The new iPhone 3.0 software automatically launches the Safari browser in certain circumstances, a feature that makes the iPhone more usable and less secure.

Thomas Claburn, Editor at Large, Enterprise Mobility

July 7, 2009

2 Min Read

Apple's attention to usability appears to have left its iPhone vulnerable to Wi-Fi hotspot hijacking.

In a blog post, Max Moser, co-founder of the remote-exploit.org security group, describes how a feature in Apple's iPhone 3.0 software aims to make the iPhone more user-friendly and ends up making it less secure.

Version 3.0 of the iPhone software, according to Moser, is designed to automatically open a browser when trying to join a Wi-Fi network.

An iPhone running the 3.0 software issues a DNS request for Apple's Web site and a request for a specific Web page. If its queries prove successful, it assumes network connectivity is okay. If it receives no response, it assumes there's no network available.

But if it receives a response from a site other than Apple's, it assumes the user is trying to access the network through a portal that requires authentication, as is often found at hotels or public Wi-Fi hotspots. To help users complete the authentication process, the iPhone software automatically opens Apple's Safari browser.

"It seems like Apple was thinking, 'Damn, that's annoying for the user...lets open up Safari automatically if this special case comes into place,'" Moser says.

That behavior, however, offers an opportunity for exploitation, as first noted by security researcher Lothar Gramelspacher.

Using penetration testing software called karmetasploit and the appropriate network hardware, an attacker can set up his or her own Wi-Fi hotspot. When an iPhone user tries to join this malicious Wi-Fi network, the attacker can capture iPhone cookies, account information, and perhaps more, depending on whether other vulnerabilities in Safari or other iPhone software can be exploited.

Moser has posted a video showing how the attack works.

It should be said that a malicious network represents a risk to any connecting device. The iPhone's automatic browser launch, however, does serve to magnify that risk.

Apple did not respond to a request for comment.

About the Author(s)

Thomas Claburn

Editor at Large, Enterprise Mobility

Thomas Claburn has been writing about business and technology since 1996, for publications such as New Architect, PC Computing, InformationWeek, Salon, Wired, and Ziff Davis Smart Business. Before that, he worked in film and television, having earned a not particularly useful master's degree in film production. He wrote the original treatment for 3DO's Killing Time, a short story that appeared in On Spec, and the screenplay for an independent film called The Hanged Man, which he would later direct. He's the author of a science fiction novel, Reflecting Fires, and a sadly neglected blog, Lot 49. His iPhone game, Blocfall, is available through the iTunes App Store. His wife is a talented jazz singer; he does not sing, which is for the best.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights