Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access point/router and when any smartphone connects, it will be injected with botnet/malicious code ? Disregarding OS.

share|improve this question
add comment

2 Answers

Barring an exploit in the drivers on a device, a smartphone would have to actually access some online service that could be compromised. The main risk with a rogue open wifi hotspot is that when SSL encryption is not used, the rogue network can replace the responses from requests to legitimate web sites and services with its own attempts at attacks.

The user would still have to access a service on the network (or have some service configured on their phone to automatically be accessed) and an exploit would have to be returned that is able to compromise the phone. This would generally be relatively difficult if a device is patched up to date, though may be a bigger risk if running outdated software.

It would take a rather complex attack to be able to try to compromise a large number of devices running different OSes and configurations as the services that would be called the the exploits that might allow access to take over the devices would be very different.

The only real advantage a rogue AP gives over any other attack on the Internet is that they can replace non-SSL (or otherwise authenticated and encrypted) protected calls to web sites and services with their own response. This only simplifies getting someone to access a compromised site though, it doesn't allow anything that couldn't be accomplished through a compromised link such as what might be found in a phishing e-mail.

It's also worth pointing out that the article you linked simply points out that open wireless networks can be used as an effective network connection for controlling a mobile botnet. It doesn't have anything to do with creating infections, just establishing that communication can be done reliably and that it makes detection of the bot nets operation through traffic analysis difficult.

share|improve this answer
    
You're incorrect about the rogue AP because you're focusing exclusively on HTTP or HTTPS as a vector for infection. A web request is not required to compromise a host, and a rogue AP allows for attacks on any vulnerable service or polling process on the mobile device. –  Brandon Franklin Jun 7 '13 at 2:20
2  
@brandonfranklin No I'm not. A web request is the polling process you are referring to. Unless there is an exploit to abuse one of these (unlikely on a patched device) then options are limited –  AJ Henderson Jun 7 '13 at 5:27
    
AJ, there are more things a mobile device does than poll HTTP. Mail protocols, for example, amongst others. –  Brandon Franklin Jun 7 '13 at 12:18
    
@BrandonFranklin I'll grant that technically email is a internet service rather than a web one, but the point is still equally valid. Someone polling their email server does no good for compromising unless it is a) not secured and b) they open something they shouldn't actively. I should have said any network service rather than web, but substitute network and everything I said and meant is still 100% valid. –  AJ Henderson Jun 8 '13 at 3:41
2  
@BrandonFranklin - and I will say once again that my answer is not focusing on what you claim it is. In order to attack an up to date device, you would have to use a zero day exploit if you wanted to try to attack the drivers of the services themselves. Doing so on a local access point is a total waste of a zero day exploit as doing it on the internet itself could do far more damage. An unpatched device might be problematic if there is an unpatched driver vulnerability, but the risk is primarily going to come from injecting something to socially engineer a desired action as a MITM. –  AJ Henderson Jun 9 '13 at 1:06
show 1 more comment

A smart phone is just a computer. So if a given attack can spread over open wifi, spreading to a smartphone versus a traditional computer is just a matter of OS. Since you said to disregard OS, then the answer is a clear yes.

Obviously you'll need an attack vector, but presumably you would already have have that, otherwise the question is moot.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.