Lawrence -- regarding "Tethering" and "WiFi" on iPhones ----

a)is there usable information in a packet trace when iPhones are connected to WiFi?

b)Since the earlier iPhones (Vers 3.x) could be spoofed, wouldn't the packet trace reveal necessary info in the certificates?

c)How secure is "tethering?"  Then, if the device that is tethered to the mobile device has malware of any sorts, isn't it reasonable that traffic will/could increase?

The diagnosting data to apple is merely an event log. I don't think text files go up to 50 megabytes easily.

BackPacker57 wrote:

 

Lawrence -- regarding "Tethering" and "WiFi" on iPhones ----

 

a)is there usable information in a packet trace when iPhones are connected to WiFi?

 

b)Since the earlier iPhones (Vers 3.x) could be spoofed, wouldn't the packet trace reveal necessary info in the certificates?

 

c)How secure is "tethering?"  Then, if the device that is tethered to the mobile device has malware of any sorts, isn't it reasonable that traffic will/could increase?

If an iPhone is connected to an open (non-encrypted) WiFi network then any communication can be intercepted. Unless the communication is over established a Secure Sockets Layer connection (HTTPS) it can all be captured. This is how the researcher in the CarrierIQ video found what was being sent.

Tethering, that is, using the iPhone as a cellular modem to a computer, is secure, both because the connection is WPA2 encrypted, and the cellular network itself is encrypted. However, this does not prevent an app on the phone (such as CIQ) or on the computer from phoning home.

I doubt that much data is sent this way, however. Even when the location database was bening sent, it was usually only a few KB.

I too am experiencing excessive/unexplained cellular data usage.  Is there any specific diagnostic data that I can view to pinpoint any/all data transfer to pin point exactly what app or iOS feature is transferring so much cellular data (anywhere from 9-15 MB) when the phone is asleep?

If not is there some kind of profiler app that exists that I can install to monitor this?

Dataman will monitor WHEN data transfers happen, but not which app the are coming from. There are several apps that have a reputation for receiving huge amounts of data. One is the Maps app when you are using it, because maps are downloaded as they are needed. It can easily use a megabyte a minute if you are moving when using it. Another is Facebook. All streaming apps (e.g., Wunderadio, Heart radio, SiriusXM). FB and the streaming apps run in background, so it won't be obvious they are running.

Lawrence has answered with DataMan and the limitations--

Here's an interesting presentation:

Toorcon 2010: IPhone Rootkits? There's an App for That

OK, I'm not using any apps that stream media but I am using the FB app.  Is this widely known? I'm surprised that FB downloads content in the background when the phone is asleep.  If that is indeed true, this is most likely the culprit.  I'm very conscious about not using FB when I'm on 3G.  99% of the time I use it I am on WiFi.

After searching the web it seems that nobody really knows if FB continues to download/send data while in the background or when the phone is in sleep mode.  Anybody who can provide information regarding this or any other apps that might be behaving this way, please chime in with some sources to back this up.  Thanks in advance!

Well, the evidence is indirect. A lot of people (if you read this and other threads) have said their heavy data usage dropped after removing Facebook. But correlation does not equal causation.

Other indirect evidence: If you press HOME while if FB, then open it a few hours later, is there content that wasn't there when you closed it?

I don't have Facebook and won't--- but you could try viewing the iPhone behavior using the iPhone Utility to just see if there is anything showing up in the console.

This means you must connect the USB to your Mac or PC and run the utility and Facebook simultaneously-- I don't know, just saying you could try.  When I use a COMPASS App and the utility I see activity---

iPhone Configuration Utility 3.3 for Mac OS X

Just curious... if you leave both Utility and iPhone in USB and login to FB then do nothing for 1 hour? Does your console continue logging any events?  Again, just curious---

Sat Dec  3 12:22:48 unknown SpringBoard[24] <Notice>: MultitouchHID(208b30) uilock state: 1 -> 0 (Pressed Home)

Sat Dec  3 12:22:48 unknown kernel[0] <Debug>: AppleMultitouchSPI: downloaded 44484 bytes of firmware data ("0x0088.hex") in 73ms (13ms stage 1, 60ms stage 2).

Sat Dec  3 12:22:48 unknown SpringBoard[24] <Notice>: MultitouchHID(2a2d80) device bootloaded

Sat Dec  3 12:23:05 unknown kernel[0] <Debug>: launchd[71] Builtin profile: container (seatbelt) (Launched Compass App)

Sat Dec  3 12:23:05 unknown kernel[0] <Debug>: launchd[71] Container: /private/var/mobile/Applications/8BEA12E2-D242-4988-8AB0-7EB969182E06 (seatbelt)

Sat Dec  3 12:23:05 unknown Compass[71] <Warning>: loading view

Sat Dec  3 12:23:06 unknown Compass[71] <Warning>: expected:0, got:5, file:///var/mobile/Applications/8BEA12E2-D242-4988-8AB0-7EB969182E06/Compass.ap p/index2.html

Sat Dec  3 12:23:06 unknown Compass[71] <Warning>: file

Sat Dec  3 12:23:06 unknown Compass[71] <Warning>: loading started

Sat Dec  3 12:23:08 unknown Compass[71] <Warning>: finished loading

Sat Dec  3 12:23:10 unknown Compass[71] <Warning>: expected:0, got:5, testheading:

Sat Dec  3 12:23:10 unknown Compass[71] <Warning>: testheading

Sat Dec  3 12:24:06 unknown SpringBoard[24] <Notice>: MultitouchHID(208b30) uilock state: 0 -> 1 (Phone sleep in USB dock)

Sat Dec  3 12:26:30 unknown CommCenter[28] <Notice>: Deactivating PDP context 1, because it has gone idle.

Sat Dec  3 12:26:31 unknown CommCenter[28] <Notice>: Deactivated PDP context 1 that supports connection types 0x2

Sat Dec  3 12:26:31 unknown configd[22] <Notice>: network configuration changed.

Sat Dec  3 12:26:31 unknown configd[22] <Notice>: CaptiveNetworkSupport:CaptiveHandlePrimaryChanged:2034 new primary: 1076CD48-4E0A-4288-8E5D-9A09E18B7B35 on pdp_ip0

Sat Dec  3 12:26:31 unknown configd[22] <Error>: CaptiveNetworkSupport:CaptiveCopyCurrentWiFiNetwork:622 WiFiManagerClientGetDevice for pdp_ip0 returned NULL

@ddarko @Lawrence Finch

"After searching the web it seems that nobody really knows if FB continues to download/send data while in the background or when the phone is in sleep mode.  Anybody who can provide information regarding this or any other apps that might be behaving this way, please chime in with some sources to back this up.  Thanks in advance!"

Am I missing something here? Surely if every other App is closed, all 3G, Mobile Data, and Location Services are OFF, FB is running and you get data usage -checked either via the Settings menu or via your router logs ....... then FB is still downloading?

@BackPacker57 - the looks like a nice app ! Alas the link for the Windows version is broken, so I can't make use of it.

I wish vendors paid me to keep their webpages updated.

Here's the link for iPhone Configuration Utility for Windows Only V 3.4

You will see the buttons to download once you get there---

The developers of iPhone apps have already stated and confirmed that:

"Some apps can go on for 10 minutes before the iOS watchdog kills it. It depends on how an app is designed by the developers."

So to expect users to act as a kill switch is first unreasonable and secondly unlike Apple wanting to think for the users (as is often claimed).

As long as the app runs, you rack up data charges against your account.

I think everyone needs to go back and read over some of the prior 100 pages of discussion. All of this has been discussed and the Facebook topic is just clouding the water.

Maybe we should go back and get a list of conerns together for Apple and wireless carriers so we have some common concerns.