Internet security researcher Samy Kamkar has uncovered a potential security flaw that could allow hackers to steal data from iPhone owners by tricking them to join an untrusted network. The attack takes advantage of the way iPhones rejoin AT&T hotspot without verifying that the network is legit, according to CNET.
“The iPhone joins the network by name with no other form of authentication,” Mr. Kamkar said.
Mr. Kamkar followed up his discovery by writing an application that displays custom messages in the iPhone’s Maps application. He plans to release the code on the Internet, too.
The discovery means anyone with a laptop can set up their own fake AT&T hotspots and potentially capture network activity from unsuspecting iPhone owners.
iPhone owners can avoid potentially auto-joining a fake AT&T hotspot network by using the built-in “Forget This Network” option every time they leave a legit AT&T hotspot. That won’t, however, prevent someone from joining a network posing as an AT&T network — and it’s a kludgy workaround, too.
Apple hasn’t commented on the potential security flaw, or said if they plan to change how the iPhone verifies Wi-Fi hotspot connections.