For the past week or so I've been having problems with wifi in my house, and it appears that my neighbor set up a Pineapple or something similar that is running a known beacon attack and/or Karma/Dogma. It is also interfering with devices connecting to my WPA2 AP.
- A rotating list of 20 or 30 SSIDs show up with common names (attwifi, Google Starbucks, wifi...) and with very specific names (the SSID of the city library wifi, random default router SSIDs like SpectrumXXXX, Fios-XXXX).
- Connecting to one of the SSIDs prompts for a login, which presents a fake FB, Google, or other phishing page to Android, iOS, and MacOS devices, but not Windows 10 devices
- There appears to wifi interference of some kind. My WPA2 AP has a stronger signal within my house than the rogue AP, but devices take 10-30 minutes to automatically connect to my network. The devices say connected, no internet and after repeated reconnections will eventually start working, or leaving the device running will allow it to connect. This is especially annoying with the smart TV, waiting 20 minutes for it to begin to function.
- The evil twin appears to be pretty simple, it presents the same MAC for all SSIDs, starting with 00:13:37, always channel 11, 2.4 Ghz only
- The thing is powerful. I've used a stumbler app on my phone and it has signal for over a 250m radius and doesn't appear to be directional. Getting too close (within ~100 ft of it) causes my phone's wifi to stop responding and I get a message about wifi being jammed. 100 ft is in the middle of the street, so it's strong enough to cause errors on my phone when I'm driving near my house.
The MAC address indicates it could be a PineAP, or maybe a device running wifiPhisher. The AP names that are echoed back seem like they could be collected by wifi harvester, or maybe from a stumbler or database.
I am primarily frustrated by the interference with my APs. Nothing appears to be wrong that I can see in my APs (Unifi) and router (Frontier, running DHCP), no extra clients or strange traffic, but they have limited data gathering capabilities. I just ordered an Alfa wifi adapter to see if I can detect aireplay or some other unusual activity indicating a DoS or deauth or some other attack on my AP.
What do I need to look for to detect an attack? I'm guessing that airodump should give me indication of an attack if it's happening, but I don't really know what to look for.
What can I do to prevent autoconnecting to SSIDs, or blocking the rogue AP?
Any other ideas for dealing with the device?
Is there an easy tool available to spam the phishing forms with data? Seems like submitting junk logins in a loop to the rogue AP will eventually fill up the storage and may interfere with its operation, with the added benefit of burying any real credentials that were input by unwary people.
Most of the comments suggest one of two routes, go talk to the neighbor or call the police. I understand those options, but I would like to understand intent and risk a little more before I do that.
As an analogy, if a neighbor has left their 1000 watt flood light on and it's shining into my bedroom window, it's really annoying and the neighbor is being inconsiderate. The correct response would be to go talk to the neighbor. If a neighbor is hiding in the bushes, filming video and shining lights into my house then the neighbor is a criminal and contacting law enforcement is appropriate.
I'm trying to tell if the neighbor bought a new toy and just left it plugged in, or has malicious intent. If it's the first then politely asking will fix the problem. If it's the second then politely asking will make them aware that they've been detected and could lead to more subtle methods that are harder to detect. Submitting junk to their device would be the equivalent of turning my floodlights on to shine back at their house, perhaps passive-aggressive, but also a nudge toward social conformity.
What would I need to look for to detect an active attack vs a stock pentest device just running? Would it be obvious in airodump? Or some other tool? Is there something else I should be looking for?
To answer some of the questions, I'm in a suburban city in Texas and I don't expect local law enforcement to understand unless I lead them by the nose (and only then if I'm lucky). FCC, FBI, or similar may have a little interest, but attacking some home wifi or transmitting at 1 watt over allowed is very minor.
I haven't seen the device actively impersonate my SSID, and it has definitely not presented WPA, so the interference with my connections would either be noise or something like an active deauth attack (how would I detect this?)
Also, the device does not provide a functional internet connection. After the phishing page it goes to a 401-like message and that's it, so it can't be sniffing http traffic that's not happening.