Securing your iPhone 2.0

The iPhone 2.0 software update released earlier this month offers some dramatic improvements from earlier versions in security management for corporate users. But even these welcome changes aren’t enough to make the iPhone seamlessly secure.

A year ago, I criticized a number of design and interface decisions Apple made with the original iPhone that increased the difficulty in creating secure network connections, and keeping your data free from prying eyes when using unsecured networks, like free and commercial Wi-Fi hotspots. The 2.0 software has a number of gaps, but it’s increased the ease with which you can take steps to secure your data. However, Apple still needs to open its arms to network security clients, to meet what enterprises (and many individuals) demand from a secure mobile device.

This isn’t to say that other devices exceed where Apple is at; rather, Apple is uniquely positioned to provide desktop operating system levels of security in the iPhone.

Reviewing the original vulnerabilities

Much of the iPhone’s original set of security problems stem from the device’s willingness to let you connect to any open access point that you pass by. That’s still a problem. As of this writing, AT&T hasn’t yet opened up its Wi-Fi network to iPhone users—although the service provider has let it slip that free access is apparently coming, with the latest false start occurring on Friday. But when AT&T opens its U.S. network to iPhone users, there’s still no security beyond means you take into your own hands.

AT&T doesn’t include corporate-grade secure connections at its hotspots as an option. In contrast, competitor T-Mobile has offered that option for four years. The iPhone now supports this kind of connection, and it could be a trivial way to render your network activities impenetrable to other hotspot users. (The option is 802.1X, explained below, and found nearly universally in enterprise networks in medium-to-large corporations.)

You must still maintain vigilance in connecting to Wi-Fi networks that you don’t know about. That’s why I continue to recommend, that iPhone users (and all laptops users) connect with a virtual private network (VPN). A VPN creates an encrypted connection between a device, like an iPhone and a remote VPN server. Any snooper who intercepts this data on a hotspot network sees just scrambled nonsense that, with current technology, can’t be turned back into sense by anyone except by the parties on both ends. (802.1X encrypts the connection between a computer or mobile device and the Wi-Fi gateway; a VPN encrypts the connection through the gateway all the way to a network endpoint somewhere far away.)

The iPhone now supports three types of VPN connections, up from two in the 1.x firmware, and several services provide a VPN for a monthly fee. WiTopia.net may be the best option for iPhone owners. It charges $40 per year for its VPN service, which requires the installation on a desktop or laptop computer of a VPN client that uses SSL, which is not available on the iPhone yet. However, WiTopia throws in a free PPTP connection for the iPhone, which is one of the supported types.

The Advanced settings screen for your SMTP mail account lets you enter a port for retrieving e-mail.

Other ways of securing your traffic have improved, though. If your ISP’s secured SSL mail server uses an unusual port (the equivalent of a numbered cubbyhole at an IP address at which certain kinds of traffic are expected), you can avoid a workaround to enter that port.

In Settings -> Mail, Contacts, Calendars -> mail account -> Advanced, you can enter a port for retrieving e-mail. Likewise in your mail account, select SMTP and choose a mail server, and you can enter a special port in the Server Port setting. This goes a long way towards dealing with anything unique your ISP may have used.

So far, the App Store features no software designed to create SSH (Secure Shell) tunnels, VPN beyond the built-in types, or other elements that would make it simpler to create a secure connection. This makes sense, because the terms of use for Apple’s iPhone software developers kit (SDK) allow only sandboxed applications which have no access except through specific channels to underlying information. It’s likely that any additional security options will have to be developed in conjunction with Apple or licensed by the company.

Better security through VPN profiles, WPA/WPA2 enterprise

In two areas, Apple has made it much easier to maintain secure communications and join secure networks. You can set up multiple VPN profiles, each with unique information. Also, an average user can join a network secured with WPA/WPA2 Enterprise, a method of requiring a unique login to a Wi-Fi (or Ethernet) network by each user.

The VPN improvements are notable, because for folks who require two or more VPNs for their job—which can include a personal one on the road and a corporate one in the office—they simply couldn’t make iPhone 1.x work for them. The original firmware series offered PPTP (Point to Point Tunneling Protocol) and L2TP (Layer 2 Tunneling Protocol, which is paired with IPsec or Internet Protocol Security as L2TP over IPsec). But you could only set up one connection for each type. If your work or life required two L2TP connections, you were out of luck.

In iPhone 2.0, you navigate to Settings -> General -> Network -> VPN, where you click tap Add VPN Configuration to get started. The Add Configuration dialog allows you to choose among L2TP, PPTP, and IPsec, the last of which is Cisco’s particular flavor of IPsec.

If you choose L2TP, for instance, you enter a description that’s displayed in the main VPN setting page, the VPN server’s host name, and your account name. Some VPN servers require just a password; others use two-factor authentication, where you also enter a code that appears on an RSA SecurID token generator that you carry with you. If your corporation requires that, you turn on the SecureID switch. If a password is required, you can choose to either enter it in the setup and the iPhone will automatically use it; leave the field blank, and the iPhone prompts you each time you connect to the VPN. L2TP connections require a shared secret that a system administrator would give you. Selecting Send All Traffic allows the iPhone to encrypt all connections, the recommended choice.

Here’s the profile that appears in the VPN setting screen after you’ve saved your VPN configuration.

Tap Save, and the profile appears in the VPN setting screen. Tap the profile to select it as your default.

You can enable your VPN through the On/Off switch on the VPN setting screen; that switch is also found on the main Settings screen below the Airplane Mode and Wi-Fi if you have just a single profile. If you have multiple profiles, you’ll see the message Not Connected which, when tapped, takes you to the VPN setting screen.

Since an iPhone might switch among Wi-Fi, 2G, and (for new models,) 3G, VPN connections still lack a critical element for roaming users—continuity. Several firms make software that allows mobile devices to maintain a continuous stable IP address, and use some acceptable network trickery that relies on simple client network software on the mobile device and a remote server to keep a connection constant even as it switches among network types. I saw this demonstrated as long ago as 2003.

Apple hasn’t invested in such a technique, nor has AT&T, and as noted above, a third party couldn’t simply write the missing piece. It’s a gaping hole, because a VPN, once activated, shouldn’t need to be managed by users until they decide to turn it off. With the iPhone, the VPN fails whenever a network transition happens, and it must be turned off and back on manually.

Setting up a basic WPA/WPA2 Enterprise connection is far simpler. This connection method is a form of 802.1X, which is called a port-based access control protocol. In plain English, 802.1X lets you connect to a Wi-Fi access point without gaining access to the network to which that access point is itself connected until you prove your identity. Once you prove yourself, the network assigns you a unique set of encryption key material (which is broken down into all the various keys your Wi-Fi adapter needs). No two users on an 802.1X network can snoop on each other’s traffic, making it more secure as well.

Subscribe to the iOS Tips & Trends Newsletter

Comments