Have you used a friend's laptop to charge your iPhone and gotten a prompt that says, "Trust This Computer?" Say yes, and the computer will be able to access your phone settings and data while they're connected. And while it doesn't feel like your answer really matters—your phone will charge either way—researchers from Symantec warn that this seemingly minor decision has much higher stakes than you'd think.
In fact, the Symantec team has found that hacks exploiting that misplaced "Trust" comprise a whole class of iOS attacks they call "trustjacking." Once a user authorizes a device, they open themselves to serious and persistent attacks while their phone is connected to the same Wi-Fi network as a hacker, or even remote attacks when the devices are separated.
Adi Sharabani, Symantec's senior vice president of modern operating system security, and Roy Iarchy, the modern operating system research team leader, will make that case Wednesday, in a presentation at the RSA security conference in San Francisco.
"Once this trust is established, everything is possible," Sharabani told WIRED last week. "It introduces a new vector of attack."
Sharabani and Iarchy's presentation focuses largely on a feature known as iTunes Wi-Fi Sync, the tool that lets iOS devices sync with desktop iTunes over Wi-Fi. For this process you physically connect a mobile device to a computer once, indicate that the iOS device can trust the computer going forward, and then enable iTunes Wi-Fi Sync from the PC. After that the two devices can sync and communicate whenever they are on the same Wi-Fi network without any further approval from the iPhone or iPad.
It's a reasonable and useful feature when used as intended. But an attacker could also plant a malicious computer—perhaps one shaped like a