Slashdot Mirror
Researchers Crack iOS Mobile Hotspot Passwords In Less Than a Minute
msm1267 writes "Business travelers who tether their iPhones as mobile hotspots beware. Researchers at the University of Erlanger-Nuremberg in Germany have discovered a weakness in the way iOS generates default passwords for such connections that can leave a user's device vulnerable to man-in-the-middle attacks, information leakage or abuse of the user's Internet connection. Andreas Kurtz, Felix Freiling and Daniel Metz published a paper (PDF) that describes the inner workings of how an attacker can exploit the PSK (pre-shared key) authentication iOS uses to establish a secure WPA2 connection when using the Apple smartphone as a hotspot. The researchers said that attackers would find the least resistance attacking the PSK setup rather than trying their hand at beating the operating system's complex programming layers."
to be fair, it took them more than a week to crack it, but now that they've cracked it a hotspot password can be cracked in 50 seconds. a big difference I think.
It's not Erlanger, it's Erlangen.
the operating system proposes four-to-six-character passwords generated from a default list of 1,842 words and then tags on a random four-digit number.
*facepalm* Dinopass does a better job of picking good passwords than Apple, and it's designed for children. For the largest company on the planet, this is really, painfully, sad. In other news, this isn't a weakness in the crypto per-se -- it's making a suggestion. The user still has the option of picking something more secure.. so it's not entirely Apple's fault if your hotspot gets p0wned.
#fuckbeta #iamslashdot #dicemustdie
Don't use default passwords.
These comments are my own and do not necessarily reflect the views or opinions of my employer or colleagues...
abuse of the user's Internet connection
I abuse my internet on a daily basis.
I must not fear. Fear is the mind-killer.
FWIW, this has been fixed in iOS 7, it is now totally random.
-- sigs suck --
It's okay, I'll just ask the NSA who has been listening in.
So, someone else might be able to jump onto your phone data when you are tethering... however to do so they need to lug around a big computer tower with a bunch of GPUs plugged in, and only if you use the default password.
This is very much a non-story. Most people using tethering will have it enabled when they need it then turn it off (otherwise major battery drain), so they might be able to use your internet for a little bit but then they'll be left with nothing. And it's really really easy to change the default password, on the screen to enable mobile hotspot on your phone the password is displayed, tapping on it gives you the keyboard to change it. This was the way it worked from the beginning of IOS tethering.
With changing the password being so easy, how many people who use tethering would leave it at the default? Most people I know would change it just to make it more personal and memorable.
The tower-full of GPUs doesn't have to be on-site. One can always transfer the captured handshake to a remote system for cracking. Of course, this renders the goal of getting a little free wireless broadband pointless (as it supposes an attacker already has some kind of network access).
So, someone else might be able to jump onto your phone data when you are tethering... however to do so they need to lug around a big computer tower with a bunch of GPUs plugged in, and only if you use the default password.
I read the article, It said nothing about lugging around a computer filled with GPU. I would be willing to bet my laptop could handle that.
“The app also gives explanations and hints on how to crack a captured WPA handshake using well-known password crackers,” the paper said. “Future releases might also automate the process of capturing and cracking hotspot passwords. As computing power on smart devices is limited, one solution is to involve online password cracking services like CloudCracker, to crack hotspot passwords on-the-fly.”
In fact it sounds as if it may even be feasible without the laptop.
Thank god there's nothing that has a GPU inside of it that could fit in a pocket or a small purse / backpack -- sorta like how my Galaxy Nexus doesn't have a GPU that you could use. Certainly doesn't fit in my pocket either.
Okay, this isn't great, but let's keep it real. They're not hacking into your phone, they're accessing its hotspot. They just get free Internet. Whoo-hoo! Also, if someone actually manages to figure out the password, you get a big blue throbbing bar at the top of the screen telling you someone's using your hotspot.
Apple knows security about as well as I know Portuguese. I do not know Portuguese, lol. They're so obsessed with "just make it work" and "make it user friendly" that they toss security out the window just as quickly as Lexus did and now you can hack one and drive away in 2 minutes.
I think I can explain what happened.
First of all, this story is a dupe. It originally ran on April 1st, 1990. At the time, the story was about "System 6" but some recent tech media editor thought that meant "iOS 6" (I'll explain how the mistake happened, below). That explains the pre-mass-mainstream approach to passwords.
Secondly, even the 1990 story was a hoax. By the standards of the day, that was still such a stupid way to generate passwords, that no one would do it.
Third, the story was written by a guy who turned out to be working at Microsoft. The whole point of the hoax was to make the Newton tablet look stupid, a mis-engineered travesty designed by utterly clueless morons. The 2013 tech media editor saw "Newton" and knew that couldn't be right, which is how it became iOS. Newtons didn't really run System 6, but the original Microsoft author didn't know that.
In short, this is about stupidity that is so stupid, that people didn't do things that stupidly, even back when your mother hadn't heard of the Internet yet.
Just kidding. It's a modern story, but I just wanted to point out that even the most absurd bend-over-backward-to-rationalize-things explanation for behavior this stupid, still isn't very convincing. No field can distort reality to the required degree.
"Believe me!" -- Donald Trump
I've also never walked around with an dual FPGA board in a pocket.
Other mobile platforms might be affected by these deficits as well. Although, we did not analyze other platforms in detail, spot-checks have revealed that default passwords in Windows Phone 8 consist of only 8-digit numbers. As this results in a search space of 108 candidates, attacks on Windows-based hotspot passwords might be practicable. Moreover, while the official version of Android generates strong passwords2, some vendors modified the Wi-Fi related components utilized in their devices and weakened the algorithm of generating default passwords. For instance, some Android-based models of the smart- phone and tablet manufacturer HTC are even shipped with constant default passwords consisting of a static string (1234567890) [26]. However, future studies will be necessary to evaluate the security level of mobile hotspots on other platforms in more detail.
Of course news about a fake are Fake News.
I didnt see a link to the word list in the article. Anyone know where to find it?