When someone sets up an evil twin AP (obviously with the same SSID and Mac address of the victim AP) and then sends de-authentication packets to force connected users to disconnect from the original AP, do users auto-connect to the new AP? If the evil twin has a stronger wifi signal, does this mean users prefer to connect to the evil twin?
-
1I'm finding lots of material on this question over the past 10 years. Every single hit I'm finding says the same thing: signal strength is the key. Is there something specific about signal strength that is the source of your question?– schroeder ♦Oct 29, 2016 at 7:59
-
I heard from my mentor that if a user can auto-connect to two APs and both are in range and listed as preferred networks then the priority would be to connect to the AP with higher signal strength. I was wondering if this is also true about evil twins.– PMDOct 29, 2016 at 10:41
-
As I mention, every article on the top 10 hits bears this out.– schroeder ♦Oct 29, 2016 at 11:24
Add a comment
|
1 Answer
First to correct you , for EVIL TWIN you don't need same bssid (MAC) as Target AP
Main Targets for EVIL TWIN are active probing of client device for SSIDs Already in its PNL (preferred network list) , so of we somehow replace bssid in PNL with out fake AP's bssid , Client will prefer associating with us .
Do users auto-connect to the new AP?
Out of various AP announcing SSID in our PNL which AP will be in our PNL It Depends on a lot of things few are as below :-
SNR :- AP with highest signal to noise ratio is always prefered
Lowest Delay in probe response :- Among the APs the AP with Lowest
DOT11 authentication :- If Open dot11 its fine but if shared key dot11 auth is applied , same wep key must be on our fake ap , or we need to allow failed handshake also
DOT1x authentication :- if Dot1x is applied for dynamic keys Management (802.11i) then Protected EAP is not vulnerable to EVEN TWIN if proper root CA certificates are deployed at client side
-
@8zero2.ops.Thank you.I am wondering if having the same MAC address as the original AP doesn't really matter. I mean how do devices verify a wifi AP apart from its SSID? I thought MAC address is also a parameter in the verification process.or isn't it?– PMDOct 29, 2016 at 11:09
-
no client actually has no way to verify it . but ya if you have made your own app to connect to wifi that you can obviously do that . But as far as standard inbuilt wifi handlers there is no such way for sure , More over if rouge detection and mitigation you can suppress such rouges and make your clients connected to rouges disconnect Oct 29, 2016 at 11:29