Network World - A new report from a mobile security vendor details how the most popular smartphones, including the iPhone, are vulnerable to man-in-the-middle attacks, carried out via public Wi-Fi connections.
According to the report by SMobile Systems, smartphone users connecting to unencrypted Wi-Fi hotspots can be easily compromised by knowledgeable attackers using an array of existing tools. The authors of the study used those tools to intercept username/password combinations sent from several different smartphones
The tests used a laptop with software tools to intercept communications between smartphones connecting to a Wi-Fi access point, and then to bypass SSL. That information was then used to access a variety of e-mail accounts. The same information could be used to access an online banking account or other information. More detail on the attack is found in the full report.
Smobile tested the Nokia N95, HTC Tilt running Windows Mobile, HTC G1 running Android, and the iPhone 3GS with the latest firmware. In each case, the user would have had no idea that their information had been compromised.
Examples of the tools used are Arpspoof, which redirects packets from a target host on the LAN to the intended host on the same LAN, by forging Address Resolution Protocol replies to the target host; SSLStrip, to hijack HTTP traffic; Ettercap, a utility for sniffing, intercepting and logging; or Wireshark, a network protocol analyzer used as a packet sniffer. Another tool, webspy, lets the attacker sniff out and open any Web pages accessed by the victim.
"Utilizing this method, the attacker has effectively told the victim device to route all traffic through the attacker's machine [laptop], and the attacker machine then forwards the requests to the Wi-Fi hotspot." The attack computer captures all the traffic and can modify or kill active connections. With SSL bypassed, as soon as the victim accesses an e-mail or other account, the login credentials will appear in plain text on the attack computer.
The authors of the study warn smartphone users to "seek out and identify applications that provide adequate encryption technologies to protect confidential or private information." Applications for doing so exist, but are still rare, the authors note. The goal should be end-to-end encryption between the client application and the target server. Lacking that, users need to be aware that their information can be visible to a snooper.
For enterprises, the key issue is to treat smartphones with Wi-Fi as if they were corporate laptops with Wi-Fi. That means client security software, for firewall and antivirus.
- Leverage the Power of APIs to Turbocharge Your Mobile Strategy: 7 Steps to a Successful API Program In this guide, Intel® Services-which offers industry-leading API management solutions for over 150 top enterprises, including Best Buy, Netflix, Expedia, ESPN, and The...
- Mission Critical Cloud Powers Freesat Website, Mobile App When subscription-free satellite TV service Freesat needed a scalable, cost-effective infrastructure it found the disaster recovery and security features it needed with Peer...
- Bring Your Own Device: From Security to Success Download this e-Book to learn best practices for executing a BYOD policy.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- API Management: The Key to Improving the Consumer Travel Experience Join PhoCusWright's Senior Technology Analyst, Norm Rose, as he shares his insights on how travel suppliers and intermediaries can improve industry data flow...
- Don't Believe the Hype: Not All Containers are Created Equal Hear executives discuss the 3 C's of Secure Mobility-content, credentials, and configurations-and learn the inherent security risks to your organization of using MDM... All Mobile/Wireless White Papers | Webcasts