Apple iOS users are most at risk from hijacked connections due to the way in which Safari manages its security certificates, BitDefender has warned.
The company revealed the issue at their security conference in Bucharest, with TechRadar in attendance, during a demonstration of the risks posed to users of free public Wi-Fi networks set up by would-be attackers.
The attack is known as a 'man in the middle' where a rogue W-Fi network is set up to attract people looking for free public Wi-Fi.
Anyone connecting will be asked to accept a security certificate from an unknown source, after which the originator of the network can track browsing behaviour and steal passwords, regardless of the device or operating system.
Safari, not so good
However, BitDefender revealed that Safari users were not able to delete this permission afterwards, meaning that they wouldn't receive the same alert in the future, putting them more at risk from a repeat attack.
"Receiving an SSL certificate warning doesn't mean someone might be hijacking your connection, it means someone is hijacking your connection," Alexandru Balan, product manager for mobile solutions warned.
"If you ever see a message asking you to accept an SSL certificate from an untrusted source, run like hell," he continued.
"Once a certificate is accepted in Safari, it stays there, and that certificate is unable to be deleted or rectified. I was not able to delete the permission in Safari."
Alexandru then showed how usernames and passwords could be easily stolen by attackers, using PayPal as an example but warned that the process was the same for Facebook, Twitter or any online service.
