I have recently read about the comparison between KARMA attack and Evil Twin attack. The article states that contrary to an Evil Twin attack, in which the attacker is required to be in range of the victim's network, the KARMA attack can be performed even if the attacker is far away from the targeted network.

The article states:

For example, if I am using a client system that is vulnerable to KARMA, my client may associate to a wireless access point that identifies itself on-the-fly as "coffeeshop," even if my real "coffeeshop" network is hundreds of miles away.

How is this possible? Did the article omit to specify that you can do that only if the target has connected to the rogue AP before?


Target has connected to some AP before

The KARMA attack requires that you have connected to some AP before, not necessarily the rogue AP.

Many wifi devices broadcast the SSIDs of known access points because, among other reasons, it allows faster [re]connecting and thus better user experience. So if you have connected to VerySecureWorkWifi earlier and have set your device to automatically reconnect to it, then your device (if it's vulnerable to KARMA) will be repeatedly broadcasting that to the world.

So any attacker can listen to that broadcast, and respond with "Yes, what a lucky coincidence! Now my SSID is VerySecureWorkWifi, please connect!".

  • The part that "your device will be repeatedly broadcasting that to the world " was not clear to me. Hence my confusion. Thank you! – re.sole Dec 11 '20 at 9:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.