Are all these attacks possible with WiFi MitM or is it over-hyped nonsense?

Question

My dad sent me this video asking if he should be worried about this?

The video shows:

• a wifi AP broadcasting an airport's wifi name
• security researcher seeing the sites the victim browses
• security researcher viewing files accessed by victim on cloud storage
• victim installing attacker's "free wifi" app
• the app giving the security researcher full control over the device

Obviously most folks should be wary of untrusted WiFi networks, but there’s a couple of strange things occurring that makes me wonder if this is just an over-hyped hacker story.

First, the Google search he performs seems to be protected by TLS, how is that possible with just MitM?

Then he does some truly mind-blowing stuff like being able to access the microphone, record audio and send it to himself. No way that’s done via just an MitM over WiFi.

Am I missing something, or does this community concur that this video is either over-simplified or just plain deceitful?

Connecting to a strange WiFi might get you into trouble, but it alone cannot cause this level of compromise... can it?

Answer 1

Am I missing something, or does this community concur that this video is either over-simplified or just plain deceitful.

I wouldn't say it's deceitful, but it's definitely overhyped/oversimplified.

First, the Google search he performs seems to be protected by TLS, how is that possible with just MiTM?

Yes. In order to do that, he would have to either strip SSL or install a root CA certificate on the mobile device. So you can't simply MITM https websites (the video over-simplifies it).

Then he does some truly mind-blowing stuff like being able to access the microphone, record audio and send it to himself. No way that’s done via just an MiTM over WiFi.

Of course not. You cant just use a phone's microphone via MITM over wifi. As you can see in the video itself, he says that you make a victim install an application and then you can record microphone or access data on the phone. He obviously oversimplifies it. Not only will the victim have to install the application, but also have to give all the required permissions to the app (if you are dumb enough to do that, I guess you could make someone install root CA as well).

Connecting to a strange WiFi might get you into trouble, but it alone cannot cause this level of compromise .... isn’t it?

At the end of the day using public WIFI is similar to being in the same network as the attacker but that's about it. Don't be stupid, keep software updated and be informed about security. The story is overhyped. Same as the ads from VPN companies.

Answer 2

All the attacks are possible and not over-hyped. In fact, these attacks are found in the wild. But you missed a detail that makes your conclusions incorrect.

There are some steps that the attacker and the victim take that are skipped in the video, but those skipped steps are specific to devices and those specific attacks. The premise and the underlying threats and possibilities are not affected by the missed steps. The video can remain valid for a much longer time by not delving into those missed technical steps.

Because these attacks actually happen in the wild, it's not fair to say that the missing parts make this an "over-simplified" video, just edited to be accessible by a wide audience (and not a technical audience).

The skipped steps for these specific attacks on the victim side:

• ignore security warnings
• install certificates (which the victim can be easily deceived into doing)
• install the app supplied by the attacker and give it the permissions it asks for (the "free wifi" app shown in the video)

Installing the certificates allows the attacker to view TLS-protected sites (browsing, Google searches, accessing cloud storage)

The video clearly states that it's the installing of the app that gives the attacker full control over the device (microphone, etc.) The app could also be used to install the certificates. So, no, it's not just being a man-in-the-middle that does it, but by being in the middle, it is possible to serve the malicious app. This is the detail you appear to miss.

I suspect that the video is actually edited to be out of chronological order to show the simple attacks first, then get more serious. The situation on the attacker side could simply be:

1. broadcast a free wifi network that the victim is likely to trust (airport wifi)
2. show a webpage asking the victim to install an "authentication" app in order to gain access to the free wifi (for security reasons)
3. ask for permissions which give the app full control, install root certificates
4. grant the victim access to the Internet
5. profit

Answer 3

Everything derives from installing the App. Normally phone Apps are signed and limited to designated App Stores. You would have to disable unknow source protection, and manually allow installation. After that, the phone is owned and MiTM isn't even a factor.

So yes I think it's overhyped.

Answer 4

Just to complement the answers above.

A man in the middle attack is just forwarding the data it receives after looking at or modifying it. You can do some stuff with it, like changeing some values or denying communications. Online game hacking is basically this same stuff. For example, the device sends a jump command, you can intercept it and change it for a crouch command. Notice that we did not do anything to the device itself, we just modified the data the device sent.

Now the good stuff, to get access to the device you need to locally install a program to control it or you need to find one or multiple vulnerabilities that will let you run commands remotely. These vulnerabilities vary on device to device and are very hard to find in updated devices (zero days). Metasploit has a list of known vulnerabilities ready to use, but its more difficult than just spoofing the Wi-Fi traffic. So a man in the middle can mess with unencrypted data, but to mess with the device you need to exploit it. If you do exploit it and get root, then you pretty much own the device and can do anything!

Answer 5

This is definitely not overhyped. It can be done. I did the same thing recently to my test phones.

The attacks are indeed possible with the right tools, and the victim wouldn't even necessarily know.

One of the phones, I was able to dump call logs, sms messages, and contacts. I also accessed the mic for recording and both front and rear cameras for snapshots. I also sent an MP3 file to her speakers of a dog growling. I'm sharing 2 screenshots of the metasploit session helpscreen showing a few commands available to me.

]2