8

Since a few weeks, someone is regularly running a wifi network copying the SSID and BSSID of my private router, resulting in some anoyance, due to being kicked out of my own network from time to time. This is especially annoying, because for some unknown reasons, my devices won't connect to my wifi for quite some time after changing its SSID. Also connecting to the fake access pints redirects to a website resembling the login page of some Wifi-hot spots, asking me to log in via my password. Altough i certainly won't use my password there, i don't wanna have to tell every guest, not to use the password there.

What are my options? I would prefer not to have to spend too much time or money on that issue, so buying a router able to change it's BSSID is not my prefered option (also i'm not quite sure wheter that would help)

Triangulating the source of the spoof with my smartphone did not work well, due to urban environment.

Improve this question
4
  • Am I right that neither your real access point nor the spoofed AP use WPA/WPA2, i.e. require a password for even associating with the AP?
    – Steffen Ullrich
    Jul 1, 2017 at 17:23
  • I am using wpa2, the fake access point does not.
    – axioman
    Jul 1, 2017 at 17:24
  • Your SSID should have a passphase assigned, in which case your devices should be unable to automatically connect to the rouge network (unless they're unwisely configured to connect to Open networks by default). This will at least help avoid the risks of connecting to the attacker's network automatically.
    – I say Reinstate Monica
    Jul 2, 2017 at 3:35
  • I have client authentication (fingerprinting) enabled on my firewall. It won't route traffic unless it knows the device it's routing for. I would love to enter my password and see what devices try to connect. If you tracked down the attacker and could match up MAC addresses to physical devices that would be solid proof.
    – Nathan Goings
    Aug 27, 2018 at 16:41

5 Answers 5

Reset to default
5

You don't need much to find his person. Just a cantenna and a rfmon sniffer like kismet or airodump-ng (from aircrack-ng). The signal levels displayed are in increasing negative numbers toward 0, where e.g. -67 is 'in range, and useable', -65 even better, -20 quite close, etc. The radiowaves bounce around, but these numbers cannot lie. Another proximity indicator is the amount of ESSID broadcasts you pick up. 10 per second is 'nearby'. A cantenna will filter signals from other directions out. Point it around, up and down. Eventually you will be standing outside the person's door. Screenrecord your entire scan.

Then, audibly call the police. Why audibly? Because you are standing outside of the attackers door, of course. The police are likely to respond, but cannot really do anything. Perhaps the spoofed AP went down after you called, or they knocked. That's because you stress the script kiddie. The police can talk, but not enter a residence. Let them talk to this person, and record it on your phone. It is only a deterrent, but unless you have seriously annoyed the attacker, he will most likely stop. Be painfully polite. The attack itself is trivial to do on Linux, so don't be too alarmed.

Improve this answer
4

You can change your SSID/rename your network but, that takes all of 1-2 minutes to re-replicate by an attacker/hacker.

You can also find the attacker by doing what user2497 stated, hunt them down and make it know you know what they are doing!

You can also try Mdk3 to knock down their AP or at-least clog it up and create an error on their network interface. They're just using a wireless adapter (probably max of 150Mb/s) and it's also probably a VM at that. I know this is not the most ethical thing to do but, this is a thing that someone can do successfully is seconds.

Improve this answer
1

Personally if you don't want to spend any money I would rename your network and hope they do not. There is little in technical controls you can do successfully at little cost. If you have passwords on your WPA2 APs then this should mitigate against false connection attempts to your rogue hotspot that does not have a password for many devices.

Improve this answer
1

The reason you are "being kicked out" is that the attacker is occasionally sending spoofed "deauth" packets, which cause your computer to disconnect from your access point. This is common in wifi attacks where the attacker wants you to stop using the legitimate access point and log in to his fake access point.

What would actually fix your problem would be to use an access point that supports 802.11w. This is a newer standard that authenticates management packets, including deauth packets. One of its design goals was to thwart this exact attack, by ensuring he can't forge the deauth packets that cause your computer to disconnect.

Check to see if your current access point has a configuration setting for "802.11w", "MFP", or "Management Frame Protection", which are all ways of enabling this protection.

The trick might be ensuring your clients are compatible with 802.11w. Windows 8 and above support it, as do most recent Linux kernels (although specific wireless adapter drivers may or may not support it. And I don't know about OSX or iOS support, but I suspect they do.) You should ensure that it will work with your client before investing in upgrading your access point.

If you want to do this without buying new hardware, you can see if your current access point is supported by OpenWRT, and if the hardware in your current access point uses the ath9k drivers.

Improve this answer
0

You could try changing and hiding your SSID. This will make it harder for the attacker to spoof your Wifi: he will have to find your SSID first (which is, however, perfectly possible to sniff when you are using it yourself).

Depending on the persistence of your attacker, this might help.

Improve this answer
1
  • I think that any attacker with the sophistication and equipment (and intent) to conduct an evil twin attack will consider hiding the SSID to be nothing more than a very tiny speed bump.
    – J Kimball
    Sep 12, 2017 at 17:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .