When someone sets up an evil twin AP (obviously with the same SSID and Mac address of the victim AP) and then sends de-authentication packets to force connected users to disconnect from the original AP, do users auto-connect to the new AP? If the evil twin has a stronger wifi signal, does this mean users prefer to connect to the evil twin?
First to correct you , for EVIL TWIN you don't need same bssid (MAC) as Target AP
Main Targets for EVIL TWIN are active probing of client device for SSIDs Already in its PNL (preferred network list) , so of we somehow replace bssid in PNL with out fake AP's bssid , Client will prefer associating with us .
Do users auto-connect to the new AP?
Out of various AP announcing SSID in our PNL which AP will be in our PNL It Depends on a lot of things few are as below :-
SNR :- AP with highest signal to noise ratio is always prefered
Lowest Delay in probe response :- Among the APs the AP with Lowest
DOT11 authentication :- If Open dot11 its fine but if shared key dot11 auth is applied , same wep key must be on our fake ap , or we need to allow failed handshake also
DOT1x authentication :- if Dot1x is applied for dynamic keys Management (802.11i) then Protected EAP is not vulnerable to EVEN TWIN if proper root CA certificates are deployed at client side