What are the risks of making a mobile phone an access point for non-trusted users?

Question

I was on the train last night, and what appeared to be a business man asked me if I could give him wifi access. I declined due to battery consumption and the fact that I am little paranoid, but would like to know if I would be risking anything if I let him (apart from him accessing dodgy sites which could get me in trouble). By the way my Iphone is updated to its latest version and isn't jailbroken.

Answer 1

The main attack vector that has been opened up is that you are now on the same LAN. I don't know how your smartphone implements some security measures so i'll assume it behaves like a PC. Being on the same LAN means that he could read sensitive information not sent over https. He could also perform standard network attacks like ARP spoofing between you and anyone else on the network to intercept and block traffic. Apart from network manipulation, if you phone has services exposed that contain exploits, they could now be attacked while before they could not.

Answer 2

There are two major types of risk I see here: network attacker, and malicious network usage.

Network attack is somewhat covered by @J.A.K. already, but basically boils down to "the same reasons you shouldn't connect to WiFi networks you don't trust" (although in practice people do this all the time). Your device could be attacked; lots of apps and OS-provided services accept incoming requests over WiFi but not over cellular radio, and any security flaws in those apps/services could then be exploited. This is more of a risk for jailbroken users, as apps for jailbroken phones are both even worse on security than normal apps and also can do a lot more damage if an attacker takes control, but it matters for normal phones too. Your network traffic could also be attacked, potentially exposing anything you send in plain text (sometimes even if you would normally send it over HTTPS; SSLStrip is a thing).

You briefly touched on the other major risk category - malicious use of your network - in the question, but it deserves more exploration. There are a lot of things that somebody would like to have a largely-untraceable Internet connection for, and many of them are illegal. If you provide that access, your IP will be the one flagged, your ISP (mobile operator, in this case) will happily tell law enforcement your name and billing address, and depending on what was done you could find yourself facing some really nasty charges, like child pornography. Even if you successfully disclaim responsibility, you're likely to face a lot of hassle and probably at least temporary seizure of your device and service. A few examples from people who run TOR exit nodes (which have the same problem of untrusted people accessing the Internet through your connection):

• https://www.deepdotweb.com/2016/04/06/seattle-law-enforcement-authorities-raid-homes-privacy-activists/
• http://www.zdnet.com/article/austrian-man-raided-for-operating-tor-exit-node/
• http://motherboard.vice.com/read/the-operators

On a less legally scary front, there's also just risks like that person using a ton of your data (tethered data is usually not unlimited even if untethered data is). LTE connections can be fast enough to burn through an entire multi-GB limit in minutes. Also, you'll want to change your tethering password (definitely after giving the person access, and ideally also before) so they can't just connect up to it later, and since you have to tell them the password, make sure it's not one that is used anywhere else (though you shouldn't reuse passwords to begin with...).