Security threats Toolkit

Wi-Fi 'Evil Twin' to become troublemaker

Tags:
Cranfield,
Evil Twin

Dan Ilet ZDNet.co.uk

Published: 20 Jan 2005 17:45 GMT

Wi-Fi hot-spot users should be on their guard for malicious wireless access points that steal data.

Researchers at Cranfield University, are claiming "Evil Twin" hot spots, networks set up by hackers to resemble legitimate hot-spots, present the "latest security threat" to Web users.

The hacker's wireless network jams the connection to the legitimate network by sending a stronger signal within close proximity to the wireless client and turns itself into an "Evil Twin".

"Evil twin hot spots present a hidden danger for Web users," explained Dr Phil Nobles, wireless Internet and cybercrime academic. "Because wireless networks are based on radio signals they can be easily detected by unauthorised users tuning into the same frequency."

Once an unknowing user has connected to an evil twin, a hacker can intercept transmitted data. Users are invited to log into the evil twin with bogus login prompts and can be lured into passing sensitive data such as user names and passwords.

"Users can also protect themselves by ensuring that their Wi-Fi device has its security measures activated because in the vast majority of cases base stations taken out of the box direct from the manufacturer are automatically configured in the least secure mode possible," said head of information systems professor Brian Collins.

Cranfield University believes this is a new area of cyber crime where more research is required. However, in October 2002, security company ISS published details of base-station cloning, otherwise known as an evil twin traffic interception. If true, this would mean that the idea is almost two-and-a-half years old.

In its 2002 document, ISS defines the technique as:

"BaseStation Clone (Evil Twin) intercept traffic -- An attacker can trick legitimate wireless clients to connect to the attacker's honeypot network by placing an unauthorised base station with a stronger signal within close proximity of the wireless clients that mimic a legitimate base station. This may cause unaware users to attempt to log into the attacker's honeypot servers. With false login prompts, the user unknowingly can give away sensitive data like passwords."

Nobles and Collins are set to give a talk on evil twins tonight at London's Science Museum.