0

Can someone have access to my iPhone if my router is compromised? Such as:

  1. having access to my Gmail app on iPhone
  2. access to my Gmail/other passwords
  3. be able to send or delete mails via iPhone?

2 Answers 2

0

No, compromising the router does not give you access to devices connected to the router. The attacker may attempt to exploit vulnerabilities in the connected devices to compromise the devices too, but if your devices are up to date, this would be very unlikely to succeed (unless you are a high value target for a sophisticated state-level attacker.)

Can someone use my ip address?

In the case of a Wifi router, yes they may be able to use your routers IP (which would be the same as your iPhone's public IP when your iPhone is connected to that Wifi), but that does not mean they will be able to access your iPhone or any accounts you are logged in to.

6
  • very unlikely to succeed, unless its a nation state level hacker
    – john doe
    Jul 29, 2020 at 14:21
  • @johndoe More like if you're a very high value target. Even state-sponsored attackers wouldn't waste a zero day on a low value individual.
    – nobody
    Jul 29, 2020 at 14:27
  • 1
    This is true for a brand new 0 day, but state-sponsored groups commonly find , hoard, and use 0 days for a long period of time until they are discovered (Or leaked and then used against you). If the vulnerability has already been widely used, but its simply unknown to Apple, then it wouldn't be considered a waste. I don't think this is a likely scenario, however. I also am the farthest thing from an expert :)
    – john doe
    Jul 29, 2020 at 14:49
  • @B_S_M Yes! As a normal user, you don't have to worry about your iPhone being hacked. Just as a side note, its still not a good idea to have your routers configurations accessible over the internet.
    – nobody
    Jul 29, 2020 at 15:17
  • 1
    @B_S_M They can't access your email given that you have secured your account with a strong password (and MFA). But they can use your IP to conduct illegal activity
    – nobody
    Jul 29, 2020 at 15:21
0

It looks like the accepted answer focused heavily on the concept of remotely accessing your phone; which, agreed, is unlikely. But two of your points were essentially asking if your inbox could be compromised via the phone, which would absolutely be possible. Sometimes trivially.

If you compromise the router/default-gateway, you can potentially intercept traffic for any service on the phone. SSL/TLS doesn't really help here as the router likely controls your DNS also. A key way for apps to protect themselves in potentially compromised environments like this is with Certificate Pinning, which Gmail may well utilise.

Key point 1#

If your router has been compromised... the data in transit from the apps on your phone is very much dependant on the security of the app itself.

Key point 2#

It is also very much dependant on the features (and level of compromise) of your router. For example, compromising a basic home router will likely provide an attacker with very limited scope to perform additional attacks. Compromising a router with more advanced hardware/software might allow them to use the router a lot more like a traditional computer on the network.

14
  • Certificate pinning is now deprecated. Certificate Transparency is used instead. And how does controlling the DNS break TLS? Last time I checked, a MitM on a TLS connection (which Gmail certainly uses) was far from trivial
    – nobody
    Aug 10, 2020 at 13:33
  • I'm not talking about vulnerabilities, rather security features. Google do not publicise the security features of the gmail app so, unless you want to go digging, you have to accept the possible risks.
    – hiburn8
    Aug 10, 2020 at 13:55
  • And certificate pinning is not deprecated, nor a subset of certificate transparency. Certificate transparency is literally there to log certificates created for a domain. Its helpful in identifying when a private key for a certificate authority might be abused/compromised, among other things. Pinning is used to ensure that a MitM attacker cannot read communications between two or more parties. Neither are explicitly designed to verify hosts.
    – hiburn8
    Aug 10, 2020 at 14:00
  • 1
    If you compromise the DNS, then you tell the victim (iphone) that the DNS for google is a.b.c.d. Then you dont have to worry about TLS, because the client is not connected to the 'real' host so would not see the real certificate. You effectively bypass it. Look up DNS spoofing attacks. Its trivial.
    – hiburn8
    Aug 10, 2020 at 14:02
  • Read the first line of the wikipedia article on HPKP. And I didn't say it was a subset of certificate transparency. And no pinning doesn't do that TLS does. If the app doesn't see any certificate, it shouldn't continue with the connection due to HSTS. And by the way, MiTM and DNS spoofing do not require your router to be compromised. They can also be carried out by your ISP
    – nobody
    Aug 10, 2020 at 14:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.