Could rogue WiFi points compromise unassuming Apple iPhone users? - SC Magazine UK
"I was recently interested in an opinion by security blogger Brian Krebs, who claimed that connection to a WiFi network could ‘make it easier for snoops to eavesdrop on your iPhone data usage'.
He claimed that Apple iPhone users who connect to open or public wireless networks should tell the device to forget the network's name after you are done using it.
He said: “For example, if you use your iPhone to connect to an open wireless network called ‘linksys', which happens to be the default, out-of-the-box name assigned to all Linksys home WiFi routers, your iPhone will in the future automatically connect to any WiFi network by that same name.
“The potential security and privacy threat here is that an attacker could abuse this behaviour to sniff the network for passwords and other sensitive information transmitted from nearby iPhones even when the owners of those phones have no intention of connecting to a wireless network, simply by giving his rogue access point a common name.”
As an iPhone user, there are times when its 3G connection are good enough to surf, use apps or simply use the basic phone function of making a call. However if you are looking to download files or ensure that an email or SMS is sent, perhaps a WiFi connection is more efficient.
What Krebs said though is to be wary of free WiFi connections that are available from coffee shops, pubs and restaurants, as if an attacker sets up a rogue wireless access point with a familiar name in a crowded place, they would likely be able to force a fair number of iPhones in the vicinity to automatically connect to his access point.
He said: “This attack scenario is more a reminder about basic wireless security safety than anything else. If you must use WiFi to communicate sensitive information make doubly sure that the web address of the site you are sending data to begins with an ‘https', or else any data you share with that site could be intercepted and read by anyone else on that same network.
“Also, if your web browser complains about a certificate or encryption error while you are trying to log on to a site or transmit sensitive data, it's probably safest to cancel that transaction, as it may be a sign that someone on the network is attempting to intercept the transmission.”
A recent pledge by Mayor of London Boris Johnson was to make London the world's biggest internet hotspot by 2012, with him claiming that 'every lamp post, every bus stop', in the capital will offer wireless internet access by the time the Olympic Games opens.
The proposal is expected to work by installing thousands of 'hotspots' into street lights and bus stops, with the boxes using the existing electrical supply and wiring, and would be able to cover a small distance around the area with WiFi.
A similar scheme already exists in the City of London, which offers users internet access anywhere. The plan is expected to allow both commuters and local homes to access the internet, although no details of pricing have been given.
I put this perspective to various people, and there was complete agreement with the perspective. Simon Ford, international sales director of NCP, said: “This is absolutely correct, when you log on to the internet at an airport, hotel or even at McDonalds or Starbucks the WiFi is provided and you have no idea what you are logging on to.
“Someone could log on to the WiFi and with a sniffer collect the data. I would not connect to a WiFi I did not know, I would hope no one goes to an airport and does online banking.”
So while the innovation of accessible WiFi could be the future of accessibility within city centres, should the mayor's plans come to fruition, there does seem to be caution exercised for users. Undoubtedly brilliant, could WiFi be the next vector for attack for unassuming users?"
No comments:
Post a Comment