2

I heard about a conference about security, where everybody who had his phone's wifi enabled (not connected) was "hacked" and their phone's pin number (PASSCODE) were shown on the screen's conference (2 last digits). Is it possible? What other data could that hacker get?

Improve this question
6
  • sounds like a lie. my phone unlocks with a doodle, not a pin...
    – Jasen
    Commented Dec 19, 2016 at 8:15
  • I have no pin to unlock my phone, I have password but I think he is referring to mobile operator's pin for the sim.
    – OscarAkaElvis
    Commented Dec 19, 2016 at 8:27
  • No, I mean the pin for unlocking the phone. I'm asking this question because It's hard for me to believe :)
    – wp42
    Commented Dec 19, 2016 at 8:37
  • In that case... a lot of phones has no pin to unlock... is hard to believe this... anyway, look at my answer, other things can be done.
    – OscarAkaElvis
    Commented Dec 19, 2016 at 8:46
  • 2
    Was it all phones (very unplausible) or just some phones of a certain model or a certain OS (more plausible)?
    – Anders
    Commented Dec 19, 2016 at 9:21

2 Answers 2

Reset to default
4

AFAIK, it is a common demo in security conferences. While one of the conferencers starts speaking, another one starts a WiFi dump tool to identify phones with an open WiFi. Then he offers them to connect on his network by trying to provide an expected SSID => fine he has immediately done a MITM. As smartphones often carry many apps that try to sync as soon as a network is available, it is likely that attacker will soon get valuable informations on the sytems and applications. Assuming that the attacker is a specialist in pentesting (common for security conferences), the risk that he can find a vulnerable system or app is... rather high if the Wifi was opened - read the owner of the phone is probably not very cautious about his device security.

Then he just tries to get various informations to prove that a hack was possible in a short time and shows the results, with a real impact on people who were hacked, which is the goal of the demo.

Now for the questions:

  • is it possible is Wifi is closed: no
  • is it possible on any smartphone with an open Wifi: probably not, because you still need talkative and vulnerable apps
  • what is the risk on your smartphone? Just count the installed applications that can automatically sync data, and try to evaluate how much you can trust their developper
Improve this answer
2
  • To add a technic to evaluate the last risk: [return] 1. configure an open Wi-Fi network with a well known public name like "Wayport_Access" on a PC which will act as a rogue AP, [return] 2. fire a tcpdump or Wireshark on it and filter everything which could come from your phone Wi-Fi MAC address, [return] 3. activate Wi-Fi on your smartphone and bring it within reach of your rogue AP PC, [return] 4. look at your tcpdump or Wireshark to witness or not the size and content of the dataleak.
    – athena
    Commented Apr 18, 2017 at 12:26
  • If you are good at filtering with tcpdump or Wireshark, just connect your rogue AP PC to Internet. Your dataleak will be much bigger and in need to be filtered to get only the interesting part.
    – athena
    Commented Apr 18, 2017 at 12:32
1

Is possible to sniff the probe requests packets from the phone looking for its known networks... That's very easy to do. With your wifi network card in monitor mode and any tool like Airodump (from aircrack suite) you can see this. In theory, you can set up a network with that data (bssid, ssid, etc) and the phone can connect to that wireless network. Is hard to automatize all of this stuff of course, but is possible.

After that, if the mobile connected and that network has internet access, the mobile is going to do its normal operations... auto syncs of apps, etc. You can be sniffed, the attacker who created the network has the MITM (man in the middle) already done and the hack depends of a lot of factors. All passwords in plain can be easily hacked (pop, ftp, etc). And if they do some technique like sslstrip could hack you even some ssl site password, it depends.

But could be possible in my opinion... anyway not in all devices. It will depend of a lot of factors.

Improve this answer
7
  • is it so easy to be the MITM if not automated? just need to sniff the packets for known network, and create a network with that data? the passwords in plain then can be sniffed? how can they be sniffed, with aircrack tools or with something else like wireshark?
    – wp42
    Commented Dec 19, 2016 at 8:40
  • The hard part is to sniff the probes with airodump, analyze that info and create fake ap with that data. Then is easy... once you are on an "evil network", the MITM is already done, probably the same linux machine which is creating the fake AP will act as a router (gateway of that network) and you can sniff with the tool that you want... wireshark, ettercap, bettercap, tcpdump or whatever sniffer.
    – OscarAkaElvis
    Commented Dec 19, 2016 at 8:44
  • Yes, I get it thanks. but why is it hard to sniff the probes with airodump and analyse it? is it because of encryption?
    – wp42
    Commented Dec 19, 2016 at 9:29
  • Because I know how to check some part of probes... the SSID which the client is asking for is easy to see... but not sure how to check the BSSID of the AP which client is asking for. I guess this can be done too, but not sure how. :/ I guess using wireshark or any other more advanced tool than airodump, but I didn't tested it, sorry.
    – OscarAkaElvis
    Commented Dec 19, 2016 at 9:39
  • 1
    Is it possible to spoof a password protected WiFi access point? I'd assume the client would try to authenticate with your AP and fail.
    – Awn
    Commented Apr 10, 2017 at 11:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .