A passive user‐side solution for evil twin access point detection at public hotspots

Abstract

SummaryThis paper proposes a passive user‐side solution, called Wi‐Fi legal access point (AP) finder (LAF), to the notorious evil twin access point problem, which in turn can result in diverse security problems, such as fraud, identity theft, and man‐in‐the‐middle attacks. Due to the severe security threats created by evil twins, many promising solutions have been proposed. However, the majority of these solutions are designed for the administrators of wireless networks, not for Wi‐Fi users. Hence, they are either too expensive or need some data that are usually not accessible to normal users. LAF utilizes the TCP three‐way handshake‐related packets and packet forwarding property created by evil twins to find legal APs, called good twins, at public hotspots or unencrypted WLANs; thus, it does not need any data or assistance from wireless network administrators. LAF does not send exploring packets actively; hence, evil twins cannot sense its existence. No matter when and where a user needs to utilize an AP to connect to the Internet at a hotspot, he can just use LAF to find out a legal AP to connect to. Experimental results show that LAF can quickly and accurately find legal APs after observing only a few packets.

WPFD: Active User-Side Detection of Evil Twins

“…We compare WPFD with previous studies on detecting evil twins [19,20] and a traditional time-metric-based solution [34]. Hsu et al [19] is our prototype using the evil twin redirection methodology.…”

“…Another difference is that a WPFD only needs one device because it uses the same WNIC to send probe packets and switch to monitor mode. When we studied LAF [20], it had some of the advantages of the WPFD. Still, the WPFD has evolved into an active detection mechanism after changing the algorithm from the passive detection mechanism of LAF.…”

“…Using local RTT (Round Trip Time), Mano et al [16] distinguished wired traffic from wireless traffic. On the other hand, client-centric evil twin AP detection is a new solution class for evil twin AP detection [9,[17][18][19][20]. Such solutions are ideal for quick connections wherever Wi-Fi access is required for AP travelers.…”