Can be WiFi credentials obtained by autoconnection feature + a mimicking hotspot?

Question

Mobile devices like smartphones and tablets have the feature to autoconnect to wireless networks of known name. The same is with laptops and other hardware using WPA2. Is it possible to:

a. Obtain the target hotspot name, like "john home network"

b. Setup a new wifi network with the same name by using e.g. Android adhoc hotspot.

c. Wait for the person to e.g. make a call outside the original hotspot range, expecting the smartphone to autoconnect to fake hotspot (after unlocking).

d. Catch the credentials sent to the fake hotspot.

Answer 1

No, this would not work because all passwords sent to password protected routers are encrypted (this is why De-Auth ing a client and then sniffing their handshake as the re-authenticate does not work). The router compares hashes and not plaintext.

You may also be interested to know that this is not dissimilar to an attack called "the evil twin attack," Google that and you'll get plenty of info...

Answer 2

a. Obtain the target hotspot name, like "john home network"

In short, yes. That is seen in plaintext from the client using probe requests (if the connection was saved), and you can also see this in plaintext from the AP using beacon packets (if it isn't specifically told to nullify the ESSID field. If it is, discovery via the client is still very easy). Additionally, if the AP doesn't broadcast the ESSID, and the client doesn't have the connection saved, you will see the ESSID in plaintext for all new connections.

b. Setup a new wifi network with the same name by using e.g. Android adhoc hotspot.

Yes, this is rather simple and can be done multiple ways.

c. Wait for the person to e.g. make a call outside the original hotspot range, expecting the smartphone to autoconnect to fake hotspot (after unlocking).

Yes, this is also pretty automatic in most scenarios. However, you need to be sure that you're using the same method for authentication. This is more important with WPA2-Enterprise (you must use the correct EAP mode on your evil twin AP).

d. Catch the credentials sent to the fake hotspot.

This one is a little bit more complex. Depending on what we're talking about (WPA2-PSK or WPA2-Enterprise using EAP-PEAP, EAP-TLS, EAP-*), it is very difference. Specific to WPA2-PSK, you should look into the handshake that is executed in order to authenticate and become authorized. For WPA2-Enterprise you'll need to set up a RADIUS server to do MITM, which is a little bit more complex.

Answer 3

No, for the reasons explained about encryption of handshakes, but a copied network SSID isn't useless for cracking security.

Whilst the exact attack you describe isn't directly possible, a few quite simple other attacks are possible if you can get a client to connect to your dupe network and not the original:

• You can sniff all activity on the network, which if they aren't sticking to HTTPS only traffic can yield useful info.
• You can use the network you've created to respond to webpage requests etc with responses that include malware, spyware etc. and whatever else you like.
• Probably the most likely to meet your original goal, is to provide a dupe network with a fake authentication page, whenever the user tries to access a webpage (like a radius login page etc.) in which some users may willingly enter their credentials for the actual wifi.