Charlie Miller: Breaking iPhones and Taking Over a Jeep

Charlie Miller has a doctorate in mathematics, five years at the National Security Agency on his résumé, and a habit of breaking the devices everyone has just declared unbreakable. He was the first to remotely hack the iPhone, the first to hack the Android phone, and the man who took a MacBook Air in two minutes.

In 2015 he and Chris Valasek took control of a Jeep Cherokee over the internet while a journalist drove it down a St. Louis highway. Chrysler recalled 1.4 million vehicles, the first automotive recall ever triggered by a cybersecurity flaw.

Then the people building self-driving cars hired him. The man who proved a car could be hijacked from a couch now spends his days making sure the next one can't be.

Charlie Miller at a Glance

• Raised in Affton, Missouri, Miller studied mathematics at Truman State University and earned a PhD from the University of Notre Dame in 2000.
• The NSA hired him as a cryptographer, and he spent five years there before returning to St. Louis in 2005.
• In 2007, weeks after the iPhone went on sale, he and colleagues at Independent Security Evaluators became the first to remotely hack it, and in 2008 he did the same to the first Android phone.
• At Pwn2Own in March 2008 he compromised a MacBook Air in two minutes for $10,000 and the laptop, the first of four wins at hacking's biggest contest.
• In 2011 Apple expelled him from its developer program for a year after he slipped a proof-of-concept app called Instastock past the App Store's review.
• In 2013, with Chris Valasek and DARPA funding, he showed what a laptop plugged into a Ford Escape and a Toyota Prius could do to the brakes and steering.
• In July 2015 the pair hacked a 2014 Jeep Cherokee wirelessly, and Fiat Chrysler recalled 1.4 million vehicles within days.
• He's since worked on vehicle security at Uber, Didi Chuxing, Cruise and General Motors, and in 2025 he and Valasek keynoted a USENIX conference on ten years since the Jeep.

The Life of Charlie Miller

Miller's Early Years

Miller grew up in Affton, a working-class suburb of St. Louis. His mother died of cancer when he was seven, and his father, a city policeman who worked several jobs, left him with a lot of unsupervised time.

He went to Truman State University, then called Northeast Missouri State, intending to study computer science and drifting instead into mathematics and philosophy. Mathematics stuck, he later explained, because nobody could argue with a proof.

At Notre Dame he wrote a dissertation on the equations that describe light moving through fiber-optic cables and finished his PhD in 2000.

Five Years at Fort Meade

The NSA hired the new doctor as a cryptographer. He moved into computer security, and about the only thing he's ever said about the work is that it involved foreign targets and computer-network reconnaissance.

He left in 2005 and went home to St. Louis, where he took a job at a financial firm and kept hacking on the side. That year he found a previously unknown flaw in Linux and sold the details to the US government for $50,000, an early lesson in what a bug was worth.

Breaking the iPhone

The job that made his name was at Independent Security Evaluators, a Baltimore consultancy. In the summer of 2007 Apple shipped the iPhone, and within weeks Miller and his colleagues had found a flaw in its Safari browser that let a malicious web page take over the phone and read its text messages, contacts and voicemail.

Apple patched it, and Miller presented the details at Black Hat in Las Vegas on August 2, 2007. "Everyone believed Macs were totally secure and safe," he said later, "and I knew they weren't."

The next year he and his ISE colleagues did it again to the first Android phone, the T-Mobile G1, on the day it was released.

Two Minutes at Pwn2Own

Pwn2Own, the hacking contest held each spring in Vancouver, puts fully patched laptops in front of researchers and hands over the machine and a cash prize to whoever breaks in first. In March 2008 the prize machine was a MacBook Air.

Miller directed the organizers to a web page carrying his exploit and had control of the computer within two minutes, collecting $10,000 and the laptop while about 20 onlookers cheered.

He'd win the contest four times, more than anyone else at the time, and once declined to compete until the organizers put up real money. They did, and added a giant novelty check for good measure.

Along the way he co-wrote The Mac Hacker's Handbook with Dino Dai Zovi, who liked to tell Apple that if it wanted to know about the bugs inside, it could buy the book like everyone else.

Kicked Out by Apple

In the fall of 2011 Miller found a hole in iOS that let an approved app quietly download and run unapproved code. To prove it, he built a stock-ticker app called Instastock, submitted it to the App Store, and watched Apple approve it.

When he went public, Apple removed him from its iOS Developer Program for a year. "It seemed to me that I was helping Apple," he said. "And then when they did that, it seemed really shortsighted."

He was also busy elsewhere: a Black Hat paper that year on the firmware inside laptop batteries, a DARPA-funded project in 2012 that attacked phones through their near-field communication chips, and, that December, a new job on Twitter's security team that he could do from home in Missouri.

The Jeep on the Highway

Car hacking started as a DARPA-funded side project with Chris Valasek, a Pittsburgh researcher. In the summer of 2013 the two sat in the back seat of a Ford Escape and a Toyota Prius in a South Bend parking lot, laptops wired into the diagnostic port, and had the Wired reporter Andy Greenberg at the wheel while they honked the horn, yanked the seat belt and killed the brakes.

Two years later the wire was gone. On July 21, 2015, Wired published Greenberg's account of driving a 2014 Jeep Cherokee at 70 mph on Interstate 64 near St. Louis while Miller, on a laptop at home ten miles away, turned on the air conditioning, blasted the radio, started the wipers and then cut the transmission on a long overpass with a semi closing in behind.

Within three days Chrysler issued a formal recall of 1.4 million vehicles, the first automotive recall for a cybersecurity flaw, and Sprint blocked the attack on its cellular network. Two senators introduced a car-security bill the same day the story ran.

Building the Cars Instead

A month later, in August 2015, Uber hired both men for its Advanced Technologies Center in Pittsburgh, the lab building its self-driving fleet. Miller left in March 2017 for a brief stint at the Chinese ride-hailing giant Didi Chuxing, and that July he and Valasek reunited at Cruise, the autonomous-vehicle company General Motors had bought the year before.

They've been there, in one corporate form or another, ever since. In August 2025 the two gave the keynote at the USENIX VehicleSec conference in Seattle, titled "Ten Years After the Jeep Hack," with both listed as General Motors engineers.

Miller Today

Miller lives outside St. Louis, in Wildwood, Missouri, with a poster of the 1995 film Hackers on his wall. He describes his method as unglamorous: feeding programs millions of slightly broken inputs and watching for the crash that means something is wrong.

"It's hard," he's said of the work, "but when you're done, you have the satisfaction of being the only one who's ever done it."

Charlie Miller: Proof by Exploit

Mathematicians prove things. Miller just does it with running code instead of a chalkboard, and his proofs have a way of becoming recalls, patches and new laws.

Apple, Google and the car industry all learned the same lesson from him: the device you say is secure is only secure until Charlie Miller gets bored.

Now he's helping secure the cars he once showed everyone how to hack.