[General Topics] jenneh:
Hello,

I wanted to have a discussion about our phone's network security and share an idea of a solution.

I don't know how practical any of this is but I would love to learn.

This post is in regards to how our phones default to automatically connect to a "Known" Open Network, as in a network named similarly to one we have connected to in the past.

An example would be with McDonalds. You are able to connect to the network at one restraunt and then drive half-way across the city.

The next new McDonalds facility with the exact same named network or SSID broadcasting, will result in a user's phone automatically connecting to it.

It is not practical to expect the user to turn off their wifi or to "forget" the network after every single use.

The user is human.

So why not implement a fix with the idea in mind most users will want to leave their wifi on and not have to forget networks?

But First of all, why should anyone care?

I have listened to some Fascinating talks on shows like David Bombal's Podast, and Jack Rhysider's Darknet Diaries, about Real World Exploits using this vulnerability as an attack vector.

One man literally mounted a router on a drone and flew it up many stories to get someone connected to his network, haha.

Naomi Brockwell has an Excellent video that explains some of the technicals:

My talk here has nothing to do with the phone broadcasting ssids bit, as it looks like vendors are researching this element.

Instead the scope will be contained to what she is talking about at 9:10 specifically the Automatic Connection to a "Known Network"

At 10:24 Shannon Morris Demonstrates how easy an attack vector this vulnerability is.

So I have very little programming knowledge but I would love to share an idea I cannot shake and maybe someone can do something with it.

I also do not know how the PNL list is coded or anything, I will just do my best to describe my theory.

Say our phones store their network lists something similar to this:

PREFFERED NETWORK LIST:

MCDONALDS_WIFI

STARBUCKS_WIFI

WALMART_WIFI

In order to add an element of security and to actually make the one network the user connected to at one buisness be "known" to our device,

Could a so called "seed" be added to the way the PNL stores the SSIDs?

For instance:

Could a genesis of "_0" or something to that affect be added in the log specifically, when the PNL initially stores the new network the user authenticated?

Could the Current IP address of the Network that the user connected to, also be stored in the PNL logs?

This would require another line of code to then force the PNL to Verify if the last known IP matches the current SSID's IP that is broadcasting.

If the IPs did not match, couldn't a simple prompt pop up to simply ask the user if they want to authenticate?

View attachment 5764093

So that, if you are sitting at home and all of a sudden your phone says a Connection request from Starbucks has been initiated, Continue?

After screaming inside, you could proceed to call the police, and lock your doors, haha.

I understand there is the possibilities for Data leaks from our devices, we wouldn't want our phones broadcasting our home ip or friends network ips.

Perhaps something like this theory could be a protocol issued only on "Open Networks" to give that small extra layer of security.

To build upon the theory more. User authenticates McDonalds wifi with an IP of 10.10.10.10

PNL Then saves this in the log as:

MCDONALDS_WIFI_0

and in the background somewhere, it also has the ip stored.

So the next day, user goes to a McDonalds in Another city and the device recognizes the name but then it does a check if the addresses match the last known IP

If it does not, this ip is 11.11.11.11 it could then prompt the user with two options

1. Authenticate the request

2. Deny

If the user authenticates the request, the device could store the new authentication like this

MCDONALDS_WIFI_1

And thus the seed just generates the next number for each same named open network SSID a user authenticates.

Idk if this made sense. I really wanted to get it out there I tried my best to make it make sense.