Does mobile hotspot have security vulnerabilities in older phones?

Question

I want to use my Samsung Galaxy Trend Plus as a mobile hotspot, for my laptop. I have installed a custom ROM on the phone -- Official Lineage OS 14.1. There are no security updates for this OS. Does this mean that the mobile hotspot connection is unsafe, or is the Wi-Fi security independent of the OS? Does it matter, as long as my laptop's OS is up to date and using a VPN?

Answer 1

Android releases frequent Security Bulletins to address a number of vulnerabilities at operating system and hardware level. So as a thumb rule, the newer the better and safer. But if you just want to use hotspot, it's not very hard to enforce the basic security measures.

Using as hotspot means your phone is working as a router. Routers do have builtin firewalls for better protection, and some advanced features like Port Forwarding, DMZ, UPnP, QoS, VPN, multiple AP's, RADIUS, NTP, DHCP server, DNS server, Dynamic DNS, VoIP features (SIP ALG and others), captive portal, traffic sniffing / DPI, anti-malware etc. A normal Android phone offers some of these features out of the box; the basic NAT, netfilter (iptables) firewall, Access Point (AP) with WPA2 encryption and a DHCP/DNS server.

Additionally if you are a tech-savvy, you can also define your own firewall rules, port forwarding rules, setup a VPN etc. A few things I can think of which can be easily done:

• Android uses dnsmasq as DHCP and DNS server. You can edit /etc/dnsmasq.conf to whitelist you MAC/IP addresses by assigning fixed IPs to MACs (options dhcp-host= and dhcp-range=) so that only your configured devices get an IP from DHCP server.
• Configure dnsmasq to listen only on local network interface and not from internet facing interface.
• Android uses hostapd to create hotspot. Configure MAC filter in hostapd.conf (options macaddr_acl=1 and accept_mac_file) so that none other can connect to your phone.
• Configure hostapd to offer at least WPA2 PSK encryption (option wpa=2).
• Configure hostapd to hide SSID (option ignore_broadcast_ssid=1).
• Configure at least 12 character long Pre-Shared Key (PSK) (option wpa_psk or wpa_passphrase).
• Run a DNS over HTTPS (DoH) server like dnscrypt-proxy. Or at least set DNS server in dnsmasq.conf (option server=) to some trustworthy public DNS like 1.1.1.1.
• Update /etc/hosts file and/or dnscrypt-proxy blacklist file from some trustworthy source like this one to block ads and harmful websites.
• Make sure you don't have any listening ports (by executing ss -ltup) except dnsmasq's port 67 (DHCP) and 53 (DNS).
• Make sure you don't have any port forwarding rules defined (by executing iptables -S FORWARD) except the one defined for hotspot.
• Block all incoming new packets. See this.
• Disable ICMP echo reply. See this.
• Block all non-root UIDs for OUTPUT chain (except if hotspot uses some non-root UID) to ensure no apps use any data.
• Also consider allowing only required destination ports like 80, 443 if you need to do only web browsing. Allow others like SIP/RTP/FTP/SFTP/SMB etc. if needed.
• Uninstall all user apps to save battery and internet traffic.
• Disable any system apps you find unnecessary, particularly GApps, cleaners, system optimizers, anti-malware etc.

Still if you enjoy playing with phone, consider setting up some router operating system like Zeroshell on your phone.

But even if you don't take any extra measures on phone, laptop's security is enough (for laptop) if configured properly.