We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
 
74,953 News Articles

Smartphone users at risk of security attacks

Using public Wi-Fi networks puts handsets at risk

Apple's iPhone and other smartphones are very vulnerable to man-in-the-middle attacks, carried out via public Wi-Fi connections, says SMobile Systems.

According to the report by the security firm, smartphone users connecting to unencrypted Wi-Fi hotspots can be easily compromised by knowledgeable attackers using an array of existing tools.

The authors of the study used those tools to intercept username/password combinations sent from several different smartphones

The tests used a laptop with software tools to intercept communications between smartphones connecting to a Wi-Fi access point, and then to bypass SSL.

That information was then used to access a variety of email accounts. The same information could be used to access an online banking account or other information. 

Smobile tested the Nokia N95, HTC Tilt running Windows Mobile, the T-Mobile G1 running Android and the iPhone 3GS with the latest firmware. In each case, the user would have had no idea that their information had been compromised.

Examples of the tools used are Arpspoof, which redirects packets from a target host on the LAN to the intended host on the same LAN, by forging Address Resolution Protocol replies to the target host; SSLStrip, to hijack HTTP traffic; Ettercap, a utility for sniffing, intercepting and logging; or Wireshark, a network protocol analySer used as a packet sniffer.

Another tool, webspy, lets the attacker sniff out and open any Web pages accessed by the victim.

"Utilising this method, the attacker has effectively told the victim device to route all traffic through the attacker's machine [laptop], and the attacker machine then forwards the requests to the Wi-Fi hotspot."

The attack computer captures all the traffic and can modify or kill active connections. With SSL bypassed, as soon as the victim accesses an email or other account, the login credentials will appear in plain text on the attack computer.

The authors of the study warn smartphone users to "seek out and identify applications that provide adequate encryption technologies to protect confidential or private information".

Applications for doing so exist, but are still rare, the authors note. The goal should be end-to-end encryption between the client application and the target server. Lacking that, users need to be aware that their information can be visible to a snooper.

For enterprises, the key issue is to treat smartphones with Wi-Fi as if they were corporate laptops with Wi-Fi. That means client security software, for firewall and antivirus.

Mobile phone buying advice

See all mobile phone reviews

See also: Smartphones a greater security risk than laptops


IDG UK Sites

Samsung Galaxy Note 4 release date, price and specs 2014

IDG UK Sites

What's the best smartwatch? 11 iWatch rivals compared in our wearables round-up

IDG UK Sites

App cloning: the mobile software industry’s hidden shame

IDG UK Sites

Developers get access to more Sony camera features