jane invites her friends Alice and John over for a LAN party. Alice and John access Jane's wireless network without a password. However. Jane has a…

An evil twin attack involves an attacker setting up a rogue Wireless Access Point (WAP) that mimics a legitimate one by broadcasting the same Service Set Identifier (SSID). This rogue AP is often configured with no security or a captive portal. Alice and John's devices likely connected automatically to this malicious, open network, believing it to be Jane's secure one. This explains why they could connect without the complex password required by Jane's actual router. The attacker can then intercept all traffic from the connected victims.

A. Wireless sniffing: This is a passive attack for capturing and analyzing wireless traffic; it does not explain how a connection was established to a secure network without a password.

B. Piggybacking: This refers to an unauthorized user gaining access by using an authorized user's active session or an unsecured network, not connecting to a spoofed network.

D. Wardriving: This is the process of searching for and mapping Wi-Fi networks, typically from a moving vehicle. It is a reconnaissance technique, not the attack that allowed the connection.

1. National Institute of Standards and Technology (NIST). (2012). Guidelines for Securing Wireless Local Area Networks (WLANs) (NIST Special Publication 800-153). Section 3.1.3

"Unauthorized APs

" describes how malicious APs can "masquerade as a legitimate AP by using the same Service Set Identifier (SSID) as a legitimate AP

" which is the definition of an evil twin.

2. Cabric

D.

& Pahlavan

K. (2004). Physical Layer Intrusion Detection for Wireless Networks. In 2004 IEEE Wireless Communications and Networking Conference. This paper discusses various wireless attacks

defining the evil twin or "AP spoofing" attack where an attacker spoofs the MAC address and SSID of a target AP to lure users (Section II.B). DOI: 10.1109/WCNC.2004.1311389.

3. Zand

A.

& Shu

J. (2017). Lecture 15: Wireless Security. In CS 4404: Computer and Network Security Courseware. Worcester Polytechnic Institute (WPI). The lecture notes define an Evil Twin as a "fraudulent AP that appears to be legitimate but is set up to eavesdrop on wireless communications." It explicitly states the evil twin uses the same SSID as a legitimate AP.