Q

What is WiPhishing?

In this expert Q&A, information security threats expert Ed Skoudis addresses WiPhishing and the reasons you shouldn't trust every wireless access point.

WiPhishing is something I've heard a lot about lately. Can you please explain this new phishing tactic and detail why WiPhishing should be seen as a threat?
WiPhishing involves a bad guy configuring a laptop to impersonate a trusted wireless access point. For example, an attacker may set up a machine with an SSID (a wireless LAN name) of "Linksys" or "T-Mobile," in an effort to get users to access the Internet through the attacker's own machine. If someone falls for the trap, the attacker can monitor all clear-text traffic that passes through the attacker's system, possibly including email, Web content and other data.

There are two factors that can make this type of threat worse. First, many wireless client packages are configured

to automatically associate with an SSID that they've used in the past, based merely on the name of the access point. Future connections often happen automatically, regardless of the hardware address or any other characteristic. Thus, a user may not know that his or her software has associated with an access point, let alone an impersonated one. Secondly, there are tools that can automate WiPhishing attacks, namely Hotspotter and Karma. These tools respond to any SSID requests that a wireless client detects. They can then pretend to be that access point, offering services like Web, email and file sharing to the victim's machine. This scheme dupes a user into revealing passwords and other sensitive information.

To foil these attacks, I recommend deploying encrypted VPN access for wireless traffic. Also, instruct users to trust wireless if and only if they've made a VPN connection across it; otherwise, attackers can monitor their traffic.

More information:

  • Learn the best practice for detecting wireless devices.
  • Build a secure wireless connection.
  • This was first published in December 2006

    Dig deeper on Client security

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    SearchCloudSecurity

    SearchNetworking

    SearchCIO

    SearchConsumerization

    SearchEnterpriseDesktop

    SearchCloudComputing

    ComputerWeekly

    Close