Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a large scale wireless network secured using WPA/WPA2 Enterprise authentication. Recently, I was made aware of the possibility that someone may use a dd-wrt router and a computer to spoof the wireless network and grab usernames and passwords as devices attempt to connect to it.

To test this theory, I succeeded in spoofing the SSID and authentication method. I set up a local RADIUS sever and could see my device (which remembered my credentials) trying to connect to it. However, I did not see my password anywhere in the RADIUS server logs (but then again, logs might not contain such information, even in debugging mode), or using Wireshark placed between the Wireless AP and the RADIUS server.

Is there any way to capture my password from a connection attempt, or does that require information only the actual RADIUS server will have? (My device has authenticated with the actual network before)

And are there any steps I (not the network admin) can take on my clients that will ensure they do not attempt to connect to similar rogue APs?

share|improve this question
For the second part of your question (how to prevent connecting to rogue APs), it has been answered well at… – AviD Jun 15 '11 at 4:52
This is an interesting question, especially its implication to eduroam. – cnst Feb 16 at 3:07
up vote 4 down vote accepted

This is one small part of a much larger answer to this question.....

One method of protecting against rogue access point is the use of rogue mitigation. There are multiple systems available which will allow a company to conduct scanning and deauthing of rogue wireless nodes. Some of these systems will actually allow you to upload a trusted device list (a company asset list) and block according to that list. Some are also able to correlate wired data with wireless transmissions to determine if the rogue AP is actually connected to your network or not.

For instance, if you have a worker's laptop and it connects to a spoofed corporate SSID, these sensors would be able to determine that a trusted asset is connecting to an untrusted device using a trusted network name (dona via mac addresses).

The fun part, if you see the device on your network, is using the same system to triangulate the location of the rogue device to track it down and see where it is plugged in to your network.

These methods also allow you to stay neutral towards any device that is not one of your company assets (which helps greatly from the legal side of things). You would only be targeting systems which are owned by your company or are connected to creating unauthorized connections to your corporate network.

share|improve this answer
This is more appropriate for the network admin, but helpful nonetheless – Soumya Jul 6 '11 at 18:57
I don't believe rogue mitigation will do anything to Jaseger to prevent the authentication from happening. By the time the device has authenticated, it has done it's job. – Ori Jul 6 '11 at 20:42
This is an interesting answer, but it doesn't appear to cover things like eduroam at all, where you don't physically have any direct connection with the on-premises network – cnst Feb 16 at 3:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.