Normally when one thinks of MiTM (Man In The Middle) attacks over wireless802.11 protocols, thoughts of ARP Poisoning and Wifi-Pineapples come to mind. Traditionally these attacks were conducted against laptops using embedded wireless functionality. Now that most mobile phones and tablet devices have Wifi capabilities in addition to access to their cellular networks, they have added themselves to the list of potential victims.
Wifi only devices, such as Google Android tablets and Apple Ipads, are particularly at risk to these kinds of attacks, especially in public environments such as airports.
If you use an Android or iOS device to connect to a Microsoft Exchange server over WiFi, security researcher Peter Hannay a PhD student, researcher and lecturer based at Edith Cowan University in Perth Western Australia has taken readily available security tools and prepared a rather damaging MiTM attack targeting mobile devices over WiFi.
The purpose of this attack is to impersonate an application the mobile device is attempting to connect to (MS Exchange Server in this case). Once the connection is established, the bogus Exchange Serve sends provisioning commands back to the device. Among commands that can be sent is the option to remotely wipe the device of its data.
The future does not look particularly bright for mobile device owners. Pending research is attempting to add the implementation of an open source software protocol library with the objectives of emulating the ActiceSync protocol and serving as a translation layer between mobile MS Exchange clients and other types of servers. This could ultimately provide such nefarious activities as retrieving data from the mobile device such as address books, contacts, emails, calendar entries and similar data using remote backup facilities or pushing policy to the phone and change configuration options such as what server the device wants to communicate with by default. There are, however, mobile hacking and security training classes available to help people learn countering techniques (and other attack techniques).
This attack is not viewed as a flaw in MS Exchange Server or the client software, according to Microsoft, but a flaw in the implementation of the aforementioned client in the Google Android and Apple iOS mobile operating systems. One has to at least question the trust model that is in place. The server component goes through great measures to ensure that a trusted client and end user is connecting while the client doesn’t follow suit. Microsoft Windows Phones are not vulnerable to this attack.
Industrial Cybersecurity
September 28, 2023
Want always be up to date?
By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.
Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings
You might have heard that the iPhone is almost completely impossible to hack or that Samsung devices have some of the best firewalls in the
Have you heard about the term “test automation” but don’t really know what it is? Well, you’ve come to the right page! Get all your
This article explores the idea of discovering the victim’s location. Previously, we have used several tools for OSINT purposes, so, today let us try this
Want always be up to date?
By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.
Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings
