CHAPTER 2 - Wireless – Client Attacks

Abstract

The hotspots are designed around a business model rather than a technical model with a purpose to draw in and get customers to stay long. Most public hotspots, be they free or for pay, generally are not encrypted. As an attacker, having access points unencrypted gives an extreme advantage. The user has no way of actually verifying that the access point is what it says it is, since there's no shared secret. A network's Service Set Identifier (SSID) is merely for organizational purposes; it is not an authentication method. Many wireless cards on the market are capable of operating in “master” mode, which allows them to operate as an access point. This fact, along with people's trusting nature, allowed early attackers to impersonate access points easily. An attacker would set up a laptop or wireless device in master mode and become an access point. The SSID would be set to either impersonate an existing access point or appear to be a legitimate access point where there was none. The tools such as Karma are capable of impersonating any open access point. It is very difficult to defend against the possibility of connecting to a fake access point. The best defense is to limit what can occur should that situation happen.