Let's say you are traveling, and you pause in the airport lounge, or your hotel lobby, or a nearby coffee shop. You haul out your laptop and scan the available wireless networks. You know the name of the wireless network because it is written behind the counter/on a slip of paper/well known.

You see that there are two options:

"Free Public Wifi" &
"Free Public Wifi"

Which one is the actual wireless network, and which one is the Evil Twin attack? How can you tell? What tools or techniques would you use to decide?

(I'm less interested in answers that involve not connecting to either, or avoiding public wireless, and more interested in the techniques to discriminate legitimate vs non-legitimate APs from a users and not administrators perspective. I'm using "Evil Twin" in this specific sense rather than a general "malicious actor" sense.)

  • 12
    What, to you, distinguishes the "actual" network from the "evil" one? What if they are both set up with good intentions? How about both set up with bad intentions? What if one is from the coffee shop next door? Does that make it evil since I'm sitting over here? When I move there does this one become the evil one? – CoverosGene Apr 2 '15 at 18:48
  • 5
    An "Evil Twin" would be an AP set up to deliberately mimic an existing legitimate AP. Setting aside any elements of intention, the "Evil Twin" will be one that is not controlled by the organization that offers the service that user intends to use. – J Kimball Apr 2 '15 at 19:56
  • 8
    So if I'm at the book store, the evil AP is the one next door at the coffee shop. When I'm at the coffee shop, the book store AP has become evil. If intent to use is the distinguishing feature, then they cannot be distinguished with technology. – CoverosGene Apr 2 '15 at 20:07
  • 2
    Instead of "evil" or "malicious", think "Legitimate". If the Book Store clones the settings of the Coffee shop, it is the Evil Twin, regardless of how the connection is used. – J Kimball Apr 2 '15 at 20:18
  • 15
    Simple, the evil one will have a goatee. – asawyer Apr 3 '15 at 13:55
up vote 24 down vote accepted

Traditionally there hasnt been an easy user-oriented method to detect evil twin attacks. Most attempts to detect an evil twin attack (ETA) are geared towards the administrator of a network where they basically have the authorised network admins scanning and comparing wireless traffic. This isnt so much of what you are interested in.

There is a paper here (and slides) that goes over an experimental approach to determine from the user's perspective a real-time ETA. Basically, they use a cunning approach to statistically determine which access point is authorised and which is the evil twin.

A simple approach (that will not always work) that I propose is to merely sniff yourself and see what the IP addresses are. The idea being that an unathorised AP will have a nonstandard (IE what you would expect) IP and thus throw up some red flags... Here is a link that describes how to setup your own ETA so you can play around with my method (or try your own). WARNING: If you are creating an ETA, do so in a lab environment as this is illegal in public.

Also note that an ETA can be greatly mitigated by simply securing the network via an authentication system that uses Extensible Authentication Protocols such as WPA2-enterprise -which works by validating both the client and access point.


To address some other points...

If you have a way to communicate with the authorised network administrators (or at least know which access point is the proper one), then you have already completed a psuedo-meta-athorisation method outside of the digital realm (IE I can physically see the proper router and know it's mac address, ip settings, etc and can thus compare them with what my adapter is telling me I'm connected to). Most often, we do not have this info and moreover shouldnt trust it even if we did. Thus, perhaps the 'best' method for using an untrusted network (ET or not) is to always assume it is compromised and implement a VPN or simply abstain altogether!

  • 2
    I had seen the paper, and it was probably the most direct prompt for my question. I was curious if there were any other techniques that are usable from a user rather than administrator perspective. I think it is fair to say that I don't fully understand the paper well enough to implement it. (I would vote your answer up, but my reputation is not yet high enough to do so.) – J Kimball Apr 2 '15 at 19:46
  • Admittedly, my maths skills are not at par with the A&M professor but the gist is simple. If I do understand it correctly, that paper is essentially using the time it takes for a packet to traverse to and from the ET to physically pinpoint a location and then from there, it draws on a mass of statistics it has gathered to create an educated guess on which AP is the proper one... – Matthew Peters Apr 3 '15 at 12:18

They're both evil. You shouldn't be connecting to any "Free Public Wifi" without assuming that all your unencrypted traffic will be monitored and modified. The best solution is to not connect to public networks at all, but if that's not an option for you then you can protect yourself a little more by specifying your own DNS (rather than letting the router pick for you), using https everywhere you can, not accessing your sensitive accounts on public networks, considering a VPN, and keeping your software and firmware up to date.

In direct answer to your question, some routers have their MAC address printed on a label; you could ask the router owner to check for you, then connect to it, ping it, and view your arp table (arp -a) to see if it matches. Alternatively, you could tell the router owner that there's an imposter nearby and have them change the network name.

  • 10
    I'm less interested in "don't use public wifi" answers than I am in techniques to distinguish between legitimate APs and their evil twins. – J Kimball Apr 2 '15 at 18:26
  • 21
    There isn't an "evil" bit that's included in packets from bad routers. You will need say what specific attacks that you want to protect yourself against if you want a specific answer. If you want to be safe against the whole palette of things a malicious actor could do after you connect to his/her wifi, the only answer is "don't connect". And without a specific attack in mind, there's no way to distinguish what makes a router "bad" in the first place. – Aron Foster Apr 2 '15 at 18:46
  • 20
    @AronFoster but an evil bit was proposed in rfc 3514... "If the bit is set to 0, the packet has no evil intent. Hosts, network elements, etc., SHOULD assume that the packet is harmless, and SHOULD NOT take any defensive measures. ... If the bit is set to 1, the packet has evil intent. Secure systems SHOULD try to defend themselves against such packets. Insecure systems MAY chose to crash, be penetrated, etc." ... oh wait, that was published a bit over 12 years ago... 12 years and one day, on the first of April. Hmm. ;-) – user30204 Apr 2 '15 at 21:27
  • 8
    What if the evil router changed MAC address to be the same as the original one? – Buge Apr 2 '15 at 22:06
  • 4
    A note about DNS - some WiFi routers (like the one from TP-Link that I own) will simply redirect anything sent towards udp/53 to whatever DNS server they are using with a firewall rule. No matter which DNS server you try to talk to, you end up with the same result. When you are on an untrusted network, the only (relatively?) secure approach is to setup a VPN to a known endpoint and do everything through the tunnel. – thkala Apr 3 '15 at 10:15

Tell the barrista/clerk/etc the wifi has gone down, can they reboot the router. Most people will happily do so, bringing the AP down for a moment, and exposing the evil twin router in the process as any active network that survives a power cycle.

If there is more than 1 evil twin router, this still works.

If there are multiple good routers, this would identify at least one. The same tactic can be used to identify the others ( Hey it's not working still, is that the only wifi box? All this tech is so confusing, maybe you need to do it to all of them? ). Alternatively, once you identify a good AP, connect a device to it, and then using a second device, connect to the other AP's and attempt to locate the first device over the network. Unless the good AP has been compromised, any AP that finds the original device is a good AP. If it has been compromised however, then all AP's are bad

Another alternative being that if you can see the make of the router, try to log in to its admin panel. If the login prompt doesn't match the make/brand then you've found the evil twin

The best solutions here are mostly going to involve simply talking to the provider of the legitimate AP rather than running an extensive comparison with questionable results

  • as for login screens, I've seen setups where the Evil Twin will simply copy the login page of the real router – schroeder Apr 3 '15 at 4:27
  • 1
    This answer also assumes there is only one router. – Matthew Peters Apr 6 '15 at 11:16
  • If there are 10 evil twins, and the barrista power cycles the router, it still works. If there are 2 routers, and the barrista power cycles both, it still works. Consequently if there are multiple routers, and you identify 1 good router via power cycling, you can join every AP and ping a device connected to a known good router as a basic test – Tom J Nowell Apr 6 '15 at 11:19
  • Exposing the Evil Twin in this manner would work only if it's not evil enough to also appear to go down for the same duration. What if it's very evil and will mirror the state of the good router? In this case you may need to introduce a pseudo-evil triplet to outdo the twin. – A-B-B Aug 4 '15 at 22:11
  • 1
    Or you could tell them they have an evil twin. – PyRulez Jan 16 '16 at 1:52

There is one thing an evil twin can't copy: location. Set up three computers, then triangulate it. Or have some sort of time detector. If one of them is responding fast enough that you know, according to the speed of light, they must be within the store, then you know that it will be in the store, which is helpful if delays make triangulation harder.

Note: If you somehow find out that the routers aren't moving through some other source, you can use one moving distance detector. This will give you a lot of data points to work with, which may help if your detector isn't accurate.

Note: If you somehow find out that the routers have the same signal power and detection capabilities, and that the good one is closer, one practical method is to simply filter out weaker packets.

  • 8
    The speed of light is too fast for standard hardware to be useful in determining distance. The response time (and variation thereof) will be dominated by processing delays. But signal strength could be used with one computer you can move. – Rick Apr 3 '15 at 15:26
  • @Rick Taking a bunch of samples gets the variation down. It is also just generally harder for the twin to attempt to copy the originals location (which your triangulating) the closer you are. – PyRulez Apr 3 '15 at 15:29

For detecting an Evil Twin attack with a standard setup, the only information you really have and the SSID, The MAC address of the wireless access point, and the DHCP IP address, gateway, and DNS server that it hands out. Apart from that, you might find the evil twin using a different frequency than the original, like the true AP being on 2.4GHz and the evil AP being on 5GHz. Many Access Points are configured via web interface, whcih means if you have a Linksys AP, you might be able to access a page at http://192.168.1.1/Managment.asp , but not on the evil AP.

An Evil Twin will probably not bother to clone that detailed level of configuration because it is far easier to just clone the SSID and MAC (if they even bother with that).

Therefore, if you know the expected DHCP config setup or expected configuration URL, you could tell if the AP you are connecting to is false.

One really simple way, if you're the network administrator, is to have a host that is attached to your physical network. So a quick ping to it, will reveal if you've been sidelined to another network.

In the use case of you being in a public area, then using a vpn might be a good idea.

  • 1
    Unless the rogue AP is a proxy for the proper one. – Cees Timmerman Apr 20 '15 at 12:05
  • Well the ping endpoint is not the same as the access point. Though really the fundamental problem is WIFI to begin with. – munchkin Apr 20 '15 at 12:28
  • WLAN is no different than LAN with strange devices. How does your solution mitigate a MITM attack? – Cees Timmerman Apr 20 '15 at 13:44
  • 1
    Couldn't the fake AP relay your ping to the real AP, thus rendering your solution void? – Cees Timmerman Apr 21 '15 at 6:51
  • 1
    The real AP is obviously not secure, so there is no reason why the fake AP could not connect to it for LAN requests. – Cees Timmerman Apr 21 '15 at 11:36

The good AP should have a trusted fingerprint of its self-signed* certificate. I think that's automated as "certificate pinning" - What is certificate pinning?

*: Self-signed because not all CAs are trustworthy.

UPDATE: I don't know your AP, but putting a simple webserver on there should be trivial (flash open source firmware). Anyway, here's proof that an AP can have a certificate.

  • 1
    Wireless access points don't use SSL certificates. – Mark Apr 18 '15 at 2:28
  • @Mark Not any? Good thing i didn't mention SSL, then. – Cees Timmerman Apr 20 '15 at 12:08
  • If the fingerprint changes then you know it's not the real AP, so how is my answer not useful? Put a secure proxy or "It's me" page on the AP if other tech is too difficult. – Cees Timmerman Dec 22 '15 at 19:30

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.