5

What are the appropriate steps to recommend for people to take after they connect their Android device to questionable open WiFi access points?

When I say "people", I mean friends and colleagues. I am not referring to establishing a corporate security policy.

This seems especially important for Android, since unlike some other operating systems, very few people actually use properly patched systems. For Android, the users can't really be blamed: manufacturers often do not release patches for their Android devices, and Google does not typically offer patches that can be applied on most devices.

If possible, in your answer, please cover any differences in best practices for non-rooted and rooted devices.

In your answer, please explain why you recommend each step.

Of course, the best advice is to instruct people to not connect to open WiFi access points. But getting people to abide by that advice is an uphill battle.

UPDATE: For those who thought their Android devices might be somewhat secure, Google just disclosed a slew of Android security issues, including six (6) that they categorized as critical. Has your Android device received patches for all these security issues?

  • It depends heavily on your threat model. Do these people have valuable data on their cell phones? Do they use properly secured applications? What do you fear might happen to them? That aside, there's one important component to any answer: VPN. If you don't trust the network, tunnel to one that you do. – Jesse K May 4 '16 at 3:20
  • Make a VPN server at home & connect to it. Now is sniffing useless. – Smit Johnth Sep 13 '17 at 17:44
1

To properly expand your thesis, you should probably read the rest of the article you posted. Under "Android and Google Service Mitigations" it explains the current posture of Google to deal with these threats. While the best solution is naturally to patch the OS at the lowest level the bug exists, it is effective enough to patch the apps in userland that enable the vulnerability, in order to make it nontrivial to exploit. This is why the apocalypse of "a billion unpatched devices" that many experts have been promising has never come to fruition, and the only users at risk are those that ignore numerous warnings and install unvetted apps from unreliable sources.

So, to answer your question: if you are asked, simply remind the user that they should be wary of strange prompts on their phone when connected to unknown networks (since all exploits in the wild start this way), always keep their apps up to date (follow prompts to do this while on a home network) and if strange behavior does start to happen don't enter any personal information like usernames/passwords until you have a chance to reboot the phone on a trusted network.

Rooting your device, unless it's a model specifically designed to allow it like some Google Nexus variants, is always a bad idea from a security perspective. You are purposefully removing a layer of security, with code that has almost certainly not been vetted by any reliable source, so after this happens ALL bets are off.

  • Thanks Jeff. I would like to propose a single correction: Many users root their devices by running closed-source "mystery code", while others root their devices using simple adb commands. The latter is comparatively safer, especially when coupled with a good su tool that is set to deny root access by default. It's not foolproof, and can expose the user to more vulnerabilities, but it's not nearly as bad as when people run unknown closed-source executables to obtain root privileges. – RockPaperLizard May 4 '16 at 19:19
  • @RockPaperLizard you are correct that ADB can be used to gain root, and without digging too deep, this is the method supported only by "open" devices like Nexus variants (as I commented) it is not supported on any of the major market handsets that I know if (i.e. Samsung, LG, Moto, etc) – Jeff Meden May 4 '16 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.