News
iPhone 3.0 Wi-Fi feature opens new security hole
A new feature found in iPhone OS 3.0 has also created a new security liability, according to a security group member. The exploit is caused by the OS’ automatic opening of Safari when attempting to connect to a network. Remote-exploit.org co-founder Max Moser explains that when the iPhone joins a network, it tries to run a DNS query for apple.com, and open a simple HTML document stored on Apple’s website. If these two things happen without incident, it functions as normal, but in circumstances in which the DNS query is successful but it can’t retrieve the HTML file, it assumes there is a “captive portal”—a hotspot with a login/pay-to-use screen—and automatically opens Safari. When combined with the penetration testing software karmetasploit, this vulnerability could potentially be used to capture iPhone cookies, account information, and possibly more, depending on what other vulnerabilities are found. While this would require a malicious Wi-Fi network to be setup, which might also pose a threat to other devices, the iPhone’s new automatic connect sequence leaves it more vulnerable than most. [via InformationWeek]
Share This Article & Win an iTunes Gift Card. Next: Apple to recall some first-gen iPod nanos in Korea
Previous: Mix: Delicious Library, ChangeWave, total App cost, touch 3G
Comments
If you have a comment, news tip, advertising inquiry, or coverage request, a question about iPods or accessories, or if you sell or market iPod products or services, read iLounge's Comments + Questions policies before posting, and fully identify yourself if you do. We will delete comments containing advertising, astroturfing, trolling, personal attacks, offensive language, or other objectionable content, then ban and/or publicly identify violators.
Recent News
- Enter the CES Exhibits Plus Pass Giveaway today
- Wider distribution boosting iPhone sales in France
- Chinon rolls out AVi portable iPod speaker
- TomTom intros separate Car Kit for iPod touch
- iLounge and MusicSkins announce the Ultimate Design Contest
- Latest edition of iPodweek coming shortly
- Apple planning more iPod touch apps for retail?
- Gameloft, others cutting back on Android development
- Google launches Google News for iPhone, iPod touch
- Magellan releases RoadMate app, Car Kit coming
Recent Reviews
- Electronic Arts Command & Conquer Red Alert
- Bowers & Wilkins Zeppelin Mini
- iHome iHM79 Rechargeable Mini Speakers
- Elexa Consumer Products iBlink
- Bose SoundDock 10
- Shure SE115m+ Sound Isolating Headset
- Apple Remote (2009)
- Kensington Travel Battery Pack and Charger for iPhone
- Tapulous Metallica Revenge
- Electronic Arts NBA Live by EA Sports
Recent Articles
- The Complete Guide to Using the iTunes Store
- iPhone Gems: Brain Challenge 2, Impossible Quiz, Jeopardy, Trivia Wars + Wheel of Fortune
- The Complete Guide to Album Tagging, Art and Playlists in iTunes
- Ask iLounge 11-13-09
- The Complete Guide to iTunes Audiobooks, Podcasts + iTunes U
- Ask iLounge 11-6-09
- iPhone Gems: Asphalt 5 and Doom Classic
- Ask iLounge 10-30-09
- Instant Expert: Secrets & Features of Apple TV 3.0
- Ask iLounge 10-23-09
1
English! Does anyone speak English? What does that mean?
Posted by Mark on July 8, 2009 at 6:05 PM (PDT)
2
@Mark: The new OS has a feature where it will automatically try to login for you, when you connect to a wifi hotspot that has a web login page.
For example, when I connect to my country’s free national wifi, I have to login via a webpage before I can actually access the internet. The OS will detect this, and automatically open Safari to login for you (if it knows your credentials) or present you with the login page (if it doesn’t know your credentials).
So theoretically, I could set up a free wifi hotspot on my laptop sitting at Starbucks, give it a mislead SSID (“FREE WIFI ZONE”) and put in a captive portal “login” page that is loaded with remote exploits.
It’s a bit of a stretch, and personally I find the autologin feature happily convenient.
Posted by ketsugi on July 8, 2009 at 8:16 PM (PDT)
3
Ah, my Touch has started popping up a login screen for The Cloud since I upgraded to OS v3, I wondered how it worked.
To number 2, it’s actually worse than that. Rather than ‘Free WiFi Zone’, you set the rogue AP up with the same SSID as of one of the national networks.
In the UK, you’d set your evil twin up with The Cloud’s SSID. All UK iPhones already know about The Cloud because they are O2’s WiFi partner, so every iPhone passing will automatically try and connect.
Put the rogue AP in the car-park of a McDonalds (all UK McDs have Cloud-provided free WiFi) and no-one will think twice if their iPhone connects to The Cloud.
Alan.
Posted by Alan Edwards on July 9, 2009 at 7:47 AM (PDT)