Attack that stops internet access for several minutes

Question

I have a question that might sound a bit weird: A friend of mine (Person A) is being attacked by a former friend (Person B) and now person A asked me for help. Person A and Person B know each other from the internet and Person A used to trust Person B.

Generally speaking, Person A experiences network issues in his WiFi network.

Person B has access to Person A's iCloud account and other accounts. Also, Person B may have changed settings (VPN, certificates, ...) or installed apps on Person A's iPhone because Person B told Person A that he knows how to cheat in a smartphone game. Person A doesn't remember anymore what Person B told him to do. Person B never had physical access to the iPhone nor the router.

Apparently, Person B can launch an attack that stops the internet on Person A's iPhone for several minutes. This only concerns incoming traffic because during these attacks Person A can be heard by me on the call, but Person A can't hear me for the time of the attack.

This doesn't only affect the iPhone, but also other devices in the same WiFi network. That's why I was thinking that Person A might have access to the router, but he could have never had physical access.

Person A is rather inexperienced with technology and, as far as I know, Person B is an experienced senior software developer who is interested in pentesting.

Does anyone have any idea what Person B might have done to Person A's iPhone/router and how he is remotely able to stop his internet?

I appreciate any help!

Answer 1

This could be as simple as person B previously enabled remote WAN management of the router. Person B knows the router's external IP address and password. He can login and reboot it remotely, resulting in "several minute" outage.

Another possibility is person B is aware of a DOS attack which affects this router triggering a reboot.

Fix: update firmware, reset to factory defaults, change password. Recommended on both router and iPhone.

In general, if a computer (or router, or iPhone) is compromised, wipe it and start over unless you are an expert. Back it up and erase it as if you were selling it. Reinstall the OS (phone could be jailbroken). Change all passwords, including the router, WiFi, and cloud passwords. On the router update the firmware and restore to factory defaults.

A third possibility is this is a bandwidth DDOS attack, but there's not much you can do about that. If your Internet pipe is full, your Internet pipe is full. In addition, WiFi can always be jammed by an (illegal) jammer radio within radio range.