T-Mobile Wi-Fi Calling App vulnerable to Man-in-the-Middle attack

T-Mobile devices having a default Wi-Fi Calling feature that keeps you connected in areas with little or no coverage using Wi-Fi connection. But according to new finding by students Jethro Beekman and Christopher Thompson from University of California Berkeley, that this feature lets millions of Android users vulnerable toMan-in-the-Middle attack...

The simplest way to become a man-in-the-middle would be for the attacker to be on the same open wireless network as the victim, such as at a coffee shop or other public space.

In a technical analysis of the exploit, The flaw could potentially allow hackers to access and modify calls and messages made by T-Mobile users on certain Android smartphones. Beekman and Thompson informed T-Mobile, a division of Deutsche Telekom, of the flaw in December and on March 18 T-Mobile was able to resolve the issue for all affected phone models.

T-Mobile uses regular VoIP for Wi-Fi Calling instead of a connection that encrypted, something that aids in its vulnerability. The certificate validation had not been fully implemented, so without this proper verification, hackers could have created a fake certificate and pretend to be the T-Mobile server.

T-Mobile released a security update to its Android users on March 18 that resolved the issue. Other carriers around the world have similar features enabled on some smartphones, including Rogers Wireless in Canada and Orange in Britain.