iOS 5 connects without user action to attwifi when in range

[elistan]

Yep, I've noticed the exact same behavior with my 4S. I used it in a Starbucks, saw it was connected to "attwifi" even though I never initiated such a connection, and was confused why there wasn't a "Forget This Network" option. So I set the "Auto-Join" to off and haven't paid much attention to it since. I should double-check it's behaving properly - thanks for reminding me of this.

It's not a "feature" I care for, because of the risk of somebody spoofing an attwifi SSID and capture all network packets, encypted or not.

 

[RichardF]

To answer this question:



That depends on you, and how you're set up your e-mail accounts. iOS since version 1 has had the capability to interact with e-mail accounts using SSL/TLS. But if you make a decision in your settings not to, then that's on you.

I have SSL turned-on for all my email accounts.

But is that effective to protect you from a man-in-the-middle type of hacking?

----------

This has bothered me in the past. It is a nasty security issue.

It's sad so many people downvoted the OP, and that so many people don't understand the issue. It has nothing to do with forgetting the network, or telling your phone to prompt when WiFi is in range.

I unboxed a phone, wiped it and restored iOS, and the phone auto-connected to an "attwifi" network the first time one was in range. No prompts, no authentication, and no security.

There is no way to make it forget the network, you can only tell it to stop auto-joining, but only if you are in range.

Thank you. You summed it up better than I could.

----------

[...]

It's not a "feature" I care for, because of the risk of somebody spoofing an attwifi SSID and capture all network packets, encypted or not.

Exactly!

 

[Hammie]

This is odd, IMO.

I got my kids an iPad and iPod for Christmas. Both devices DID NOT automatically connect to an attwifi site (at a Starbucks) until they told it to.

I cannot remember what my iPhones did when I first got them...

 

[Block]

Have you tried seeing if it connects to other open networks that are not named attwifi?

 

[donnaw]

I also remembered reading about this (as another poster stated). Here is a link. It may shed some light.


http://www.att.com/gen/press-room?pid=4800&cdvn=news&newsarticleid=26865

 

[RichardF]

Have you tried seeing if it connects to other open networks that are not named attwifi?

Yes and it doesn't.

----------

I can't find the article but I remember reading about a press release from ATT a while back that said if you have an iPhone it will *automatically* connect to att wi-fi hotspots at starbucks, att stores and so on.

So their must be some special code or somefunctionality that detects att wi-fi hotspots and connects to them regardless of what your wi-fi setting is if your wi-fi is on.

I also remembered reading about this (as another poster stated). Here is a link. It may shed some light.


http://www.att.com/gen/press-room?pid=4800&cdvn=news&newsarticleid=26865

Thank you for this. So this dates back to iOS 3.

I cannot believe Apple allowed this. The moronic language/ wording is also typical of short-sighted corporations touting a problem as a "feature".

Anyone can "spoof" attwifi as I demonstrated above by setting their SSID to the same.

 

[summitRun]

I can confirm that on day 2 of my 4s ownership with wifi turned OFF and never having once joined any wifi network that I was auto connected to "attwifi" at a starbucks. I didnt actually realize it until after I sat down and was fooling around with my new phone. Whats crazy is that I was parked at least 100 ft from the store and when I got to my car I stayed connected. Not cool...

 

[Daveoc64]

I'm pretty sure the Wi-Fi setting "at fault" is stored in the Carrier settings file.

Apple allows Carriers to specify Wi-Fi settings to be used by the phone.

In this case, AT&T is using it for the "attwifi" network.

IMO iOS should allow the user to disable that more clearly, but Apple gives the carriers a LOT of control with the carrier settings and I doubt they'll change that any time soon.

<key>attwifi</key>
		<dict>
			<key>AuthMethod</key>
			<string>WISPr</string>
			<key>AuthenticationRealm</key>
			<string>attmobilityiphone.com</string>
			<key>Password</key>
			<string>%attmd5%</string>
			<key>SharedSecret</key>
			<string>a446649326d41d87dbb8caec8caf736a</string>
			<key>TrustedDomains</key>
			<array>
				<string>.wayport.net</string>
				<string>.att.net</string>
				<string>.att.com</string>
				<string>.sbc.com</string>
			</array>
			<key>UserName</key>
			<string>%phonenumber%</string>
		</dict>
	</dict>

AT&T also specifies two other networks:

"ATTMETROWIFI" and "Wayport_Access"

 

[RichardF]

This is very helpful. Thank you very much.

With iOS 5 I thought there were hardly any reasons left to jailbreak an iPhone.
I was wrong.

Is there a way to edit the carrier file without having to jailbreak the phone?

 

[david34]

This is odd, IMO.

I got my kids an iPad and iPod for Christmas. Both devices DID NOT automatically connect to an attwifi site (at a Starbucks) until they told it to.

I cannot remember what my iPhones did when I first got them...

These settings come from the carrier files. I suspect you purchased WiFi iPads or 3G iPad and didn't activate the wireless service, hence the iPad has nothing to do with AT&T.

This is very helpful. Thank you very much.

With iOS 5 I thought there were hardly any reasons left to jailbreak an iPhone.
I was wrong.

Is there a way to edit the carrier file without having to jailbreak the phone?

The carrier file is signed, if you want to edit it you need to do further hacking to disable the signature check.

And still, iOS 5 can do OTA carrier updates, presumably forced & un-prompted.

 

[Hammie]

These settings come from the carrier files. I suspect you purchased WiFi iPads or 3G iPad and didn't activate the wireless service, hence the iPad has nothing to do with AT&T.




The carrier file is signed, if you want to edit it you need to do further hacking to disable the signature check.

And still, iOS 5 can do OTA carrier updates, presumably forced & un-prompted.

Yes, the 3G iPad has not had the data plan activated. Thanks for that info. Makes sense now.

 

[VulchR]

Weird bug. In the UK one can connect to BT wifi networks (BTFON), but an app (actually a fairly crappy app) is required to make the connection. You'd think there'd be something similar in the US for AT&T.

 

[RichardF]

These settings come from the carrier files. I suspect you purchased WiFi iPads or 3G iPad and didn't activate the wireless service, hence the iPad has nothing to do with AT&T.




The carrier file is signed, if you want to edit it you need to do further hacking to disable the signature check.

And still, iOS 5 can do OTA carrier updates, presumably forced & un-prompted.

I hadn't thought about the OTA move. Even if one manages to edit it, they could just update it.



So...


The only solution is to this problem, is to connect manually to a router you have control over, say at home, each time setting to SSID to the auto-join network names mentioned above by Daveoc64 and to toggle the Auto-Join setting under each to Off.


Set the SSID of your router to attwifi, ATTMETROWIFI and Wayport_Access and toggle the setting to Off for each.

Thank you everyone for your participation. Collective knowledge is amazing.

I hope this thread will shows-up in Google and will help someone out there.