Tapped in: How your phone gives you up to companies and criminals

[Commentary] A lot has been done to secure major Web services and Internet applications, particularly on the PC. But one of the lessons we have learned was that for every data leak that has been plugged by the major websites, another springs up on mobile.

And mobile devices are the ones that face the greatest risk of surveillance and attack -- not so much from the National Security Agency, but from companies and criminals looking to track and target individuals on a smaller scale.

Public Wi-Fi has become an integral part of how mobile devices’ apps work. Apple and Google have both configured their mobile services to leverage Wi-Fi networks to improve their location services, and mobile and broadband companies offer public (and unencrypted) Wi-Fi networks to either offload users from their cellular data networks or extend the reach of their wired network services. Comcast, for example, has been expanding its Xfinity broadband networks by turning access points at homes and businesses into public Wi-Fi hotspots for subscriber access.

That’s great for customers’ convenience, but it also opens up a potential vector of attack for anyone who wants to get in the middle of broadband users’ Internet conversations. We demonstrated one potential Wi-Fi threat during our testing -- using a rogue wireless access point broadcasting the network ID (SSID) “attwifi” prompted AT&T iPhones and Android devices with default settings to automatically connect to them.