Fake Hot Spots Pose Serious Wi-Fi Phishing Threat23 January 2005
AirMagnet, the leader in wireless LAN (WLAN) security and performance solutions, addresses the "evil twin" problem that has been plaguing Wi-Fi networks for several years, but has received recent attention in the press. AirMagnet products first protected customers, such as hot spot providers and hotels, from spoofed wireless access points (APs) and similar attacks in 2002, which have recently come to be known as "evil twins."
In the "evil twin" example, a hacker sets its service identifier (SSID) to be the same as an access point at the local hot spot or coffee shop, or even a corporate wireless network. He then disrupts or disables the legitimate AP by disconnecting it, directing a denial of service against it, or creating sufficient RF interference around it with a metal or another obstacle to prevent it from communicating with nearby laptops or other devices. Users that were connected to the legitimate AP lose their connections and re-connect to the "evil twin," allowing the hacker to intercept all the traffic to that device.
"While many corporate wireless networks have security measures in place to prevent hackers from gaining access to sensitive information, users of hot spots and other public wireless networks are more at risk," said Dean Au, AirMagnet President and CEO. "The growing menace of phishing scams, and the increasing use of Wi-Fi networks for e-commerce transactions make securing these networks absolutely critical. AirMagnet customers already have the tools to locate and defeat 'evil twins' and hundreds of other Wi-Fi issues."
AirMagnet users can use remote or mobile products to identify "evil twin" and similar attacks in several different ways, at multiple stages of the process:
-- AirMagnet identifies 20 different types of denial-of-service attacks, which is most often the hacker's first move in an "evil twin" attack.
-- AirMagnet identifies multiple devices with the same MAC address, a circumstance that is a very good indication that a spoof is being attempted.
-- AirMagnet identifies rogue devices with legitimate SSIDs that do not match up with a legitimate vendor, or are on the wrong wireless channel or band.
-- AirMagnet also identifies excessive AP power cycling and configuration changes, which may indicate a failing device or tampering by a user.
-- AirMagnet also identifies APs that should be active, but have gone silent (stopped transmitting), which may be a performance malfunction, but could be an indication of foul play.
Contacts
AirMagnet
Jenny Coupe, 408-400-1290
jcoupe@airmagnet.com
or
A&R Partners (for AirMagnet)
Mary Colvig, 650-762-2820
mcolvig@arpartners.com
Source: Business Wire
All trademarks and copyrighted information contained herein are the property of their respective owners.
Related Articles
Recent Issues
|
