Security threats Toolkit
Story: Wi-Fi 'Evil Twin' to become troublemaker
Posted by: Anonymous (Friday 21 January 2005, 10:47 AM)
Do you not think statements such as there are just spreading fear, uncertainly and doubt? That is, confusion and FUD over how public HotSpots vs. corp. Access Points, vs Secure Web sites work?
Typical HotSpot service users are authenticated on a secure (https) web
page. So that provides reasonable levels of security for passing user credentials through a mutual authentication mechanism.
Conducting financial transactions or anything that is of a sensitive or personal nature is today done via secure web sites or over VPN connections. These deliver end to end security, regardless of the networks involved, be they wired, wireless, or wet string! If there's education to be done here, is it not that users need to know if they're
on a secured connection, or not? To say 'don't use/be careful using a particular type of connection' is just plain missleading, isn't it?
So back to the the "evil twin"... It may look like a HotSpot access point, even with a login page that looks like a HotSpot behind it. This
would be the same as the "evil twin owner" trying to capture bank details by making their web page on an Internet site somewhere look like a Bank's page. This is 'phishing', and not really an issue associated with public wireless HotSpots, other than their connection to the Internet at large.
ONCE authenticated at a HotSpot, and with a connection to the Internet at large, the user is really no more at risk than connecting over any other type of ISP connection. It MUST be considered insecure and hackable. That's why we have secure web sites for banking, a VPN industry etc., for secure transmission of sensitive data for the public and corporates.
Point is, this is an issue of phishing of secure web sites, NOT pretending to be an Access Point.
In a corporate environment it's different - the Access Points themselves are often connected right to the corp. network (no secure login page, no secure web sites or VPNs on the internal network, etc.) so the access points themselves have to secured from these type of attacks, using WPA/802.11i or whatever is the flavour of the day.
Full Talkback thread
