4

We are working on an activity to train staff about security. Is there any way to spoof the company's guest router and ask staff to provide login credentials (as public wifi does) and when they do that, we will have a list of their passwords. so, they can understand that public wifi is not secure enough.

Is there something around it?

5
  • Literally buy a new wifi router and connect it to the office guest network with the same name?
    – Adam Katz
    Jul 15 at 14:52
  • 2
    This is in many jurisdictions Highly illegal. But Hak5 does have some devices that could help you… before you do this contact A IT-Lawyer!!!
    – LvB
    Jul 15 at 14:55
  • "we will have a list of their passwords" -- what do you plan to do with that PII? Do you have a legitimate need for that data? Have you checked with your legal or your data protection/information governance team to determine if you should/are allowed to collect and store that data?
    – schroeder
    Jul 15 at 20:57
  • Having a password, just to show them that open WIFI connections can have their credientials.
    – ANA
    Jul 16 at 9:32
  • You can do that in a demo without exposing your staff so nakedly or your company to liability. You do not want their passwords and should not have or collect them.
    – schroeder
    Jul 18 at 21:35
6

This is a colossally bad idea.

But the technical answer is to perform an Evil Twin attack and simply stand up a new access point with the same name and run Evil Twin software to capture passwords.

But here is why you should not do this:

You are not teaching them anything except to not trust you.

You are hosting a legitimate network, then setting up a fake network to capture their credentials. Why capture credentials? A simple landing page on the Evil Twin that educates staff on why they should not have connected to the wrong wifi access point and how to tell the difference would be better. And capturing credentials carries a number of legal risks.

Second, the security of the company access points is up to the company. If you want to secure your people on your networks, don't dig a pit then push them in then blame them for falling. Instead, secure your networks.

If you want to teach your people about the dangers of open wifi points, run a demo, make a video, educate don't entrap.

0

Yeah - this is a good idea.

https://shop.hak5.org/products/wifi-pineapple

But don't shame your staff - use it for training, but not to trick them normally.

It’s a good defcon-style exercise. https://www.zdnet.com/article/defcon-2007-wall-of-sheep-shame/

I don’t see the value in impersonating your guest wifi but setting up a test wifi to show people what can happen is interesting.

I also train people to never trust wifi including that provided by our company. But to trust https.

6
  • 2
    The difference is that at DEFCON, the attendees, i.e. the Sheep, are trained security professionals who expect good-natured compromise antics. The context here is staff that needs to be trained. Naming and shaming is never a good idea for staff. And certainly not without their consent. Plus the legal ramifications.
    – schroeder
    Jul 15 at 20:41
  • I agree but it seems off topic. I don’t think the shaming is the point of the question.
    – Jonathan
    Jul 15 at 20:47
  • 1
    Your answer includes a link to a name-and-shame example ... "It’s a good defcon-style exercise." -- no, it is not.
    – schroeder
    Jul 15 at 20:48
  • Right. Whether we agree or disagree with the wall, It’s educational.
    – Jonathan
    Jul 15 at 22:53
  • 1
    No, it most certainly is not "educational". Do not entrap. Do not name and shame. Do not confuse staff with a fake AP alongside the legitimate AP. These things do not educate. These things have the opposite effect of education.
    – schroeder
    Jul 16 at 9:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.