For the following scenario in which victim has a WIFI access point at home (AP-HOME) through which he surfs the net and a client (CLI1) connected to "AP-HOME" via WPA2. The victim also has "FREE-AP" in his list over preferred WIFI networks. "FREE-AP" has no encryption.
The evil hacker has a battery driven mobile rogue access point set up to use either ESSID "AP-HOME" or "FREE-AP" depending on conditions below in questions. Also the rogue AP has a high gain antenna attached and no encryption.
I have Following Questions:
- Will CLI1 connect to the hackers rogue FREE-AP instead of victims legitimate access point AP-HOME if the evil hackers rogue access point is hidden close to the CLI1 (but still outside the house)? Or will AP-HOME always be chosen since it is number one in CLI1 preferred list for WIFI connections?
- Will a denial of service-attack against the victims AP-HOME disconnect CLI1 from AP-HOME and then choose number two in the list over preferred connections instead, hence connecting to evil hackers rogue ap FREE-AP?
- If CLI1 is say at work and already connected to a LAN via cable but also has the WIFI turned on. What would happen if evil hacker comes along with the rogue access point with ESSID "AP-HOME". Will CLI1 connect to that as well or do nothing since it is connected (to internet) already? I know windows will use the network connection with lowest metric value but will CLI1 still be a part of the network that the rogue access points is offering (meaning CLI1 will be possible to attack via WIFI interface)?
- Any ideas on how to get CLI1 to download an exe? The best idea so far is to fake a page looking like http://www.update.microsoft.com/ and try to trick the user into downloading and run a VERY IMPORTANT UPDATE