iPhone 3.0 Wi-Fi feature opens new security hole | iLounge News

iPhone 3.0 Wi-Fi feature opens new security hole

A new feature found in iPhone OS 3.0 has also created a new security liability, according to a security group member. The exploit is caused by the OS’ automatic opening of Safari when attempting to connect to a network. Remote-exploit.org co-founder Max Moser explains that when the iPhone joins a network, it tries to run a DNS query for apple.com, and open a simple HTML document stored on Apple’s website. If these two things happen without incident, it functions as normal, but in circumstances in which the DNS query is successful but it can’t retrieve the HTML file, it assumes there is a “captive portal”—a hotspot with a login/pay-to-use screen—and automatically opens Safari. When combined with the penetration testing software karmetasploit, this vulnerability could potentially be used to capture iPhone cookies, account information, and possibly more, depending on what other vulnerabilities are found. While this would require a malicious Wi-Fi network to be setup, which might also pose a threat to other devices, the iPhone’s new automatic connect sequence leaves it more vulnerable than most. [via InformationWeek]

Related Stories



English!  Does anyone speak English?  What does that mean?  ;-)

Posted by Mark on July 8, 2009 at 9:05 PM (CDT)


@Mark: The new OS has a feature where it will automatically try to login for you, when you connect to a wifi hotspot that has a web login page.

For example, when I connect to my country’s free national wifi, I have to login via a webpage before I can actually access the internet. The OS will detect this, and automatically open Safari to login for you (if it knows your credentials) or present you with the login page (if it doesn’t know your credentials).

So theoretically, I could set up a free wifi hotspot on my laptop sitting at Starbucks, give it a mislead SSID (“FREE WIFI ZONE”) and put in a captive portal “login” page that is loaded with remote exploits.

It’s a bit of a stretch, and personally I find the autologin feature happily convenient.

Posted by ketsugi on July 8, 2009 at 11:16 PM (CDT)


Ah, my Touch has started popping up a login screen for The Cloud since I upgraded to OS v3, I wondered how it worked.

To number 2, it’s actually worse than that.  Rather than ‘Free WiFi Zone’, you set the rogue AP up with the same SSID as of one of the national networks.

In the UK, you’d set your evil twin up with The Cloud’s SSID.  All UK iPhones already know about The Cloud because they are O2’s WiFi partner, so every iPhone passing will automatically try and connect.

Put the rogue AP in the car-park of a McDonalds (all UK McDs have Cloud-provided free WiFi) and no-one will think twice if their iPhone connects to The Cloud.


Posted by Alan Edwards on July 9, 2009 at 10:47 AM (CDT)

Subscribe to iLounge Weekly

Sign up for the iLounge Weekly Newsletter

iLounge is an independent resource for all things iPod, iPhone, iPad, and beyond.
iPod, iPhone, iPad, iTunes, Apple TV, Mac, and the Apple logo are trademarks of Apple Inc.
iLounge is © 2001 - 2019 iLounge, Inc. All Rights Reserved. Terms of Use | Privacy Policy