An evil twin attack involves an adversary creating a fraudulent wireless access point that mimics a legitimate network, tricking users into connecting and exposing their traffic to interception. Evil twin prevention encompasses the technical controls, user education, and monitoring strategies that protect against this class of wireless impersonation attack.
Evil twin attacks succeed because wireless clients typically auto-connect to known network names (SSIDs) based on signal strength. An attacker broadcasts the same SSID as a legitimate network with a stronger signal, causing nearby devices to connect to the malicious AP instead. Prevention requires a multi-layered approach. Enterprise WPA2/WPA3 with certificate-based 802.1X authentication (EAP-TLS) prevents connections to APs that cannot present a valid server certificate. Client-side certificate validation must be properly configured to reject connections to servers with unknown certificates. WIPS sensors detect duplicate SSIDs and alert on access points broadcasting organizational network names from unauthorized locations. 802.11w Protected Management Frames prevent attackers from deauthenticating clients from legitimate APs to force reconnection to the evil twin. MDM policies can enforce wireless profiles that require certificate validation and prevent auto-connection behavior. User education teaches employees to verify network authenticity and report suspicious wireless behavior.
Evil twin attacks are simple to execute using commodity hardware and freely available tools, yet highly effective against unprotected clients. Once connected to an evil twin, all user traffic including credentials, session tokens, and sensitive data flows through the attacker's system. HTTPS provides some protection but can be undermined through SSL stripping, captive portal phishing, and certificate warning fatigue. Public locations like airports, hotels, and coffee shops are particularly vulnerable.
CDA addresses evil twin prevention within the Threat Intelligence and Defense domain. Our missions assess wireless client configurations, validate certificate-based authentication deployment, conduct controlled evil twin exercises, and train users to recognize and report wireless impersonation attempts.