In November 2009, trade coverage reported that SMobile Systems, a mobile security vendor, had published a report showing that the most popular smartphones, the iPhone among them, were open to man-in-the-middle attacks carried out over public Wi-Fi connections. The finding was aimed at anyone who read corporate email or logged into online accounts from a phone at a café, airport or hotel.
The report was still being cited the next year. A US government publication on managing smart phone security risks, retrieved in June 2010, listed it among its sources on mobile threats.
Timeline: from the report to the warnings that followed
November 2009: the report
SMobile Systems concluded that users who connected to unencrypted Wi-Fi hotspots could be compromised by knowledgeable attackers using existing tools. The authors did not rely on a new exploit. They used freely available methods against ordinary devices.
The tests used a laptop running software tools that sat between a smartphone and a Wi-Fi access point. The tools intercepted the traffic and then got around SSL protection. The authors used the intercepted usernames and passwords from several different phones to get into a range of email accounts. They noted that the same information could open an online banking account or other data.
Devices tested
SMobile tested four handsets: the Nokia N95, the HTC Tilt running Windows Mobile, the HTC G1 running Android, and the iPhone 3GS with the latest firmware at the time. The result therefore did not point at one operating system. It pointed at how phones and their applications handled traffic on open networks.
What defenders were told
The authors advised users to look for applications that provided adequate encryption for confidential information. They said such applications existed but were still rare. The goal, they said, should be end-to-end encryption between the client application and the target server. Without it, users should assume a snooper could see what they sent.
For enterprises, the central advice was to treat a smartphone with Wi-Fi as a corporate laptop with Wi-Fi. In practice that meant client security software, including a firewall and antivirus.
Late 2009 and 2010: wider coverage
Macworld UK carried a report under the headline “iPhone on Wi-Fi Vulnerable to Security Attack”, which the US government’s later paper on mobile phone threats listed as a source. A review of 2010 Wi-Fi security issues published by Network World described a related risk. Phones that joined an open or public network and were not told to forget it could be lured onto a fake network. Users caught that way could leak passwords and other private data, and could be exposed to malware and worms.
The same review covered Hole196, a flaw that let an insider on a WPA2 network get around encryption and authentication to scan devices for weaknesses. It was targeted at WPA (AES)/802.1x networks, but the review said it also applied to WPA/WPA2-PSK networks. It said the finders considered the attack simple and not detectable by traditional wire-side intrusion detection systems.
The trend behind it
The US government’s paper, “Cyber Threats to Mobile Phones” by Paul Ruggiero and Jon Foote, said smartphones’ popularity and relatively lax security had made them attractive targets. It cited a study finding that new vulnerabilities in mobile operating systems rose 42 percent from 2009 to 2010. It also said many users failed to switch on the security software that came with their phones, and believed browsing on a phone was as safe as, or safer than, browsing on a computer.
FAQ
Did the SMobile test need a special attack against the phones?
No. The authors said the attack relied on an array of existing tools, run from a laptop against phones connected to an unencrypted access point.
Why did the report matter to businesses?
Phones were storing email, calendars, contact details and passwords. The US government paper said these were increasingly valuable targets, which is why the report’s advice was to manage phones like laptops.