If I use my mobile device in a Wifi hotspot, can I take it that it bears the same risks as using a laptop in that data can be easily sniffed and that the mobile device is also open to man-in-the-middle attacks?
asked Apr 23, 2012 at 1:09
-
9It's worth to note that in an open wifi every user can easily read all plaintext other users are sending. However, in a WPA-protected network, even if the access key is "public" knowledge, each computer still gets it's own private cryptographic "channel" which makes eavesdropping from other connected computers a much bigger effort. Still, only way to be actually private is to only use client-server -secured connections (HTTPS), and to be really, really sure use pre-stored remote certificates for known sites and use some method to get alerts about certificate changes.– Ilari KajasteApr 23, 2012 at 7:03
-
@Ilari Kajaste - How do I get access to pre-stored remote certificates for known sites or can I download them to the mobile device?– PeanutsMonkeyApr 23, 2012 at 20:02
-
Personally, I consider spoofed certificate MITM scenario rare enough to be safely ignored. That said, for desktop there's a Firefox extension called Certificate Patrol. Using that, you can first just visit all of the sites and after that the extension will inform you if their certificates have changed. However, I don't know if there's something similar available for Android.– Ilari KajasteApr 23, 2012 at 20:17
-
1Not quite an answer, but there's an app called WifiKill that can redirect traffic to your phone if it's on the same network, and "kill" the internet connection. So, I guess it wouldn't be harder to just "sniff" the data if it's not encrypted. forum.xda-developers.com/showthread.php?t=1282900– jadkik94Apr 27, 2012 at 16:28
-
See also: Security risks of open Wifi and What Android sync'd data is encrypted? which both have lots more on the security risks of open wifi– GAThrawnMay 9, 2012 at 13:06
|
Show 1 more comment
2 Answers
Yes, you are subject to the same risks as you would have in a laptop (or any device that connects to a wireless network, for that matter); to avoid them, the standard security procedures apply: do not use unencrypted connections that you do not trust and always prefer HTTPS for browsing.
-
Would the same principles of security apply or are they different? Apr 23, 2012 at 1:22
-
3The same principles can be applied for any device that connects over wireless: use only HTTPS web pages, don't use untrusted wireless networks etc...– RenanApr 23, 2012 at 1:23
Yes. There are 2 different problems:
A. An attacker sniffing and/or redirecting all traffic via arp-spoofing.
Two different android applications already do this (banned from market of course). Please note that it might be illegal to install and test them in your country!
- FaceNiff allows (don't know if it still applies) to snoop on logged in credentials and take over facebook accounts and similar.
- Droidsheep does effectively the same
B. An attacker impersonating as the Hotspot.
The more serious one, I suppose. It allows to hijack your phone any time if you previously have connected to a well known hot-spot provider.
Your android phone usually remembers known hotspots by the accesspoints ESSID alone (it's name) and tries to reconnect to it any time it sees such an ESSID again for ease of use. This allows an attacker to set up such a well known ESSID and your phone will happily connect to it then. Because no arp-spoofing will be involved, you cannot detect this behaviour easily.
Just try it yourself, set up your phone as an unencrypted hotspot device using a well known hotspot ESSID and see how many connections you get in no time... It's maybe not even illegal to use such an ESSID and noone is tricked into using your connection either.
