1

I was recently the victim of an evil twin attack on my WiFi network, probably by the new upstairs neighbors. It prompted me, with a captive portal, saying there had been an update and I needed to enter my WiFi password to finalize it.

Now I read a lot about about this kind of attack and actually tested it out on a hotspot I made from my phone using fluxion to understand it better. What I'm wondering, however, is why does this attack use a captive portal? Couldn't it simply create an evil twin with WPA2 security, so that I would log onto it either automatically or manually when I notice my phone isn't connected to the WiFi anymore?

3

They cannot create a twin WPA network without knowing the password of the legitimate one. So they usually disrupt the legitimate network, create an open network with the same SSID, and wait until some user connects to it by mistake.

After connecting, the user is redirected to a fake "Maintenance Mode" portal, or something like that, asking for the network password to proceed. As the vast majority of the users aren't tech-savvy, they will happily enter the password.

It takes only one user to disclose the password, and it's done. No need to capture lots of handshakes, rent an expensive rig on Amazon and spend a lot of money cracking a hash. Depending on the demographics of the users, a password can be obtained in minutes.

  • What about creating a twin network with a different security like WEP? – Halhex Jul 3 at 15:27
  • You could, but this network had to have the same password of the main network, and that defeats the purpose of capturing the password if you already know it. – ThoriumBR Jul 3 at 15:58
  • Interesting, I hadn't realize you needed to know the password to set up a secured wifi. – Halhex Jul 3 at 18:20
0

After a bit of consideration, I am guessing that if they used a legitimate WPA2 outward facing, then the credentials you sent would not be in clear text. Embarrassingly enough, I'm not 100% sure on if they could just get the encryption key and decipher your password then. Another thought is that if it was real WPA2 security, you wouldn't actually gain access to the network (or the wireless connection mgr on the os would give a warning), which would be cause for suspicion, prompting you to change pw/ inspect your network

In theory, that doesn't matter if they can get a hold of your credentials. I'd imagine that there is some differences in how they may design the attack based on if they,re using a HostAP , vs a real wireless access point. Each of these options is going to have a different dataflow, so they're going to plan for whatever gets your credentials most easily.

I think the real advantage of a captive portal, is that it's a low effort way to confirm that the victim is gullible, and get credentials in clear text, directly to a web server, rather than into an AP, where they may have more trouble either getting at the creds, or unencrypting them. From there since you're already connected to their AP, if you're still using the connection they can monitor your traffic and extract more in clear text, or frankly they can have a baseline for trying to unencrypt any credentials you send over a secure connection. This is far flung, but they can run a brute force decryption on anything you send, like a bank account login, and enrich that with a known password of yours (wifi password), basically making a more intelligent guess as to what the encrypted pw is.

  • I'm not a wireless security expert, but I'd love to hear what you think. :) And yes, of course they can, but that's making assumptions about the exact methodology they're using, their skill level, etc. Not every attack is highly sophisticated or well thought out. It's not entirely uncommon for this sort of thing to be done with a software utility, or just using a method thats being followed like a recipe. – SWM Jul 2 at 20:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.