3

I was reading an article on an iOS8 SSL exploit on The Register when one quote caught my eye:

“Anyone can take any router and create a Wi-Fi hotspot that forces you to connect to their network, and then manipulate the traffic to cause apps and the operating system to crash,”

Emphasis mine. This is reiterated in the slides (PDF warning!) on pages 20-22. It mentions that it wouldn't be possible unless you can force the user to connect to WiFi but immediately says that's possible to circumvent with "Karma attacks" and "WifiGate", bypassing any user interaction.

Even before the DoS exploit, the idea of an attacker manipulating a device onto their network is terrifying.

Could somebody explain how these work, if they only apply to iOS and either way, how somebody might mitigate against them?

  • Not that people can be forced to connect to it, but most AT&T phones automatically connect to AT&T wifi hotspots, so if you could spoof that... – ajkblue Apr 22 '15 at 13:52
2

The good news is that your device will never connect by itself to previously-unknown access point.

The bad news is that the concept of "previously-unknown" may not be as obvious as expected.

Basically, you device will recognize and connect to an access point thanks to two things:

  • The SSID, the "name" of the network,
  • The pre-shared key, the password securing the network and ensuring, among other things, that the access point is who it pretends to be.

(For completeness the device can also check the access point MAC address, but I think this is rarely the case by defult, most probably to not interfere with Wifi networks using several access point to cover a larger area).

However, on public networks, there is by definition no pre-shared keys. Therefore, the only thing the device can use to recognize the access point will be the SID.

In other words, if your device has been allowed to connect to some genuine public wifi (which usually bear very frequent or obvious names), then it will try to "connect back" automatically as soon as any other access point broadcast the same SSID, even if this time the access point could be everything but genuine...

1

I think you are referring to WiFi Pinneapple and Karma attacks.
It's worth noting that the Pineapple can only perform this kind of attack by impersonating an open network (public wifi, coffee shop, etc.)

The best way to protect yourself from an attack such as this is to 'forget' open networks as soon as you have finished using them, just remove them from the list so they cannot be abused in the future.

0

It is also recommended you disable the autoconnect feature which some OS's or phones will have.

if you have connected previously to an open network (i.e. McDonalds wifi, or an airport wifi) your device - if it sees the same SSID - will attempt to connect automatically. Hackers can setup a network using a laptop or such with the same SSID, and fool your device into connecting. Once done, it's then possible to intercept web traffic, falsify SSL certs and gain access to user/password data being transmitted to the destination website. As suggested disable wi-fi when not in use, and remove all known OPEN access points once out of range.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.