I have read this paper, which is answers part of the question. It answers, 'open wifi will help increase the spread speed and impact' but what I want to know is, can you 'plant' an open wifi access point/router and when any smartphone connects, it will be injected with botnet/malicious code ? Disregarding OS.
Barring an exploit in the drivers on a device, a smartphone would have to actually access some online service that could be compromised. The main risk with a rogue open wifi hotspot is that when SSL encryption is not used, the rogue network can replace the responses from requests to legitimate web sites and services with its own attempts at attacks.
The user would still have to access a service on the network (or have some service configured on their phone to automatically be accessed) and an exploit would have to be returned that is able to compromise the phone. This would generally be relatively difficult if a device is patched up to date, though may be a bigger risk if running outdated software.
It would take a rather complex attack to be able to try to compromise a large number of devices running different OSes and configurations as the services that would be called the the exploits that might allow access to take over the devices would be very different.
The only real advantage a rogue AP gives over any other attack on the Internet is that they can replace non-SSL (or otherwise authenticated and encrypted) protected calls to web sites and services with their own response. This only simplifies getting someone to access a compromised site though, it doesn't allow anything that couldn't be accomplished through a compromised link such as what might be found in a phishing e-mail.
It's also worth pointing out that the article you linked simply points out that open wireless networks can be used as an effective network connection for controlling a mobile botnet. It doesn't have anything to do with creating infections, just establishing that communication can be done reliably and that it makes detection of the bot nets operation through traffic analysis difficult.
|show 1 more comment|
A smart phone is just a computer. So if a given attack can spread over open wifi, spreading to a smartphone versus a traditional computer is just a matter of OS. Since you said to disregard OS, then the answer is a clear yes.
Obviously you'll need an attack vector, but presumably you would already have have that, otherwise the question is moot.