What are the risks of connecting an iPhone to an unsecured wireless network?

Question

This is a similar question to this one, but since I can't tell how well that translates to the iPhone, I'm asking it again.

I've recently been abroad on holiday, and with very expensive data roaming charges, it's very tempting to use an open wifi, for example for downloading app updates. I expect that communication with the App Store goes over HTTPS, so it should be safe entering my iTunes password there, right?

I know the risks of using HTTP over an unencrypted wifi, but I have no idea what protocols other apps besides Safari use. Anything I need to be aware of?

Will using a VPN client to connect to my university's network effectively make my connection secure?

Answer 1

The iTunes Store uses HTTPS for most of it (if not all), at least that's how it was when I checked.

Regarding your specific question, you have to consider the iPhone is another regular device, albeit full of limitations in the tweaking department, it still runs a OS X variant, with derived UNIX parts, etc. So for the sake of this question, let's say your iPhone is a computer running some form of Unix Operating System; with that in mind, all the security risks that affect a computer are valid. Should the iPhone (and iOS) have a remote vulnerability, you would be exposed, just like your Macbook or your Windows computer or even your Linux Box.

Using 'open' Wi-Fi means anyone can log in and inspect the traffic. Anyone trying to do malicious stuff will be eavesdropping and listing for traffic in the network.

If you send an email, it will likely be unencrypted and visible. If you use IM (MSN, Yahoo, iChat/AIM, Jabber, etc.) you are likely not encrypted either (nor using a secure channel by default).

When using Safari, anything that doesn't go though some form of HTTPS is visible. Cookies and Data, with all the associated risks.

So as you can see, and excluding particular OS vulnerabilities, we're very exposed when using open networks. Most people doesn't really care or know but the risks are there (and so are the malicious users) :)

Connecting through a VPN will help with your traffic, but I have never used a VPN on an iPhone and thus I don't know what the capabilities of that are.

Answer 2

Considering that SSL has been cracked (and HTTPS relies on it), the biggest risk is theft of private data which could result in: loss of money, privacy violation, harrassment/stalking/blackmailing etc.

Also, most websites/apps (hint: POP3 Mail) might not even use HTTPS and transfer clear-text information. I would recommend at least some sort of secure tunneling for your traffic (there are services offering VPN tunneling for anonymity/privacy).

It is also possible (though I've seen no exploit demonstrated using a free wifi for a man-in-the-middle attack) to get an iDevice infected or rootkitted with harmful software which otherwise could not reach that device. This will result in further, long term losses (from private data to media, phone recordings). For the paranoid, this eHow article is a good starting point.