Evil Twin Attacks
1 Global Definition
An Evil Twin Attack is a wireless network exploit where an attacker sets up a fake Access Point that mimics a legitimate Wi-Fi network. Unsuspecting users connect to this rogue hotspot, allowing the attacker to intercept sensitive data such as credentials, session cookies, and private communications.
1.1 Key Concepts
- SSID: The Wi-Fi name that can be cloned by the attacker.
- Rogue AP: The malicious access point broadcasting the fake SSID.
- Man-in-the-Middle (MitM): The attacker sits between the victim and the real internet, intercepting traffic.
- Captive Portal: A fake login page used to trick users into entering credentials.
- Deauthentication Attack: Forcing users off the real AP so they reconnect to the Evil Twin AP.
1.2 How the Attack Works
- Attacker scans for nearby Wi-Fi networks to identify target SSIDs.
- A fake AP is created with the same SSID as the legitimate network.
- A deauth attack is launched against clients of the real AP.
- Victims reconnect to the attacker’s AP, thinking it is legitimate.
- The attacker can now sniff traffic, inject malware, or capture credentials via a phishing login page.
1.3 Tools for Evil Twin Attacks
- Airbase-ng: Creates rogue APs for Evil Twin setups.
- Wifiphisher: Automates Evil Twin attacks and phishing portals.
- Hostapd: Linux utility to create and configure rogue access points.
- Bettercap: Framework for network MITM attacks and traffic sniffing.
- Wireshark: Used to analyze intercepted traffic.
1.4 Defense Mechanisms
- Use VPN when connecting to public Wi-Fi.
- Always verify the SSID and security settings before connecting.
- Disable auto-connect to open networks on devices.
- Implement 802.1X authentication in enterprise environments.
- Use wireless intrusion detection systems (WIDS) to detect rogue APs.
1.5 Why It Matters
Evil Twin Attacks exploit user trust in familiar Wi-Fi networks. By imitating legitimate hotspots, attackers can harvest personal data, financial information, and company secrets. Awareness and proper defenses are critical since these attacks often occur in public places like cafes, airports, and hotels.