iPhone 3.0 Wi-Fi feature opens new security hole

News

iPhone 3.0 Wi-Fi feature opens new security hole

A new feature found in iPhone OS 3.0 has also created a new security liability, according to a security group member. The exploit is caused by the OS’ automatic opening of Safari when attempting to connect to a network. Remote-exploit.org co-founder Max Moser explains that when the iPhone joins a network, it tries to run a DNS query for apple.com, and open a simple HTML document stored on Apple’s website. If these two things happen without incident, it functions as normal, but in circumstances in which the DNS query is successful but it can’t retrieve the HTML file, it assumes there is a “captive portal”—a hotspot with a login/pay-to-use screen—and automatically opens Safari. When combined with the penetration testing software karmetasploit, this vulnerability could potentially be used to capture iPhone cookies, account information, and possibly more, depending on what other vulnerabilities are found. While this would require a malicious Wi-Fi network to be setup, which might also pose a threat to other devices, the iPhone’s new automatic connect sequence leaves it more vulnerable than most. [via InformationWeek]

« Apple to recall some first-gen iPod nanos in Korea

Mix: Delicious Library, ChangeWave, total App cost, touch 3G »

Comments

1

English! Does anyone speak English? What does that mean?

Posted by Mark on July 8, 2009 at 5:05 PM (PST)

2

@Mark: The new OS has a feature where it will automatically try to login for you, when you connect to a wifi hotspot that has a web login page.

For example, when I connect to my country’s free national wifi, I have to login via a webpage before I can actually access the internet. The OS will detect this, and automatically open Safari to login for you (if it knows your credentials) or present you with the login page (if it doesn’t know your credentials).

So theoretically, I could set up a free wifi hotspot on my laptop sitting at Starbucks, give it a mislead SSID (“FREE WIFI ZONE”) and put in a captive portal “login” page that is loaded with remote exploits.

It’s a bit of a stretch, and personally I find the autologin feature happily convenient.

Posted by ketsugi on July 8, 2009 at 7:16 PM (PST)

3

Ah, my Touch has started popping up a login screen for The Cloud since I upgraded to OS v3, I wondered how it worked.

To number 2, it’s actually worse than that. Rather than ‘Free WiFi Zone’, you set the rogue AP up with the same SSID as of one of the national networks.

In the UK, you’d set your evil twin up with The Cloud’s SSID. All UK iPhones already know about The Cloud because they are O2’s WiFi partner, so every iPhone passing will automatically try and connect.

Put the rogue AP in the car-park of a McDonalds (all UK McDs have Cloud-provided free WiFi) and no-one will think twice if their iPhone connects to The Cloud.

Alan.

Posted by Alan Edwards on July 9, 2009 at 6:47 AM (PST)

If you have a comment, news tip, advertising inquiry, or coverage request, a question about iPods/iPhones/iPad or accessories, or if you sell or market iPod/iPhone/iPad products or services, read iLounge's Comments + Questions policies before posting, and fully identify yourself if you do. We will delete comments containing advertising, astroturfing, trolling, personal attacks, offensive language, or other objectionable content, then ban and/or publicly identify violators.

Recent Reviews

New Deals

Shop for Accessories: Cases, speakers, chargers, etc.

iLounge

News