In today’s world where free public Wi-Fi hotspots are becoming the norm, rogue access points are a significant threat as they are primarily activated to attract unwary users to connect to them and thereafter harvest the connections thereof. Rogue access points work by posing as legitimate public hotspot access points while looking so much the same as their targets.

An evil twin, for instance, is a rogue access point that acts as a man-in-the-middle monitoring their traffic of victims. The attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The evil twin will have the same Service Set Identifier (SSID) and Basic Service Set Identifier (BSSID) showing a MAC address as that of the legitimate access point, and it will be configured to pass Internet traffic through to the target access point while monitoring the victim’s connection, or it can simply say the system is temporarily unavailable after obtaining a username and password. It may also forcibly de-authenticate clients from the legitimate access point to force a reconnect to itself.

We shall take a look at airbase-ng, a Kali Linux tool for turning a wireless card into an access point. The attacker starts by setting up a Wireless LAN adapter into monitor mode.

Setting up Wireless LAN adapter into monitor mode

Thereafter, the hacker sees what access points are close by and sets up the adapter to evil twin one of them. A previous connected user reconnects to the fake access point.

Launching an evil twin

When the victim has successfully connected to the evil twin, the attacker uses a packet sniffer such as Wireshark to monitor the WPA encrypted traffic which is captured and rerouted as a man-in-the-middle.

Wireshark capture

How could you prevent such a scenario?

  1. Install wireless intrusion prevention systems (WIPS) to monitor the radio spectrum for unauthorized access points.
  2. Use mutual authentication between the network and the client such as IEEE 802.1X, where the clients must be authenticated by the network to access network resources, and similarly, the client verifies the authenticity of the network infrastructure it is attaching to before beginning data transmission.
  3. Have awareness training for staff so they can be wary of access points with suspicious SSIDs.
  4. Set up a Virtual Private Network (VPN) to secure your online activities through an encrypted tunnel.

Over time, it has been noticed that people are the weakest link in enforcing security and with that regard, Summit Consulting Ltd brings you a Cyber Security Awareness Training course at your premises to bring forth awareness on the various forms of cybercrime and attack schemes that could be executed on your network, alongside the defensive measures.