I just read about WiFi probe requests and that it is possible to track clients by the MAC-Address in the request.
I was wondering if it would be possible to set up a malicious AP which responds "Yes, that's me" to every probe request from clients, resulting in clients automatically connecting to that "known" network. A malicious AP could for example sniff the traffic from smartphones of people walking by whose devices automatically connected. Is that possible in theory?
Yes and No.
First some technicalities, there's no such things as responding "Yes, that's me" since part of the setup of an access point is to set the SSID (name of the network). This SSID is used to create some keys win WPA/2 for the connection to be established and so on. So in the probe response (which responds the probe requests) you announce the client "I'm this SSID"
YES: Somehow it may be possible for open networks
If the client has saved AP with open connection it's pretty easy, just create an access point with the same name (SSID) and voila, the client with just connect as any regular client, no questions asked. And this may be automated.
NO
Most of the cases the the network is protected with WPA/2 or WEP, which you need beforehand the passphrase (password) to generate the keys together with the SSID using PBKDF2*. So unless you own the network (defeats the purpose of a "fake AP") they can't connect to you automatically.
Taken from Wikipedia: /PBKDF2
*For example, WPA2 uses:
DK = PBKDF2(HMAC−SHA1, passphrase, ssid, 4096, 256)
