Evil twin is a term for a rogue Wi-Fi access point that appears to be a legitimate one offered on the premises, but actually has been set up by a hacker to eavesdrop on wireless communications among Internet surfers.[1]
Evil twin is the wireless version of the phishing scam. An attacker fools wireless users into connecting a laptop or mobile phone to a tainted hotspot by posing as a legitimate provider.
Wireless devices link to the Internet via "hotspots" – nearby connection points that they lock on to. But these hotspots can act like an open door to thieves. Anyone with suitable equipment can locate a hotspot and take its place, substituting their own "evil twin".
This type of evil twin attack may be used by a hacker to steal the passwords of unsuspecting users by either snooping the communication link or by phishing, which involves setting up a fraudulent Web site and luring people there.[2]
Contents |
The attacker uses a bogus base station that someone connects to using Wi-Fi wireless technology. By imitating the name of another, legitimate wireless provider, they can fool people into trusting the internet services that they are providing. When the users log into bank or e-mail accounts, the phishers have access to the entire transaction, since it is sent through their equipment.
Unwitting web users are invited to log into the attacker's server with bogus login prompts, tempting them to give away sensitive information such as usernames and passwords. Often users are unaware they have been duped until well after the incident has occurred.
Users think they have logged on to a wireless hotspot connection when in fact they have been tricked into connecting to the attacker's base station. The hacker jams the connection to the legitimate base station by sending a stronger signal within proximity to the wireless client – thereby turning itself into an 'evil twin.'
A rogue Wi-Fi connection can be set up on a laptop with a bit of simple programming and wireless card that acts as an access point. The access points are hard to trace, since they can suddenly be shut off, and are easy to build. A hacker can make their own wireless networks that appear to be legitimate by simply giving their access point a similar name to the Wi-Fi network on the premises. Since the hacker may be physically closer to the victim than the real access point, their signal will be stronger, potentially drawing more victims. The hacker's computer can be configured to pass the person through to the legitimate access point while monitoring the traffic of the victim, or it can simply say the system is temporarily unavailable after obtaining a user id and password.[3]
Several free programs available on the Internet can decode packets to reveal clear-text logins and passwords. Using an evil twin attack a hacker is able to harvest Web applications such as email that could send passwords in clear text.
Hackers typically setup evil twin attacks near free hotspots, such as airports, cafes, near student residences, hotels or libraries.[4]
Virtual private networks or end to end encryption (such as TLS/SSL/HTTPS) may be used to protect passwords, E-mail and other sensitive information.
One way that Corporate users can protect themselves from an evil twin attack is by using VPN (virtual private network) when logging into company servers. They should not send sensitive information such as bank account information or corporate user ids and passwords over a wireless network.[5]