How 'evil twins' and multipots seek to bypass enterprise Wi-Fi defenses

Enterprise Wi-Fi threats are an ever-present struggle for security managers, and the most simplistic attack methods are often the most effective. In this tip, contributor Noah Schiffman explains how "evil twin" attacks work and why its sister attack method, the multipot, can bypass wireless intrusion prevention systems with remarkable success.

The introduction of wireless communications within an enterprise network environment presents several new challenges

for corporate IT security managers. While many deployments are driven by the convenience of untethered access to network resources, Wi-Fi creates a larger network attack surface and a whole new class of threats and exploits specific to wireless technology.

Listen to Noah's tip

Download Noah's multipot and 'evil twin' prevention advice to your PC or favorite MP3 player.
First, it's important to note that several differences exist between the security monitoring systems of wired vs. wireless networks. In-line probes inspect wired network segments, monitoring packets as they traverse the LAN. Enterprise WLAN monitoring, however, relies on wireless intrusion prevention systems ( WIPS), where a distributed network of transceiver sensors constantly monitor all channel bandwidths, reporting all activity to a centralized server. Through analysis of sensor data, the server is able to locate and thwart denial-of-service (DoS) attacks and unauthorized use of network resources, yet such WIPS architectures are more complex to implement and manage than their wired counterparts.

Despite increasingly effective WIPS, wireless attacks are rapidly increasing due to several factors, most notably the proliferation of enterprise usage, the frequent changes in standards and the common misconception that Wi-Fi security is nothing more than an afterthought. Today there are also many well-written applications, platforms, operating systems and hardware modifications designed to simplify the setup and execution of sophisticated wireless attacks. Most of the commonly known types of network threats traditionally seen in wired network environments have been redesigned to exploit wireless systems; sniffing, probing, scanning, spoofing and cryptographic attacks, to name a few, have all been effectively executed.

More information

In our Wireless Security Lunchtime Learning program, Lisa Phifer reviews the risks that Wi-Fi implementation can have on enterprise networks

Learn more about defeating 'evil twin' attacks

Michael Cobb explains how frequently an enterprise network should be checked for rogue access points.
One of the most widespread and effective Wi-Fi attack methods is the "evil twin" attack. A "rogue" or unauthorized access point is set up to appear identical to a nearby legitimate access point. When a user attempts to gain network access, the two identical access points are meant to cause confusion and coerce the user into connection to the illegitimate or evil twin access point, putting the user at the attacker's mercy. The attacker could opt to phish or probe the client for sensitive information, though an attacker will often take the opportunity to execute a wireless man-in-the-middle attack, which involves observing, capturing and forwarding all of the user's outbound traffic through the legitimate AP, providing no indication to the user that anything has gone awry. While this remains an effective threat at the consumer level, fortunately it is often prevented in the corporate setting with a standard WIPS implementation.

The multipot attack takes the evil twin concept a step further and presents a more significant threat to enterprises. Coined from the term "multiple honeypots", a multipot employs the use of two or more malicious access points configured as clones of a legitimate access point.

The multipot's use of multiple rogue access points, however, creates a unique and difficult situation for an enterprise WIPS. In this scenario, when session containment is attempted, the client receives the WIPS's deauthentication packets, which force network disconnection. But when the client restarts the 802.11 reconnection process, it associates itself to the second rogue access point and resumes communication attempts. Although the sensors again detect improper activity and transmit deauthentication packets, the WIPS is presented with a temporal obstacle. Its sensor is a transceiver and is responsible for channel-frequency scanning and packet broadcasting for session containment. While the time required to complete these tasks is in the order of seconds, it is much longer than the millisecond process of client reconnection.

So in a scenario with only one rogue access point, the process of connecting to and being disconnected from a single access point would result in a cycle causing packet flooding, yet with two rogue access points, the client effectively "outruns" the deauthentication packets by hopping back and forth between the rogue access points. Again, this vast difference in the time that each device needs to perform its job -- the WIPS sensor requires seconds while the client just milliseconds -- allows for client communication to proceed without perception of any disruptions.

There are a number of steps that can be incorporated into an enterprise security strategy to mitigate these types of threats. Site surveys to maintain a current database of network elements allow for monitoring WLAN changes via access point characteristics such as channel signal strengths associated with each SSID, physical access point location, RF triangulation, vendor consistency via MAC addressing, and access point firmware versions. Since the 802.11 standard only defines Layer 1 (physical) and Layer 2 (data link layer/MAC address sublayer) segments, multilayered protection should be implemented with additional upper-layer authentication, encryption, network access control and vulnerability management. Knowledge of the geographic coverage area, physical mapping of wireless threat exposure, identifying areas of high risk probability, dense sensor deployment, 24x7 real-time monitoring, effective threat classification and increasing physical access to office premises and surrounding areas are also essential for secure enterprise WLAN deployment. Finally, employee education and enforcement of a well-defined security policy remain the cornerstones for maintaining a secure network environment.

About the author:
Noah Schiffman is a reformed former black-hat hacker who has spent nearly a quarter century penetrating the defenses of Fortune 500 companies. Today he works as an independent IT security consultant specializing in risk assessment, pen testing, cryptography and digital forensics, predictive analysis models, security metrics and corporate security policy. He holds degrees in psychology and mechanical engineering, as well as a doctorate in medicine from the Medical University of South Carolina. Schiffman is based in Charleston, S.C.

This was first published in October 2007

Dig deeper on Wireless LAN Design and Setup

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchCloudSecurity

SearchNetworking

SearchCIO

SearchConsumerization

SearchEnterpriseDesktop

SearchCloudComputing

ComputerWeekly

Close