If you use your iPhone to connect to open or public wireless networks, it’s a good idea to tell the device to forget the network’s name after you’re done using it, as failing to do so could make it easier for snoops to eavesdrop on your iPhone data usage.
For example, if you use your iPhone to connect to an open wireless network called “linksys,” — which happens to be the default, out-of-the-box name assigned to all Linksys home Wi-Fi routers — your iPhone will in the future automatically connect to any Wi-Fi network by that same name.
The potential security and privacy threat here is that an attacker could abuse this behavior to sniff the network for passwords and other sensitive information transmitted from nearby iPhones even when the owners of those phones have no intention of connecting to a wireless network, simply by giving his rogue access point a common name.
That means that if you’ve ever taken advantage of the free Wi-Fi that AT&T offers to iPhone users at most Starbucks, Barnes & Noble and other locations nationwide, your iPhone will automatically connect to any network named “attwifi,” the name AT&T uses for its public hotspots. Indeed, an attacker who set up a rogue wireless access point named “attwifi” or “linksys” in a crowded place likely would be able to force a fair number of iPhones in the vicinity to automatically connect to his access point. This could create a privacy problem for those who are using the iPhone’s 3g data connection to send e-mail or other information, as the iPhone normally will switch from 3G to a preferred wireless network whenever a trusted one is available.
This attack scenario is more a reminder about basic wireless security safety than anything else. If you must use Wi-Fi to communicate sensitive information make doubly sure that the Web address of the site you are sending data to begins with an “https://”, or else any data you share with that site could be intercepted and read by anyone else on that same network. Also, if your Web browser complains about a certificate or encryption error while you are trying to log on to a site or transmit sensitive data, it’s probably safest to cancel that transaction, as it may be a sign that someone on the network is attempting to intercept the transmission.
And by the way, this advice is the same whether you’re browsing a public Wi-fi network over an iPhone, a Mac, or a Windows PC (these devices also may auto-connect to familiar open wireless networks).
As I was writing this, I came across an older but related post by Rich Mogull at the Securosis blog, which offers a few more Wi-Fi security tips for iPhone users. Specifically:
-Turn on “Ask to join networks”.
-If you have an unencrypted home wireless network, use an obscure name with some random numbers in it. This reduces the odds you’ll ever hit another one with the same name unless someone specifically targets you.
To force your iPhone to forget a wireless network after you’re done using it, click “Settings,” “Wi-Fi Networks,” select the wireless network’s name, and then “Forget this Network.” The “Ask to join networks,” option also is on the “Wi-Fi Networks” screen.
Thanks for the advice.
You might also wish to note that this is an easily toggleable behaviour (per found AP) in Gnome’s Network Manager in the Linux world, via right clicking Network Manager and selecting edit connections.
When I expressed my concerns about the fact that Verizon’s webmail site does not begin with https:// a Verizon tech support dismissed my concern, saying that anyone who wants to can hack into any wi-fi connection.
I don’t believe him.
What does hacking a wi-fi connection have to do with not securing webmail authentication? The things Tier 1 support says sometimes…
Quoting Bryan:
-If you have an unencrypted home wireless network, use an obscure name with some random numbers in it. This reduces the odds you’ll ever hit another one with the same name unless someone specifically targets you.
Why would you want to have an unsecured home wireless network? I don’t want anyone using my network that I’m not aware of.
I have, on occasion, used other open wireless connections, but … (don’t use mine).
The encryption technically slows down your connection a tad, so leaving the connection unencrypted can give “gamers” at least some placebo comfort. Routers usually give you an option to whitelist MAC addresses for permitting access, but that doesn’t affect snooping.
There are also some nifty routers that will serve as endpoints for multiple wireless networks. The basic idea is that you can leave an unsecured network with less privileges as a sort of honeypot for your neighbors so that they won’t bother trying your phone number for the password to your real network….
The label “Ask to join networks” is misleading. It’s a choice between “ask” and “don’t connect”, rather than “ask” and “automatically connect”. I think it’s safer off.
How do I make my iPhone forget a network I connected to when I was in another location? I don’t see it in the list now.
So how safe is Wi-Fi? I use my computer only at home and I’ve stuck with DSL even though I could get Verizon fiber optic. Should I switch and what else would I need to do to make it safe?
Excellent article!! Scary, but it’s good to know that I already do what you suggested… I’ve already passed this on to my friends and posted it on my blog.
Brian makes another excellent case about WiFi security, but it should be noted that PC laptops should have similar constraints on this ‘fluid’ connectivity behavior.
In XP; Control Panel> Wireless Network Connections> Wireless Networks> ‘Advanced’ button, tick ‘access points only’ and uncheck ‘Automatically connect to non-preferred networks’> close> OK out.
Vista/Win7 should have all Networks not in direct control of the user placed in the “Public” heading, with maximum stealth settings.
When attending WiFi-enabled conferences, I also use VPN for both my iPhone and laptop (and now iPad).
Another best practice is to turn off Wi-Fi when you don’t need it. This practice also helps save your battery.
As the number of smart-phones rises so will the danger of using them rise.
It has been some hackers dream to have the ability to steal information just by walking near people with a smart phone.
As the usage of smart phones and similar devices that transmit info over wi-fi rises this hacker dream is coming closer. This threat can come in many forms it havent been created yet but it could be phone exploiting all the phones in a circle around it or just stealing stored passwords or something else…
Not unlike security on a PC, most Iphone owners dont care about security, bringing up any security subject as discussion topic will likely blow away most people they dont even want to hear about this boring crap.
You don’t know how right you are. Very good advice!!
If you use your iPhone to connect to open or public wireless networks, it’s a good idea to tell the device to forget the network’s name after you’re done using it
Much more importantly, never use public wifi for anything except to establish an ssh tunnel to your home computer, and make sure that your email account has SSL on for both sending and receiving email.
Here’s a shell script that I use on my JB iPhone. Install in /var/mobile/bin/ssht, then run from Terminal (you can program a quick action for this as well for convenience). At home, I have Squid and Privoxy proxies chained with access only from localhost; you can use any of Squid/Polipo/Privoxy options for this purpose, all available using “sudo port install squid privoxy polipo” from MacPorts, or equivalent using yum/etc. on Linux.
With a setup like this, the only information the public wifi router (and all its clients) will see is encrypted SSL and ssh traffic.
#!/bin/sh
# SSH tunnel to squid proxy: ssht [user_name@][ip_address][:ssh_port]
MYUSERNAME_DEFAULT=username
MYHOSTNAME_DEFAULT=192.168.1.1 # actual IP goes here
MYSSHPORT_DEFAULT=22 # move ssh off standard port 22!
# SSH port forwarding specs, e.g. 8080:localhost:3128
MYLOCALHOSTPORT=8080
MYSQUIDPORT=3128
# Get username, hostname, and ssh_port from the command line argument
if [[ $1 == *@* ]]
then
MYUSERNAME=${1%%@*}
else
MYUSERNAME=$MYUSERNAME_DEFAULT
fi
if [ -z $MYUSERNAME ]
then
MYUSERNAME=$MYUSERNAME_DEFAULT
fi
if [[ $1 == *:* ]]
then
MYSSHPORT=${1##*:}
else
MYSSHPORT=$MYSSHPORT_DEFAULT
fi
if [ -z $MYSSHPORT ]
then
MYSSHPORT=$MYSSHPORT_DEFAULT
fi
MYHOSTNAME=${1##*@}
MYHOSTNAME=${MYHOSTNAME%%:*}
if [ -z $MYHOSTNAME ]
then
MYHOSTNAME=$MYHOSTNAME_DEFAULT
fi
ssh -p $MYSSHPORT -L $MYLOCALHOSTPORT:localhost:$MYSQUIDPORT -l $MYUSERNAME $MYHOSTNAME -f -C -q -N \
&& echo “SSH tunnel established via $MYLOCALHOSTPORT:localhost:$MYSQUIDPORT\n\tto $MYUSERNAME@$MYHOSTNAME:$MYSSHPORT.” \
|| echo “SSH tunnel FAIL.”
Great advice! I’ve passed the word on here. http://bit.ly/bNISE4