Evil twin attack is an interesting variant of client hack attack targets business Flum clients attackers
have to set up an access point with an SS ID that is expected from a user the rogue access point has
to emit a signal that's greater in strength than the legitimate access points.
A user knows that Enterprise Networks are protected and they have to log in to connect.
That's why a rogue access point will also employ a logging mechanism a radius server verifies user credentials
and business networks.
Our access point will also be a radius server client but unlike a legitimate radious server the evil
server will authenticate all users regardless of submitted log ins and passwords.
This means that users will always connect to our access points.
Whether or not they will be granted Internet access depends on our access point configurations and our
subsequent agenda.
Until we physically connect our access point to a business network users will not be able to access
the network.
The damage however is already done.
A user send his credentials to an attacker freely.
He had to do it because a radius server client the access point had to send it to the server.
The data will either be sent in clear text or as a challenge in response message depending on a radius
configuration.
If the protocol was used the data will be transmitted in clear text
because an attacker is not trying to make his own life more difficult.
He'll said his rogue access point and Radius server to use Pat radious clients negotiate different authentication
levels from illest configured by an administrator.
If the user agrees to use pap It's very simple from then on if it doesn't and goes on to negotiate a
higher level authentication protocol.
For example M-S chip the challenge in response message will be encrypted with the user password the
encryption will have to be reversed.
This operation will take us about 15 seconds
at this point.
An attacker is obtained the user credentials
if he manages to physically connect to an enterprise network you can for example log in as the victim.
The fact that a user is connected to an access point means that the attacker is fully able to control
a client's.
In this scenario we did not expect any need for major user activity the client was only expected to
connect to an access point.
What are the counter managers as a rule.
You shouldn't only prove your identity to an access point the access point should also prove its identity
to you by way of mutual authentication.
This would help prevent impersonating a trusted access point
mutual authentication can easily be configured in Windows systems locally or using group rules.
You can see the latter configuration below.
You can select in EAP settings whether you want to ensure the identities of an access point or radious
server if it's checked.
Select next to certificate to be used for verification
a radius server is required to present its valid certificate that matches a certificate issued by a
public certification authority a common error in managing Enterprise Networks is failing to require
mutual authentication.
Another problem is accepting all the certificates pre-installed in a Windows system.
This means that to run an attack a potential intruder will only need to buy a valid certificate which
costs about 100 dollars.
You should only trust certificates that were issued by your certification authority.
You also need to have your own public key infrastructure.