Your laptop remembers the Wi-Fi networks it has joined before, and it will happily join one with the same name again. Evil Twin (T1557.004) abuses that trust. MITRE lists it under Credential Access and Collection, and the platform is Network Devices, because the weak point is the wireless access layer.
How attackers use it
MITRE describes adversaries hosting seemingly genuine Wi-Fi access points. By reusing the SSID of a legitimate network, a fraudulent access point can trick devices or users into connecting. An adversary may offer a stronger signal, or block access to the real access points, to push victims toward the fake one. MITRE names the Wi-Fi Pineapple, a network security auditing and penetration testing tool, as one device used for ease and range.
Devices also broadcast probe requests for networks on their Preferred Network Lists. A malicious access point can answer a probe with the same SSID, and the device believes it found a known network.
Once connected, a user may land on a fake login page or captive portal that captures credentials. The adversary may also monitor activity, manipulate data, or use custom certificates to try to intercept HTTPS traffic. MITRE notes that places with lots of public Wi-Fi, such as airports, coffee shops and libraries, are likely targets.
How to detect it
MITRE's detection strategy looks for rogue access points broadcasting the same SSID as a legitimate one, with signals such as stronger signal strength, unexpected MAC or BSSID values, or inconsistent encryption settings. It also suggests correlating authentication attempts, captive portal redirections and anomalous traffic flows through unauthorized access points.
In practice that means keeping an inventory of your own access points (SSID, BSSID, channel, security mode) so a lookalike stands out.
How to reduce the risk
MITRE lists two mitigations:
- Wireless intrusion prevention. A WIPS can identify traffic patterns that suggest adversary-in-the-middle activity and scan for evil twins and rogue access points.
- User training. Teach people to be suspicious of access points marked Open or Unsecure, and of certificate errors. A certificate error can mean the certificate presented does not match the one the application expects.
Quick check
Why is a certificate error on public Wi-Fi worth taking seriously?
MITRE notes that adversaries may use custom certificates to try to intercept HTTPS traffic. A mismatch between the presented certificate and the expected one is exactly what that looks like.
