News
iPhone 3.0 Wi-Fi feature opens new security hole
A new feature found in iPhone OS 3.0 has also created a new security liability, according to a security group member. The exploit is caused by the OS’ automatic opening of Safari when attempting to connect to a network. Remote-exploit.org co-founder Max Moser explains that when the iPhone joins a network, it tries to run a DNS query for apple.com, and open a simple HTML document stored on Apple’s website. If these two things happen without incident, it functions as normal, but in circumstances in which the DNS query is successful but it can’t retrieve the HTML file, it assumes there is a “captive portal”—a hotspot with a login/pay-to-use screen—and automatically opens Safari. When combined with the penetration testing software karmetasploit, this vulnerability could potentially be used to capture iPhone cookies, account information, and possibly more, depending on what other vulnerabilities are found. While this would require a malicious Wi-Fi network to be setup, which might also pose a threat to other devices, the iPhone’s new automatic connect sequence leaves it more vulnerable than most. [via InformationWeek]
Share This Article & Win an iTunes Gift Card. Next: Apple to recall some first-gen iPod nanos in Korea
Previous: Mix: Delicious Library, ChangeWave, total App cost, touch 3G
Comments
If you have a comment, news tip, advertising inquiry, or coverage request, a question about iPods or accessories, or if you sell or market iPod products or services, read iLounge's Comments + Questions policies before posting, and fully identify yourself if you do. We will delete comments containing advertising, astroturfing, trolling, personal attacks, offensive language, or other objectionable content, then ban and/or publicly identify violators.
Recent News
- Apple launches Reserve and Pick Up retail service
- Apple patent points to simplified data sharing
- iPodweek coming shortly, still time to register
- Apple rolling out updated iTunes LP/Extras files
- Apple seeking new iPhone security manager
- Vers launches open-front Shellcases for iPod, iPhone
- iPhone developer accused of stealing phone numbers
- Quirky intros Beamer case for iPhone 3G, 3GS
- Apple’s Jobs named ‘CEO of the decade’
- Intel responds on iPhone sync issues
Recent Reviews
- Elexa Consumer Products iBlink
- Bose SoundDock 10
- Shure SE115m+ Sound Isolating Headset
- Apple Remote (2009)
- Kensington Travel Battery Pack and Charger for iPhone
- Tapulous Metallica Revenge
- Electronic Arts NBA Live by EA Sports
- Edifier iF500 Luna5 Encore
- Griffin iTrip for iPod + iPhone With iTrip Controller App
- XtremeMac Luna Voyager
Recent Articles
- iPhone Gems: Asphalt 5 and Doom Classic
- Ask iLounge 10-30-09
- Instant Expert: Secrets & Features of Apple TV 3.0
- Ask iLounge 10-23-09
- iPhone Gems: Copy Cat, Derek Jeter Baseball, I Am T-Pain, MotionX GPS Drive, Pang + Real Racing GTI
- iPhone Gems: 2XL ATV Offroad, Adrenaline Golf Online + Iron Fist Boxing 3rd Strike
- iPhone Gems: BombLink, Rock Band + Tap Tap Revenge 3
- Ask iLounge 10-16-09
- iPhone Gems: Global Eater, NPR News, Pocket Tunes Radio, scanR + vTuner Radio
- iPhone Gems: Itsy Bitsy Spider and Little Red Hen Childrens’ Books
1
English! Does anyone speak English? What does that mean?
Posted by Mark on July 8, 2009 at 6:05 PM (PDT)
2
@Mark: The new OS has a feature where it will automatically try to login for you, when you connect to a wifi hotspot that has a web login page.
For example, when I connect to my country’s free national wifi, I have to login via a webpage before I can actually access the internet. The OS will detect this, and automatically open Safari to login for you (if it knows your credentials) or present you with the login page (if it doesn’t know your credentials).
So theoretically, I could set up a free wifi hotspot on my laptop sitting at Starbucks, give it a mislead SSID (“FREE WIFI ZONE”) and put in a captive portal “login” page that is loaded with remote exploits.
It’s a bit of a stretch, and personally I find the autologin feature happily convenient.
Posted by ketsugi on July 8, 2009 at 8:16 PM (PDT)
3
Ah, my Touch has started popping up a login screen for The Cloud since I upgraded to OS v3, I wondered how it worked.
To number 2, it’s actually worse than that. Rather than ‘Free WiFi Zone’, you set the rogue AP up with the same SSID as of one of the national networks.
In the UK, you’d set your evil twin up with The Cloud’s SSID. All UK iPhones already know about The Cloud because they are O2’s WiFi partner, so every iPhone passing will automatically try and connect.
Put the rogue AP in the car-park of a McDonalds (all UK McDs have Cloud-provided free WiFi) and no-one will think twice if their iPhone connects to The Cloud.
Alan.
Posted by Alan Edwards on July 9, 2009 at 7:47 AM (PDT)