PNL bug still leaving phone door open to hackers

[silicon_toad2000]

http://www.theregister.co.uk/2013/05/23/wifi_pnl_bug_unpatched/

Security expert Raul Siles has warned that years after it was first identified, the Preferred Networks List (PNL) Wi-Fi bug remains unaddressed on many an iPhone, Android phone, and Windows or BlackBerry handset.

The problem itself is simple enough, reports HelpNet Security. When searching for networks, a poor Wi-Fi implementation can result in a device exposing its PNL list to eavesdroppers. This could allow an attacker to spoof one of the network that appears on the user's list, becoming the vector for a man-in-the-middle attack.

PNL disclosure remains a problem in Android 2, 3 and 4, may occur when users add networks manually in iOS 1-6, and in BlackBerry 7, according to Siles. It has also been fixed in some versions of Windows Mobile.

Some mobile operating systems (BlackBerry, for example) give users enough control that the problem can be fixed manually – but only, Siles said, if the user knows there's a problem and knows how to fix it.

Given the growing popularity of BYOD in the business environment, there's the added danger of a fake preferred network being used to capture corporate logins. System administrators need to ensure that devices hide Wi-Fi network data (where this is possible), and Siles called for Android to be upgraded to allow users to hide new networks.