Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there any risk when connecting an Android Phone to a [Verizon] iPhone's Hotspot? If there are I'd like to know about solutions.

The Android Phone will basically be tapping the data plan of the iPhone through its turned on Hotspot.

share|improve this question
1  
Is this the exact same question as "what is the danger of connecting to a wireless network that I don't own?" I think so. – KnightOfNi Apr 26 '14 at 22:11
1  
It's not the same, because I know the connection I'm connecting too. You can look at it this way, I own both phones: One phone has a data plan and another phone doesn't. That phone without a data plan is using the hotspot of the phone that has a data plan. -- Is the security weak in terms of hotspot? What risk comes with using hotspot? etc.. – Green Apr 27 '14 at 3:33
    
I see. Could you provide more information about the hotspot your iPhone sets up? Specifically, knowing the encryption type would be nice. – KnightOfNi Apr 28 '14 at 0:00
    
I believe its a WPA2 encryption. – Green Apr 29 '14 at 16:35

If you control both devices, then the only extra risk I would be concerned about is someone sniffing the wireless traffic between the two, so use decent encryption, and possibly restrict access by MAC address etc and you should be fine.

share|improve this answer

Assuming the Verizon hotspot is actually what it says it is, then no, you shouldn't have an issue. However, if it's a WiFi Pineapple thing, meaning a rogue access point which any idiot could throw up, then yes, be afraid, very afraid.

There's a lot of things people can do with a rogue access point. Here are a couuple:

  1. Running a drive-by download on the "login" page.
  2. Phishing your credentials with replaced pages using a man-in-the-middle attack

But if you control both devices, and the hotspot is legit, then you should be fine, generally speaking.

share|improve this answer

When you're using Personal Hotspot on iOS (no idea about the behavior on other OSes), it opens a new PDP context on a specific APN informing the carrier that personal hotspot is being used (so these crooks can bill you differently even though it's costing them the same). That "context" has its own IP address and appears as a separate network interface on the personal hotspot iPhone which is then bridged with the Wi-Fi access point interface.

This means that personal hotspot traffic could end up somewhere else compared to normal traffic, and that somewhere else could be less secure, possibly having compromised equipment in its path which could put devices connected to the personal hotspot at risk while leaving the hotspot device fine as it uses a different PDP context (with a different IP address routed through a different network path) that wouldn't go through that same compromised equipment.

Now, is this "compromised network equipment" scenario actually likely? A popular mobile ISP I used to work at for example is using a third-party company to do web filtering to block adult entertainment websites on their mobile network, which means all the web traffic most likely goes through them. In addition, the customer's accounts are managed using Windows XP machines with Internet Explorer 8 (with unrestricted web access), Flash, Silverlight and Java installed on them. And these machines have credit card readers which see a lot of use throughout the day. Having seen that, I would not trust their mobile network more than the local McDonalds Wi-Fi. Your opinion might vary of course.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.