notification being sent to the person who was charged. When that happens, the recipient can reply to the SMS with a six-digit code that was sent in the original message, which completes the payment.

Vigo contacted and notified the payment service, who patched the design flaws in the Venmo app and iOS that allowed stealing money from other people’s Venmo accounts. They responded within 18 days of being notified by killing the SMS “reply-to-pay” functionality in order to prevent such attacks.

How did this vulnerability occur?

The vulnerabilities have to do with the way iOS allows you to perform a limited range of actions, like sending text messages and initiating phone calls, without actually having to unlock the phone with a PIN number or fingerprint. In combination with Siri commands and other methods, the flaws allow an attacker to compel a victim to make a payment through the Venmo app.