iPhone security: Experts compromise email names and passwords over WiFi

A team of researchers have successfully compromised the security that protects sensitive data being transferred over WiFi networks in four phones, the Nokia N95, Windows HTC tilt, T-Mobile G1 Android and Apple iPhone 3GS.

A team from SMobile Systems managed a “man-in-the-middle” exploit, in which communications on an unsecured wireless network are intercepted, re-routed, and used to enable or disable connections and to replay and view communications between the systems.

Using the hacker’s toolkit of Arpspoof and SSLStrip, the researchers succeeded in gaining access to email user names and passwords by breaking into the SSL encryption on the devices.

On the iPhone 3GS, the researchers managed to gain email user name and password through an SSL bypass attack on the iPhone using both the Safari web browser and the Mail app to access email.

“Targeting a smartphone’s mailbox, web browser or email application, the testers were successful in getting email login credentials for all four devices,” reports ITPro.

The researchers warn, “the use of public WiFi hotspots should be approached with caution and care should be taken that confidential or private data is adequately encrypted, when it becomes necessary to access such data.”

They urge users to ensure they use trusted and secure WiFi networks in order to keep safe. And warned that smartphones should be equipped with enterprise-scale security counter-measures to protect corporate data.

The report is available in full here (PDF)