4.2 Summarize various types of attacks and their impact
Network Attacks
📘CompTIA Network+ (N10-009)
1. Definition
An Evil Twin attack is a type of wireless network attack where a hacker sets up a fake Wi-Fi access point (AP) that looks identical to a legitimate one. The goal is to trick users into connecting to it instead of the real network.
Once a user connects to the fake access point, the attacker can intercept data, steal credentials, or launch further attacks.
2. How it Works
- Set Up Fake AP:
- The attacker creates a Wi-Fi access point with the same name (SSID) as a legitimate network.
- Often, it uses stronger signal strength so that devices automatically prefer it over the real AP.
- Device Connection:
- Users unknowingly connect to this fake AP.
- Devices think it’s safe because the network name looks familiar.
- Data Interception:
- Once connected, all network traffic passes through the attacker’s device.
- This allows the attacker to capture usernames, passwords, and sensitive information.
- They can also redirect users to fake websites for phishing attacks.
3. Why It’s Dangerous
- Steals sensitive information such as email credentials, VPN logins, and corporate data.
- Can be used to inject malware into connected devices.
- Difficult for users to detect because the network looks exactly like the legitimate one.
4. Methods Used
- SSID Spoofing: Copying the name of a trusted Wi-Fi network.
- Rogue Access Point Setup: Using devices like laptops or portable routers to broadcast the fake Wi-Fi.
- Deauthentication Attacks: Forcing devices off the legitimate network to push them to connect to the Evil Twin.
5. How to Detect an Evil Twin
- Check the network properties:
- Verify MAC address of the AP. Legitimate networks usually have known, registered MAC addresses.
- Use security tools:
- Wireless Intrusion Detection Systems (WIDS) can identify multiple APs with the same SSID.
- Certificate warnings:
- HTTPS or VPN may alert if the connection is not secure.
6. How to Prevent an Evil Twin Attack
- Use WPA3 or WPA2-Enterprise:
- Strong encryption and authentication reduce the chance of connecting to a fake AP.
- Certificate-based Authentication:
- VPNs and enterprise Wi-Fi should use certificates instead of just passwords.
- Wireless Intrusion Prevention Systems (WIPS):
- Monitors Wi-Fi networks and blocks rogue APs automatically.
- User Education:
- Teach users not to connect to unknown Wi-Fi networks, even if the SSID looks familiar.
7. Exam Tips
- Key terms to remember: Fake AP, SSID spoofing, deauthentication attack, credential theft, rogue access point.
- Understand how the attack is executed and the risks.
- Be able to identify detection and prevention methods, as CompTIA often asks scenario-based questions.
Example Question Style (CompTIA Exam):
A user connects to a Wi-Fi network named “CompanyGuest” and unknowingly exposes their login credentials. Which type of attack is this?
Answer: Evil Twin Attack.
✅ Summary:
An Evil Twin is a malicious Wi-Fi network that mimics a legitimate one to steal information or compromise devices. Detection involves verifying network properties and using intrusion detection systems, while prevention includes strong encryption, certificate-based authentication, and user awareness.
