How would you detect an Evil Twin attack, especially in a new environment?

Question

Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of the wireless network because it is written behind the counter/on a slip of paper/well known.

You see that there are two options:

"Free Public Wifi" &
"Free Public Wifi"

Which one is the actual wireless network, and which one is the Evil Twin attack? How can you tell? What tools or techniques would you use to decide?

(I'm less interested in answers that involve not connecting to either, or avoiding public wireless, and more interested in the techniques to discriminate legitimate vs non-legitimate APs from a users and not administrators perspective. I'm using "Evil Twin" in this specific sense rather than a general "malicious actor" sense.)

Answer 1

Traditionally there hasnt been an easy user-oriented method to detect evil twin attacks. Most attempts to detect an evil twin attack (ETA) are geared towards the administrator of a network where they basically have the authorised network admins scanning and comparing wireless traffic. This isnt so much of what you are interested in.

There is a paper here (and slides) that goes over an experimental approach to determine from the user's perspective a real-time ETA. Basically, they use a cunning approach to statistically determine which access point is authorised and which is the evil twin.

A simple approach (that will not always work) that I propose is to merely sniff yourself and see what the IP addresses are. The idea being that an unathorised AP will have a nonstandard (IE what you would expect) IP and thus throw up some red flags... Here is a link that describes how to setup your own ETA so you can play around with my method (or try your own). WARNING: If you are creating an ETA, do so in a lab environment as this is illegal in public.

Also note that an ETA can be greatly mitigated by simply securing the network via an authentication system that uses Extensible Authentication Protocols such as WPA2-enterprise -which works by validating both the client and access point.

---

To address some other points...

If you have a way to communicate with the authorised network administrators (or at least know which access point is the proper one), then you have already completed a psuedo-meta-athorisation method outside of the digital realm (IE I can physically see the proper router and know it's mac address, ip settings, etc and can thus compare them with what my adapter is telling me I'm connected to). Most often, we do not have this info and moreover shouldnt trust it even if we did. Thus, perhaps the 'best' method for using an untrusted network (ET or not) is to always assume it is compromised and implement a VPN or simply abstain altogether!

Answer 2

They're both evil. You shouldn't be connecting to any "Free Public Wifi" without assuming that all your unencrypted traffic will be monitored and modified. The best solution is to not connect to public networks at all, but if that's not an option for you then you can protect yourself a little more by specifying your own DNS (rather than letting the router pick for you), using https everywhere you can, not accessing your sensitive accounts on public networks, considering a VPN, and keeping your software and firmware up to date.

In direct answer to your question, some routers have their MAC address printed on a label; you could ask the router owner to check for you, then connect to it, ping it, and view your arp table (arp -a) to see if it matches. Alternatively, you could tell the router owner that there's an imposter nearby and have them change the network name.

Answer 3

Tell the barrista/clerk/etc the wifi has gone down, can they reboot or power cycle the router?

Most people will happily do so, bringing the AP down for a moment, and exposing the evil twin router in the process as any active network that survives a power cycle.

If there is more than 1 evil twin router, this still works.

If there are multiple good routers, this will identify at least one. The same tactic can be used to identify the others ( Hey it's not working still, is that the only wifi box? All this tech is so confusing, maybe you need to do it to all of them? ).

Alternatively, once you identify a good AP, connect a device to it, and then using a second device, connect to the other AP's and attempt to locate the first device over the network. Unless the good AP has been compromised, any AP that finds the original device is a good AP. If it has been compromised however, then all AP's are bad

Another alternative being that if you can see the make of the router, try to log in to its admin panel. If the login prompt doesn't match the make/brand then you have found the evil twin.

The best solutions here are mostly going to involve simply talking to the provider of the legitimate AP rather than running an extensive comparison with questionable results.

In the meantime, if the AP in question is open, it is insecure, evil twin attacks are unnecessary. A public network with a shared password is also insecure. If you're concerned about the security of a public wifi network for any reason, do not use it.

Answer 4

There is one thing an evil twin can't copy: location. Set up three computers, then triangulate it. Or have some sort of time detector. If one of them is responding fast enough that you know, according to the speed of light, they must be within the store, then you know that it will be in the store, which is helpful if delays make triangulation harder.

Note: If you somehow find out that the routers aren't moving through some other source, you can use one moving distance detector. This will give you a lot of data points to work with, which may help if your detector isn't accurate.

Note: If you somehow find out that the routers have the same signal power and detection capabilities, and that the good one is closer, one practical method is to simply filter out weaker packets.

Answer 5

For detecting an Evil Twin attack with a standard setup, the only information you really have and the SSID, The MAC address of the wireless access point, and the DHCP IP address, gateway, and DNS server that it hands out. Apart from that, you might find the evil twin using a different frequency than the original, like the true AP being on 2.4GHz and the evil AP being on 5GHz. Many Access Points are configured via web interface, whcih means if you have a Linksys AP, you might be able to access a page at http://192.168.1.1/Managment.asp , but not on the evil AP.

An Evil Twin will probably not bother to clone that detailed level of configuration because it is far easier to just clone the SSID and MAC (if they even bother with that).

Therefore, if you know the expected DHCP config setup or expected configuration URL, you could tell if the AP you are connecting to is false.

Answer 6

One really simple way, if you're the network administrator, is to have a host that is attached to your physical network. So a quick ping to it, will reveal if you've been sidelined to another network.

In the use case of you being in a public area, then using a vpn might be a good idea.

Answer 7

The good AP should have a trusted fingerprint of its self-signed* certificate. I think that's automated as "certificate pinning" - What is certificate pinning?

*: Self-signed because not all CAs are trustworthy.

UPDATE: I don't know your AP, but putting a simple webserver on there should be trivial (flash open source firmware). Anyway, here's proof that an AP can have a certificate.