2

I'm learning about the Evil Twin and ARP Spoofing attacks performed by an attacker on the same WPA2-PSK protected wireless network and wanted to know which one would be more impactful since both of them essentially end up sniffing traffic in the end?

2
  • Welcome to the community. What's your threat model and impact in what regard? Impactful in the CIA triad or something more broad? Feb 10, 2023 at 16:43
  • I think being impactful in the CIA triad would make more sense.
    – scottstots
    Feb 11, 2023 at 18:51

1 Answer 1

1

The impact of a successful ARP spoofing and a successful Evil Twin attack can be the same - controlling the network traffic of a client, i.e. both sniffing and modifying. An attacker can also send direct traffic to the client, thus bypassing network-level firewalls. Insofar both attacks are similar dangerous - if successful.

What is different though are the preconditions for these attacks and possible protections against the attack: ARP spoofing requires that the attackers already have access to the network. Static ARP entries, port security at switches and other methods can be used to protect against this.

With Evil Twin attackers instead try to make clients join their own network. Strong passphrases for the WLAN unknown and unguessable to attackers can prevent them from creating a network with the same name and passphrase.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .