Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

If I use my mobile device in a Wifi hotspot, can I take it that it bears the same risks as using a laptop in that data can be easily sniffed and that the mobile device is also open to man-in-the-middle attacks?

share|improve this question
9  
It's worth to note that in an open wifi every user can easily read all plaintext other users are sending. However, in a WPA-protected network, even if the access key is "public" knowledge, each computer still gets it's own private cryptographic "channel" which makes eavesdropping from other connected computers a much bigger effort. Still, only way to be actually private is to only use client-server -secured connections (HTTPS), and to be really, really sure use pre-stored remote certificates for known sites and use some method to get alerts about certificate changes. –  Ilari Kajaste Apr 23 '12 at 7:03
    
@Ilari Kajaste - How do I get access to pre-stored remote certificates for known sites or can I download them to the mobile device? –  PeanutsMonkey Apr 23 '12 at 20:02
    
Personally, I consider spoofed certificate MITM scenario rare enough to be safely ignored. That said, for desktop there's a Firefox extension called Certificate Patrol. Using that, you can first just visit all of the sites and after that the extension will inform you if their certificates have changed. However, I don't know if there's something similar available for Android. –  Ilari Kajaste Apr 23 '12 at 20:17
1  
Not quite an answer, but there's an app called WifiKill that can redirect traffic to your phone if it's on the same network, and "kill" the internet connection. So, I guess it wouldn't be harder to just "sniff" the data if it's not encrypted. forum.xda-developers.com/showthread.php?t=1282900 –  jadkik94 Apr 27 '12 at 16:28
    
See also: Security risks of open Wifi and What Android sync'd data is encrypted? which both have lots more on the security risks of open wifi –  GAThrawn May 9 '12 at 13:06
show 1 more comment

2 Answers

up vote 20 down vote accepted

Yes, you are subject to the same risks as you would have in a laptop (or any device that connects to a wireless network, for that matter); to avoid them, the standard security procedures apply: do not use unencrypted connections that you do not trust and always prefer HTTPS for browsing.

share|improve this answer
    
Would the same principles of security apply or are they different? –  PeanutsMonkey Apr 23 '12 at 1:22
3  
The same principles can be applied for any device that connects over wireless: use only HTTPS web pages, don't use untrusted wireless networks etc... –  Renan Apr 23 '12 at 1:23
add comment

Yes. There are 2 different problems:

A. An attacker sniffing and/or redirecting all traffic via arp-spoofing.

Two different android applications already do this (banned from market of course). Please note that it might be illegal to install and test them in your country!

  • FaceNiff allows (don't know if it still applies) to snoop on logged in credentials and take over facebook accounts and similar.
  • Droidsheep does effectively the same

B. An attacker impersonating as the Hotspot.

The more serious one, I suppose. It allows to hijack your phone any time if you previously have connected to a well known hot-spot provider.

Your android phone usually remembers known hotspots by the accesspoints ESSID alone (it's name) and tries to reconnect to it any time it sees such an ESSID again for ease of use. This allows an attacker to set up such a well known ESSID and your phone will happily connect to it then. Because no arp-spoofing will be involved, you cannot detect this behaviour easily.

Just try it yourself, set up your phone as an unencrypted hotspot device using a well known hotspot ESSID and see how many connections you get in no time... It's maybe not even illegal to use such an ESSID and noone is tricked into using your connection either.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.