Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For the following scenario in which victim has a WIFI access point at home (AP-HOME) through which he surfs the net and a client (CLI1) connected to "AP-HOME" via WPA2. The victim also has "FREE-AP" in his list over preferred WIFI networks. "FREE-AP" has no encryption.

The evil hacker has a battery driven mobile rogue access point set up to use either ESSID "AP-HOME" or "FREE-AP" depending on conditions below in questions. Also the rogue AP has a high gain antenna attached and no encryption.

I have Following Questions:

  1. Will CLI1 connect to the hackers rogue FREE-AP instead of victims legitimate access point AP-HOME if the evil hackers rogue access point is hidden close to the CLI1 (but still outside the house)? Or will AP-HOME always be chosen since it is number one in CLI1 preferred list for WIFI connections?
  2. Will a denial of service-attack against the victims AP-HOME disconnect CLI1 from AP-HOME and then choose number two in the list over preferred connections instead, hence connecting to evil hackers rogue ap FREE-AP?
  3. If CLI1 is say at work and already connected to a LAN via cable but also has the WIFI turned on. What would happen if evil hacker comes along with the rogue access point with ESSID "AP-HOME". Will CLI1 connect to that as well or do nothing since it is connected (to internet) already? I know windows will use the network connection with lowest metric value but will CLI1 still be a part of the network that the rogue access points is offering (meaning CLI1 will be possible to attack via WIFI interface)?
  4. Any ideas on how to get CLI1 to download an exe? The best idea so far is to fake a page looking like http://www.update.microsoft.com/ and try to trick the user into downloading and run a VERY IMPORTANT UPDATE
share|improve this question
    
And Point Number 4 is criminal intent... Needs to be beaten with a Baton Rouge... As opposed to a Baton Rogue. –  Fiasco Labs Aug 12 '13 at 20:53

1 Answer 1

up vote 0 down vote accepted
  1. Yes, We can create FAKE AP but with same ESSID or BSSID as legitimate one. Thus if our signal strength is higher victim will connect to FAKE AP. For ex We can duplicate the AP-HOME and with same MAC address that AP-HOME has.

  2. If AP-HOME is off, and we create fake AP with ESSID AP-HOME, client will automatically connect to us.

  3. we can set up wifi bridge between authorized network and Rougue-AP, and in this case if Victim connects to Rougue-AP he will have access to internet via Wifi-Bridge.

  4. Well, the simplest way but the most hardest trick is to show victim a webpage which will automatically download a virus on client's PC. Ever visited a malicious site that automatically delivered virus on your machine. This way client will no necessarily download virus but will get infected.

Some things in question were unclear, I hope this will help

share|improve this answer
    
Long live CCCP and the Rouge flag! –  Fiasco Labs Aug 13 '13 at 18:39
    
Thank you. Very usefull information! One follow up question on #4: you then assume that the browser that the client uses has some kind of vulnerability that can be exploited with e.g. metasploit? –  user1298720 Aug 14 '13 at 18:57
    
This approach is known as Drive by download. Attacker may take advantage of browser vulnerabilities, java applet, flash etc. This can also be done with server side programming language such as PHP using header injection. –  Mark Evans Aug 15 '13 at 12:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.