What are the risks of a rogue Access Point? What lessons can be learned from the Wifi Pineapple?

Question

I'd like to educate colleagues and peers on rogue access points using the tool "Wifi Pineapple".

What are some specific security-related lessons I could demonstrate? If applicable, what are the mitigations to those attacks?

Answer 1

First and foremost, the pineapple demonstrates the concept of a rogue AP, as that is essentially what it is.

Every wireless card that has been configured to automatically connect to a previously known network will get connected to the pineapple. This is a hardware implementation of the karma attack.

Once connected, the pineapple becomes a powerful tool for conducting MITM attacks, coming with a good range of tools built in.

The pineapple can also be extended using modules that provide functionality like sslstrip, tcpdump and nmap.

Mitigation techniques that apply to standard MITM attacks also applies to guarding against the pineapple. One very interesting technique that is pineapple specific is to set a network with a name like pineapple as the SSID as the priority trusted network. If your card connects to that network, it means you have fallen prey to the pineapple. I read about it in a blog post about the pineapple, but i can't find it now.

Answer 2

A rogue AP can be placed outside, run on batteries or a non-standard constant power-source, and/or it can look like a Pineapple.