Usability vs. Security: The Everlasting Trade-Off in the Context of Apple iOS Mobile Hotspots Andreas Kurtz, Felix Freiling, Daniel Metz Friedrich Alexander University Computer Science Department Technical Report CS-2013-02, June 2013 Available: https://www1.cs.fau.de/filepool/projects/hotspot/hotspot.pdf Presented by Tobey Hung

Overview Apple smartphones can be turned into portable Wifi hotspots. Default passwords generated are memorable BUT weak and susceptible to brute force attacks.

Threats Large attack surface: - Multiple connectivity options hence many points of entry for attackers to get into the system. Types of attacks: Abuse Internet Connection Exposed Services Eavesdropping (Man-in-the-middle)

Password Generation Default passwords are 4-6 letters long followed by 4 numbers. - All words generated can be found from a online word list of around 52500 entries. Reverse engineering shows that passwords are generated from a front-end spell-checking service. - Only 1842 entries taken into consideration. Selection of words is skewed with some words being chosen more frequently than others. - Some words are 10 times more likely to be selected than others.

The Attack Attack can be simulated in 4 steps: Identifying iOS targets. - e.g Business travellers at airports. De-authenticating wireless clients. - Forces users to re-authenticate Capture WPA handshakes. Cracking hotspot default passwords. - Offline brute force on suggestWordInLanguage() word list while invoking most commonly used words first. - CloudCracker for cloud password cracking

Limitations and Countermeasures - Limited time frame. - Need to be within proximity of the hotspot. Countermeasures: - Replace default passwords with user-defined strong and secure passwords. - Hotspot switched off when not in use. - Check screen for suspicious activities. e.g Unknown connected users.

Appreciation Authors adjust experiment to match real life scenarios: - Adjusts time efficiency of attacks to match a realistic time frame. - Created an dedicated application “Hotspot Cracker”. - The whole cracking process can be replicated easily which can be used as a basis for future work.

Criticism Problem is overhyped: - Can be fixed with a simple software update of the application as the only form of attack described is brute force. - The problem will likely to be addressed through advancement of security in future iOS systems (e.g iOS 7). Focus on the wrong aspect of the security issue. - Step 4) Password generation can be fixed easily. - But what about the other steps?

Question “What forms of authentications would we need to ensure secure wireless data transfer?”