Evil Twin
A fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.
Term
description · examples · notesA fake Wi-Fi network, known as an evil twin, imitates a legitimate wireless network so that users connect to an access point the attacker controls. The network name looks familiar, the signal can be stronger, and the device often suggests or restores the connection by itself.
Description
Once the user connects, the attacker can watch the traffic, attempt credential theft, present a fake captive portal, redirect the user, or run an attack as a man in the middle. In public places this works particularly well, because people expect open networks in hotels, cafés, airports and conference halls.
The problem is not only the Wi-Fi name. Devices remember networks, users are in a hurry, and a fake network can look convincing. If a business account is entered on a fake portal, the attacker is no longer attacking the network but the victim's identity.
Examples
- At an airport a network appears with a name similar to the official free Wi-Fi.
- A fake captive portal asks for a business email and password to grant internet access.
- The attacker uses a portable device to create a fake network with the same name as the hotel Wi-Fi.
Notes
- A familiar network name is no proof that the network is genuine.
- A VPN, HTTPS, MFA and caution with captive portals reduce the damage, but the best protection is not using business systems over unknown networks without further protection.
Techniques
carried out with 4Techniques used to carry it out. Select one to open its page.
Defenses
countered by 5How it is defended against. Select one to open its page.