1

I have a question that might sound a bit weird: A friend of mine (Person A) is being attacked by a former friend (Person B) and now person A asked me for help. Person A and Person B know each other from the internet and Person A used to trust Person B.

Generally speaking, Person A experiences network issues in his WiFi network.

Person B has access to Person A's iCloud account and other accounts. Also, Person B may have changed settings (VPN, certificates, ...) or installed apps on Person A's iPhone because Person B told Person A that he knows how to cheat in a smartphone game. Person A doesn't remember anymore what Person B told him to do. Person B never had physical access to the iPhone nor the router.

Apparently, Person B can launch an attack that stops the internet on Person A's iPhone for several minutes. This only concerns incoming traffic because during these attacks Person A can be heard by me on the call, but Person A can't hear me for the time of the attack.

This doesn't only affect the iPhone, but also other devices in the same WiFi network. That's why I was thinking that Person A might have access to the router, but he could have never had physical access.

Person A is rather inexperienced with technology and, as far as I know, Person B is an experienced senior software developer who is interested in pentesting.

Does anyone have any idea what Person B might have done to Person A's iPhone/router and how he is remotely able to stop his internet?

I appreciate any help!

  • So the attacks slow internet for every device in the network and not just the iPhone specifically? What if A disconnects from the WiFi for a while, and waits for the gateway's external IP to change (assuming NAT + dynamic IP)? I immediately want to call it a DOS because it's affecting the whole network and is trivial to carry out. – Pheric Jan 11 at 3:08
  • In general, if a computer is compromised, wipe it and start over unless you are an expert. Since this is an iPhone that’s easy. Back it up and erase it as if you were selling it. Reinstall the OS (phone could be jailbroken). Change all passwords, including the router (should update firmware and restore router to factory defaults). Note that WiFi can always be jammed by an (illegal) jammer radio within radio range. – Darrell Root Jan 11 at 6:18
2

This could be as simple as person B previously enabled remote WAN management of the router. Person B knows the router's external IP address and password. He can login and reboot it remotely, resulting in "several minute" outage.

Another possibility is person B is aware of a DOS attack which affects this router triggering a reboot.

Fix: update firmware, reset to factory defaults, change password. Recommended on both router and iPhone.

In general, if a computer (or router, or iPhone) is compromised, wipe it and start over unless you are an expert. Back it up and erase it as if you were selling it. Reinstall the OS (phone could be jailbroken). Change all passwords, including the router, WiFi, and cloud passwords. On the router update the firmware and restore to factory defaults.

A third possibility is this is a bandwidth DDOS attack, but there's not much you can do about that. If your Internet pipe is full, your Internet pipe is full. In addition, WiFi can always be jammed by an (illegal) jammer radio within radio range.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.