Ok, not MY evil twin, but I've been you've fallen for the evil twin attack. Evil twin attacks are pretty hard to avoid unless you are really skilled at identifying evil twin wireless access points. An evil twin access point looks just like the real one to wireless users. It has the same SSID as the real SSID so it's hard to tell which one is right.
Say you are at an airport and see FREE AIRPORT WIFI in your list of available wireless networks. You go ask an airport employee "Hey nice airport employee what is the name of your wifi?" and they respond "FREE AIRPORT WIFI". So that means you can connect to it, start using and you are safe, right? Wrong. It may be an evil twin. This happens a LOT at coffee shops and other free wifi places.
Some folks think they are really smart and can tell which one is the correct one. They see one has 5 bars and the other has 4 bars and assume the one with 5 bars must be the correct one. Hate to be a bubble buster, but that doesn't account for access point placement. The real one may be the one with the weaker signal because it is properly secured in a closet.
If you connect to the wrong evil twin, it only takes them 30 seconds to steal whatever information you transmit. Before you are done sending your emails, they have your password and can access everything you have in your emails.
How can you avoid the evil twin attack? Don't use free, unecyrpted wifi. Instead make a hotspot on your phone and connect to it or carry a MIFI with you. Think about that MIFI subscription or the extra data on your phone as insurance against identity theft. Work-provided wifi is safe as long as it isn't using WEP encryption. WPA2, WPA2-PSK and WPA2-ENT are the current encryption methods recommended these days. So never ever use WEP. Ever.
And stay away from the evil twin.
No comments:
Post a Comment