I heard about a conference about security, where everybody who had his phone's wifi enabled (not connected) was "hacked" and their phone's pin number (PASSCODE) were shown on the screen's conference (2 last digits). Is it possible? What other data could that hacker get?
AFAIK, it is a common demo in security conferences. While one of the conferencers starts speaking, another one starts a WiFi dump tool to identify phones with an open WiFi. Then he offers them to connect on his network by trying to provide an expected SSID => fine he has immediately done a MITM. As smartphones often carry many apps that try to sync as soon as a network is available, it is likely that attacker will soon get valuable informations on the sytems and applications. Assuming that the attacker is a specialist in pentesting (common for security conferences), the risk that he can find a vulnerable system or app is... rather high if the Wifi was opened - read the owner of the phone is probably not very cautious about his device security.
Then he just tries to get various informations to prove that a hack was possible in a short time and shows the results, with a real impact on people who were hacked, which is the goal of the demo.
Now for the questions:
- is it possible is Wifi is closed: no
- is it possible on any smartphone with an open Wifi: probably not, because you still need talkative and vulnerable apps
- what is the risk on your smartphone? Just count the installed applications that can automatically sync data, and try to evaluate how much you can trust their developper
Is possible to sniff the probe requests packets from the phone looking for its known networks... That's very easy to do. With your wifi network card in monitor mode and any tool like Airodump (from aircrack suite) you can see this. In theory, you can set up a network with that data (bssid, ssid, etc) and the phone can connect to that wireless network. Is hard to automatize all of this stuff of course, but is possible.
After that, if the mobile connected and that network has internet access, the mobile is going to do its normal operations... auto syncs of apps, etc. You can be sniffed, the attacker who created the network has the MITM (man in the middle) already done and the hack depends of a lot of factors. All passwords in plain can be easily hacked (pop, ftp, etc). And if they do some technique like sslstrip could hack you even some ssl site password, it depends.
But could be possible in my opinion... anyway not in all devices. It will depend of a lot of factors.