Vulnerabilities / Threats
03:11 PM
Connect Directly

Apple's iPhone Vulnerable To Hotspot Hijacking

The new iPhone 3.0 software automatically launches the Safari browser in certain circumstances, a feature that makes the iPhone more usable and less secure.

Apple's attention to usability appears to have left its iPhone vulnerable to Wi-Fi hotspot hijacking.

In a blog post, Max Moser, co-founder of the security group, describes how a feature in Apple's iPhone 3.0 software aims to make the iPhone more user-friendly and ends up making it less secure.

Version 3.0 of the iPhone software, according to Moser, is designed to automatically open a browser when trying to join a Wi-Fi network.

An iPhone running the 3.0 software issues a DNS request for Apple's Web site and a request for a specific Web page. If its queries prove successful, it assumes network connectivity is okay. If it receives no response, it assumes there's no network available.

But if it receives a response from a site other than Apple's, it assumes the user is trying to access the network through a portal that requires authentication, as is often found at hotels or public Wi-Fi hotspots. To help users complete the authentication process, the iPhone software automatically opens Apple's Safari browser.

"It seems like Apple was thinking, 'Damn, that's annoying for the user...lets open up Safari automatically if this special case comes into place,'" Moser says.

That behavior, however, offers an opportunity for exploitation, as first noted by security researcher Lothar Gramelspacher.

Using penetration testing software called karmetasploit and the appropriate network hardware, an attacker can set up his or her own Wi-Fi hotspot. When an iPhone user tries to join this malicious Wi-Fi network, the attacker can capture iPhone cookies, account information, and perhaps more, depending on whether other vulnerabilities in Safari or other iPhone software can be exploited.

Moser has posted a video showing how the attack works.

It should be said that a malicious network represents a risk to any connecting device. The iPhone's automatic browser launch, however, does serve to magnify that risk.

Apple did not respond to a request for comment.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio