5

I go to a local coffee shop (part of a regional chain/franchise) fairly frequently. The last few weeks an "extra" guest network has been showing up on the list of available connections. For as long as it's been open there was only one...

The two APs are very closely named - "ShopGuestWifi" vs. "ShopWiFi-Guest", so it's not likely to be a neighboring store.

The physical building is quite small (the physical building was originally a gas station) and unlikely to require a second guest AP - and even then I'd expect a reasonably consistent name.

Some other points that may or may not help:

  • Staff don't know which one I should be connecting to since there should only be one (and they're not the most technical).
  • I have seen a few new regulars there at the same time this started up.
  • I upgraded the tablet I've been bringing with me, so I don't have the old access point's name saved anywhere I can get to it.
  • Teathering to my phone has become ... problematic. Sprint's service was never the best here, but lately I've been getting full bars on LTE with a peak speed of 730 mbps. :(

Is there a way for me to figure out which one is the correct? I'd rather not connect to some joker's wifi pineapple.

Improve this question
4
  • 4
    This is an interesting question, one solution that comes to mind is ask the staff to turn off the router, see which one disappears.
    – iainpb
    Commented Dec 21, 2016 at 18:17
  • 1
    Can you define what the "real" guest network is in your opinion, i.e. how it differs from any fake guest networks you might see or what features you expect from it (security in a public Wifi probably not)? Maybe this way one can derive the answer on how you differentiate the networks into real and fake.
    – Steffen Ullrich
    Commented Dec 21, 2016 at 18:30
  • @SteffenUllrich - real as in the one that belongs to the shop. There should only be one "ShopGuestWiFi", but a second similarly named AP is also on the list. I do not know which one of the two is the one run by the shop.
    – AnonJr
    Commented Dec 21, 2016 at 18:33
  • @AnonJr: if you only care about "belongs to the shop" then check exactly this: Let the manager show you the AP which belongs to the shop and then check by signal strength, MAC (sometimes shown on the device) or by switching it off like iain suggested which one is the correct.
    – Steffen Ullrich
    Commented Dec 21, 2016 at 18:54

2 Answers 2

Reset to default
1

If someone's using a WiFi Pineapple, they may be using the "Generate a Random MAC" option on the WiFi adapter. You might be able to figure this out if the OUI in the MAC is nonsense, or if it's consistent with the coffee shop's access point.

Install Wireshark and grab the MAC addresses of both of the APs. Look up the OUI of both of the MACs (Wireshark offers this service here. If one of the OUI's is Netgear, Belkin, Cisco, D-Link, T-Link, or other common home router (and this is a small independent coffee shop), and the other comes up with "No Matches", you've probably identified the honest one. This is a guess, of course, but probably better than blindly trusting to chance.

If it's a large chain, the access point may have been installed by the corporate networking department, which means they may be running on "enterprise" equipment. Instead of Belkin or TLink, look for an OUI belonging to Cisco, Huawei, Netgear, or other major network appliance manufacturer.

Also, if it's a large chain, consider contacting the corporate HQ and reporting what you've found. They may make simplistic improvements such as putting up a window sticker that says "Our official wifi hotspot is named 'CoffeebucksGuestWifi'". They may also have detection software in their access point that can help identify find rogue devices, and with surveillance video evidence they may go so far as to prosecute someone who may be stealing credentials from their customers. It does a company no good to be associated with identity thieves; so there's at least a chance they will take this seriously.

Another option is that the second access point is legitimate. Perhaps the coffee shop added a second access point to improve coverage in the back room of the shop. Perhaps the second access point belongs to a neighboring business. I know the front counter staff won't be able to answer questions, but perhaps the coffee shop owner can?

Improve this answer
7
  • It's actually a big chain/franchise, I should add that to the original question; and the building is too small to ever require more than one AP. The two APs are too closely named to be a different business in the area.
    – AnonJr
    Commented Dec 21, 2016 at 18:41
  • A big chain would still likely be using a recognizable manufacturer of WiFi access points; but probably not the familiar home router makers like Belkin or D-Link. I expect a big chain would have an access point made by someone like Cisco, Huawei, Netgear, or other major manufacturer.
    – John Deters
    Commented Dec 21, 2016 at 18:48
  • Thank you. I'll see what I can figure out on my lunch break tomorrow.
    – AnonJr
    Commented Dec 21, 2016 at 18:49
  • I definitely agree that having the second name so close to the original name looks phishy. Can you come back at a time when the "jokers" aren't likely to be present?
    – John Deters
    Commented Dec 21, 2016 at 18:50
  • 1
    I updated the answer to include contacting the company's HQ. I know this would get an immediate response from the Info Security group in the company I work for, but I can't speak for the coffee shop you're in. I left the small-shop remarks in my answer, as other people in your situation may still find this approach useful.
    – John Deters
    Commented Dec 21, 2016 at 19:05
0

An interesting tool, though not totally foolproof either, and an indication at best, but not a proof, would trying to trace the route packets take when routed through either network.

Packets getting routed through a cellular network operator's infrastructure would be most suspicious; though I could both imagine an attacker would use the legitimate wifi as "backbone" himself, as well as using a completely intransparent tunnel when connecting over a mobile network.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .