Usability vs. Security: The Everlasting Trade-Off in the Context of Apple iOS Mobile Hotspots

 

source: https://www1.cs.fau.de/filepool/projects/hotspot/hotspot.pdf

Average cracking time (ACT) of an arbitrary iOS hotspot default password using different GPU clusters.

# GPUs	Hardware	Cycles per Second	ACT
2x	Nvidia Tesla C2075	46.600	3m 18s
1x	AMD Radeon HD6990	180.000	52s
4x	AMD Radeon HD7970	390.000	24s

To automate the process of word list generation, we built the iOS app Hotspot Cracker. This app assists in generating an iOS hotspot cracking word list, which might be used in subsequent attacks on other hotspot users. The app also gives explanations and hints on how to crack a captured WPA handshake using well-known password crackers. Future releases might also automate the process of capturing and cracking hotspot passwords. As computing power on smart devices is limited, one solution is to involve online password cracking services like CloudCracker, to crack hotspot passwords on-the-fly.

As the mobile hotspot feature is probably most often used while being on travel, on conferences, or hotel stays, an attacker will only have a limited amount of time to succeed in breaking into a mobile hotspot. Therefore, a very limited cracking time frame is the main requirement for such an attack to be practically relevant. Taking our optimizations into consideration, we are now able to show that it is possible for an attacker to reveal a default password of an arbitrary iOS hotspot user within seconds. For that to happen, an attacker only needs to capture a WPA2 authentication handshake and to crack the pre-shared key using our optimized dictionary.

As it is always a good advice to replace initial default passwords by user-defined strong and secure passwords, this becomes particular relevant on mobile hotspots passwords. Therefore, users of mobile hotspots, especially of iOS-based mobile hotspots, are advised to change their passwords. In addition, some mobile platforms (like Apple iOS) display the number of connected clients on the lock screen. Therefore, it is a good advice to periodically check that screen for any conspicuous activity. Finally, hotspot capabilities of smart devices should be switched off every time when they are no longer needed, to keep the overall attack surface as minimal as possible.

Vendors of mobile hotspot solutions should improve their way of generating initial default passwords. System-generated passwords should be reasonably long and should use a reasonably large character set. Consequently, hotspot passwords should be composed of completely random sequences of letters, numbers and special characters. It can be neglected that increased randomness could have a negative impact on the memorability of the passwords. Particularly, in the context of mobile hotspots there is no need to create easily memorizable passwords. After a device has been paired once by typing out the displayed hotspot password, the entered credentials are usually cached within the associating device and are re-used within subsequent connections.

Summing up, the results of our analysis have shown that the mobile hotspot feature of smart devices increases the attack surface in several ways. As the default password of an arbitrary iOS hotspot user can be revealed within seconds, attacks on mobile hotspots might have been underestimated in the past and might be an attractive target in the future.