Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sniffer Hijacks SSL Traffic From Unpatched IPhones

Posted by samzenpus on from the patch-your-phone dept.

CWmike writes "Almost anyone can snoop the secure data traffic of unpatched iPhones and iPads using a recently-revised nine-year-old tool, a researcher said as he urged owners to apply Apple's latest iOS fix. If iOS devices aren't patched, attackers can easily intercept and decrypt secure traffic — the kind guarded by SSL, which is used by banks, e-tailers and other sites — at a public Wi-Fi hotspot, said Chet Wisniewski, a security researcher with Sophos. 'This is a nine-year-old bug that Moxie Marlinspike disclosed in 2002,' Wisniewski told Computerworld on Wednesday. On Monday, Marlinspike released an easier-to-use revision of his long-available 'sslsniff' traffic sniffing tool. 'My mother could actually use this,' he said."

5 of 94 comments (clear)

  1. Re:never been used my ass by nedlohs · · Score: 4, Informative

    You can't check the User Agent without feeding them the fake SSL cert first, since it's in the encrpted data.

    You could of course default pass along everything and only act as a man in the middle for https requests from a device that you've already intercepted an HTTP request from to determine it's of the right flavor. But that does make it ever so slightly more difficult.

  2. Re:How can they patch this? by spydir31 · · Score: 3, Informative

    No, you're thinking of SSLstrip which methodically strips HTTPS references. This is a different attack, where the client accepts certificates signed by any certificate that has a valid chain

  3. 3G Owners are SCREWED by Anonymous Coward · · Score: 5, Informative

    3G owners can't upgrade past 4.2.1. Looks like they are SOL! Thanks Apple!

    1. Re:3G Owners are SCREWED by spinkham · · Score: 4, Insightful

      iPod touch 2g also.

      It was still being sold as the 8 gig version less than 3 months before the announced last software update.

      The 3g 8gig was being sold around 6 months before the last announced software update.

      I understand not getting feature updates, but why can't we get security updates for a device apple was still selling a year ago?

      --
      Blessed are the pessimists, for they have made backups.
  4. Breaks Jailbreak by tecker · · Score: 3, Insightful

    Problem is that applying this update for something that is not likely exploited in the wild will hose your Unteathered Jailbreak. Reports on twitter are that redsn0w pointed at 4.3.4 (or 4.2.9) will work for getting a tethered Jailbreak. Many jailbreakers likely wont bother.

    Wonder if someone will patch this like they did the PDF exploit and put it on Cydia.

    --
    Procrastinating life a way at a rapid rate of speed.