Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access point/router and when any smartphone connects, it will be injected with botnet/malicious code ? Disregarding OS.

share|improve this question

Barring an exploit in the drivers on a device, a smartphone would have to actually access some online service that could be compromised. The main risk with a rogue open wifi hotspot is that when SSL encryption is not used, the rogue network can replace the responses from requests to legitimate web sites and services with its own attempts at attacks.

The user would still have to access a service on the network (or have some service configured on their phone to automatically be accessed) and an exploit would have to be returned that is able to compromise the phone. This would generally be relatively difficult if a device is patched up to date, though may be a bigger risk if running outdated software.

It would take a rather complex attack to be able to try to compromise a large number of devices running different OSes and configurations as the services that would be called the the exploits that might allow access to take over the devices would be very different.

The only real advantage a rogue AP gives over any other attack on the Internet is that they can replace non-SSL (or otherwise authenticated and encrypted) protected calls to web sites and services with their own response. This only simplifies getting someone to access a compromised site though, it doesn't allow anything that couldn't be accomplished through a compromised link such as what might be found in a phishing e-mail.

It's also worth pointing out that the article you linked simply points out that open wireless networks can be used as an effective network connection for controlling a mobile botnet. It doesn't have anything to do with creating infections, just establishing that communication can be done reliably and that it makes detection of the bot nets operation through traffic analysis difficult.

share|improve this answer
You're incorrect about the rogue AP because you're focusing exclusively on HTTP or HTTPS as a vector for infection. A web request is not required to compromise a host, and a rogue AP allows for attacks on any vulnerable service or polling process on the mobile device. – Brandon Franklin Jun 7 '13 at 2:20
@brandonfranklin No I'm not. A web request is the polling process you are referring to. Unless there is an exploit to abuse one of these (unlikely on a patched device) then options are limited – AJ Henderson Jun 7 '13 at 5:27
AJ, there are more things a mobile device does than poll HTTP. Mail protocols, for example, amongst others. – Brandon Franklin Jun 7 '13 at 12:18
I really don't want to keep up the back and forth (feel free to have the last word), but you're still focusing on javascript and phishing as vectors for infecting. A rogue AP is the single best way to be in a position to conduct any attack that relies on stack or heap manipulation on a client service. It allows you to become a malicious peer on any connection from the device. I repeat, to say a rogue AP lets you achieve the same things as phishing emails or compromised websites is a misrepresentation of the risk they present. – Brandon Franklin Jun 8 '13 at 12:08
@BrandonFranklin - and I will say once again that my answer is not focusing on what you claim it is. In order to attack an up to date device, you would have to use a zero day exploit if you wanted to try to attack the drivers of the services themselves. Doing so on a local access point is a total waste of a zero day exploit as doing it on the internet itself could do far more damage. An unpatched device might be problematic if there is an unpatched driver vulnerability, but the risk is primarily going to come from injecting something to socially engineer a desired action as a MITM. – AJ Henderson Jun 9 '13 at 1:06

A smart phone is just a computer. So if a given attack can spread over open wifi, spreading to a smartphone versus a traditional computer is just a matter of OS. Since you said to disregard OS, then the answer is a clear yes.

Obviously you'll need an attack vector, but presumably you would already have have that, otherwise the question is moot.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.