3

I've been looking at SSID spoofing devices lately, including the Wi-Fi Pineapple and similar hardware. While these types of devices seem very useful to someone who's up to no good or working as a white-hat hacker, I'm interested in how I could detect such devices, and what methods exist to stop MITM attacks caused by them, as the user of a Wi-Fi network with no administrative privileges.

I'm making the assumption that using a wired network isn't an option, as well as that I have at my disposition widely-available Wi-Fi analysis software (including signal strength monitors and SSID scanners).

3

As a client your basic countermeasure is to use a VPN. Since you don't have a good way to baseline anything about the multitude of Wifi access points you might have to use, your ability to spot a real one vs a Wifi Pineapple is pretty minimal. Your only hope, really, is to immediately route all traffic through a properly authenticated VPN which will resist attack (or at the least, fail and indicate your traffic is being heavily manipulated).

If you are the Wifi operator, you have a number of additional options to mitigate, most of which include just basic channel use awareness since a Wifi Pineapple or similar device is only going to work by displacing your existing infrastructure (or operating so close to the border that it can lure some users away) and in either case, you simply need to be running your own counterintel (watching open Wifi activity from a listen-only station with a good antenna) in order to spot an attack in progress.

0

You can disable auto connection whenever your device sees a familiar SSID. For certain banking websites, the bank protects external users from Frauds. At minimum, have Internet security software protect your end device. Products like Kaspersky or WebRoot can protect your browser windows but I am not sure what exactly they protect...

Best is to practice safe browsing..

  • I believe the OP is asking how to detect a spoofed access point. I don't think that you address that in your answer. – Neil Smithline Jul 18 '16 at 22:30
  • @NeilSmithline that's correct. – Jules Jul 18 '16 at 22:31
  • Apologies. One of the ways to avoid MITM from wifi spoofing is firstly not to accidentally connect to a rogue APs by disabling a feature to auto connect to previously authenticated SSIDs. Spoofers usually act as a legitimate SSID or offering free Internet access luring users to connect to them. VPN is another way to encrypt your data in transit so MITM attacks will see gibberish traffic. – Davis Jul 18 '16 at 23:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.