Problem solve Get help with specific problems with your technologies, process and projects.

How 'evil twins' and multipots seek to bypass enterprise Wi-Fi defenses

Enterprise Wi-Fi threats are an ever-present struggle for security managers, and the most simplistic attack methods are often the most effective. In this tip, contributor Noah Schiffman explains how "evil twin" attacks work and why its sister attack method, the multipot, can bypass wireless intrusion prevention systems with remarkable success.

The introduction of wireless communications within an enterprise network environment presents several new challenges...

for corporate IT security managers. While many deployments are driven by the convenience of untethered access to network resources, Wi-Fi creates a larger network attack surface and a whole new class of threats and exploits specific to wireless technology.

Listen to Noah's tip

Download Noah's multipot and 'evil twin' prevention advice to your PC or favorite MP3 player.

Despite increasingly effective WIPS, wireless attacks are rapidly increasing due to several factors, most notably the proliferation of enterprise usage, the frequent changes in standards and the common misconception that Wi-Fi security is nothing more than an afterthought. Today there are also many well-written applications, platforms, operating systems and hardware modifications designed to simplify the setup and execution of sophisticated wireless attacks. Most of the commonly known types of network threats traditionally seen in wired network environments have been redesigned to exploit wireless systems; sniffing, probing, scanning, spoofing and cryptographic attacks, to name a few, have all been effectively executed.

More information

In our Wireless Security Lunchtime Learning program, Lisa Phifer reviews the risks that Wi-Fi implementation can have on enterprise networks

Learn more about defeating 'evil twin' attacks

Michael Cobb explains how frequently an enterprise network should be checked for rogue access points.
Wi-Fi attack methods

The multipot attack takes the evil twin concept a step further and presents a more significant threat to enterprises. Coined from the term "multiple honeypots", a multipot employs the use of two or more malicious access points configured as clones of a legitimate access point.

The multipot's use of multiple rogue access points, however, creates a unique and difficult situation for an enterprise WIPS. In this scenario, when session containment is attempted, the client receives the WIPS's deauthentication packets, which force network disconnection. But when the client restarts the 802.11 reconnection process, it associates itself to the second rogue access point and resumes communication attempts. Although the sensors again detect improper activity and transmit deauthentication packets, the WIPS is presented with a temporal obstacle. Its sensor is a transceiver and is responsible for channel-frequency scanning and packet broadcasting for session containment. While the time required to complete these tasks is in the order of seconds, it is much longer than the millisecond process of client reconnection.

So in a scenario with only one rogue access point, the process of connecting to and being disconnected from a single access point would result in a cycle causing packet flooding, yet with two rogue access points, the client effectively "outruns" the deauthentication packets by hopping back and forth between the rogue access points. Again, this vast difference in the time that each device needs to perform its job -- the WIPS sensor requires seconds while the client just milliseconds -- allows for client communication to proceed without perception of any disruptions.

There are a number of steps that can be incorporated into an enterprise security strategy to mitigate these types of threats. Site surveys to maintain a current database of network elements allow for monitoring WLAN changes via access point characteristics such as channel signal strengths associated with each SSID, physical access point location, RF triangulation, vendor consistency via MAC addressing, and access point firmware versions. Since the 802.11 standard only defines Layer 1 (physical) and Layer 2 (data link layer/MAC address sublayer) segments, multilayered protection should be implemented with additional upper-layer authentication, encryption, network access control and vulnerability management. Knowledge of the geographic coverage area, physical mapping of wireless threat exposure, identifying areas of high risk probability, dense sensor deployment, 24x7 real-time monitoring, effective threat classification and increasing physical access to office premises and surrounding areas are also essential for secure enterprise WLAN deployment. Finally, employee education and enforcement of a well-defined security policy remain the cornerstones for maintaining a secure network environment.

About the author:
Noah Schiffman is a reformed former black-hat hacker who has spent nearly a quarter century penetrating the defenses of Fortune 500 companies. Today he works as an independent IT security consultant specializing in risk assessment, pen testing, cryptography and digital forensics, predictive analysis models, security metrics and corporate security policy. He holds degrees in psychology and mechanical engineering, as well as a doctorate in medicine from the Medical University of South Carolina. Schiffman is based in Charleston, S.C.

First, it's important to note that several differences exist between the security monitoring systems of wired vs. wireless networks. In-line probes inspect wired network segments, monitoring packets as they traverse the LAN. Enterprise WLAN monitoring, however, relies on wireless intrusion prevention systems (), where a distributed network of transceiver sensors constantly monitor all channel bandwidths, reporting all activity to a centralized server. Through analysis of sensor data, the server is able to locate and thwart denial-of-service (DoS) attacks and unauthorized use of network resources, yet such WIPS architectures are more complex to implement and manage than their wired counterparts. One of the most widespread and effective is the "evil twin" attack. A "rogue" or unauthorized access point is set up to appear identical to a nearby legitimate access point. When a user attempts to gain network access, the two identical access points are meant to cause confusion and coerce the user into connection to the illegitimate or evil twin access point, putting the user at the attacker's mercy. The attacker could opt to phish or probe the client for sensitive information, though an attacker will often take the opportunity to execute a wireless man-in-the-middle attack, which involves observing, capturing and forwarding all of the user's outbound traffic through the legitimate AP, providing no indication to the user that anything has gone awry. While this remains an effective threat at the consumer level, fortunately it is often prevented in the corporate setting with a standard WIPS implementation.
This was last published in October 2007

Dig Deeper on Wireless network security

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.