Evil Twin Wi-Fi

Tricking users to connect to a malicious network

Introduction

An Evil Twin attack is a wireless network attack in which an attacker creates a rogue Wi-Fi access point that impersonates a legitimate wireless network. The attacker gives the malicious network the same, or a very similar, Service Set Identifier (SSID) as a trusted network, attempting to trick users into connecting to it.

Once connected, the attacker can potentially monitor traffic, redirect victims to malicious websites, harvest credentials, or exploit weaknesses in the victim’s device or applications.

What is an Evil Twin attack?

To understand what an Evil Twin attack is, you first need to understand some basics of Wireless networking.

When you set-up wireless network, you typically give it a human-readable name – This is known as the SSID – Service Set Identifier

A wireless access point also has something called a BSSID – Basic Service Set Identifier – This is a unique Identifier, akin to a MAC address, that is used to identify the access point in the network.

A legitimate Wi-Fi network might be called something like Hotel-free-WiFi

An attacker can create another wireless network using the exact same SSID, but will be using a completely different BSSID.

To a user, both networks may appear identical, but the attacker-controlled access point can then position itself between the victim and the internet – This creates an opportunity for the attacker to observe and manipulate network traffic.

An Evil Twin does not necessarily require breaking the legitimate Wi-Fi password. Instead, the attacker attempts to convince the victim to connect to a different access point.

How Evil Twin networks work

  • Legitimate network – The victim normally connects to a trusted wireless network.
  • Rogue Access Point – The attacker creates a wireless network using the same or a similar SSID.
  • Victim connects – The victim’s device sees the familiar network name and now connects to the attacker’s access point.
  • Traffic relay – The attacker forwards traffic towards the internet while potentially monitoring or manipulating communications.
  • Credentials harvesting – The attacker may present a convincing captive portal or malicious website designed to capture usernames, passwords or other information.

What can the attacker target?

An Evil Twin can potentially be used to target:

  • Authentication credentials
  • Email accounts
  • Corporate accounts
  • Session information
  • Web traffic
  • Application traffic
  • Personal information
  • Unencrypted communications
  • Devices connected to the rogue network

The actual impact depends heavily on whether applications use TLS/HTTPS, certificate validation, secure authentication and other protective mechanisms.

Common Evil Twin techniques

  • SSID Impersonation – The attacker creates an access point using the same SSID as a legitimate network.
  • Signal manipulation – The rogue access point may be positioned close to the victim to provide a stronger signal.
  • Captive portal phishing – The victim is redirected to a fake authentication page requesting credentials.
  • Deauthentication – Attackers may attempt to disconnect devices from the legitimate access point, encouraging them to reconnect to the rogue network.
  • Network impersonation – The attacker attempts to reproduce characteristics of the legitimate wireless network to make the rogue network appear authentic.

Detecting an Evil Twin network

Organisations should look for:

  • Unexpected duplicate SSIDs
  • Unauthorised access points
  • Unknown BSSID/MAC addresses
  • Sudden changes in wireless infrastructure
  • Unexpected certificate warnings
  • Suspicious captive portals
  • Authentication attempts from unusual locations
  • Rogue DHCP servers
  • Unexpected DNS behaviour
  • Wireless intrusion detection alerts

Enterprise wireless infrastructure can use Wireless Intrusion Detection/Prevention Systems (WIDS/WIPS) to identify unauthorised access points and suspicious wireless activity.

Preventing Evil Twin attacks

  • Use WPA2/WPA3 Enterprise – Enterprise authentication makes simple SSID impersonation substantially less effective.
  • Verify network authenticity – Users should not assume that a familiar SSID is automatically trustworthy.
  • Use HTTPS – Encrypted application traffic reduces the value of network-level interception.
  • Use VPNs When appropriate – A properly configured VPN can provide an additional encrypted tunnel over an untrusted network.
  • Disable automatic Wi-Fi connections – Prevent devices from automatically joining previously encountered networks.
  • Use certificate validation – Applications should properly validate certificates rather than accepting unexpected or invalid certificates.
  • Deploy WIDS/WIPS – Monitor wireless infrastructure for rogue and unauthorised access points.
  • User awareness – Train users to recognise suspicious captive portals, certificate warnings and unexpected authentication requests.

Conclusion

An Evil Twin attack does not have to defeat the legitimate Wi-Fi network – Instead, the attacker attempts to make the victim connect to a network that only appears to be legitimate.

The most important defence is to never treat a familiar Wi-Fi name as proof that the network is trustworthy. Authentication, encryption, certificate validation, wireless monitoring and user awareness all help reduce the risk.