Evil Twin Wi-Fi

What Is Evil Twin Wi-Fi?

A stranger can broadcast a Wi-Fi network named after the venue you are in, leave it open, and your device cannot tell it from the real one. Anything you sign into then crosses a connection they control. You will watch a lookalike access point go up from a nearby table, get caught signing into it, confirm the real network name from the venue instead of the list, and switch to your phone hotspot to change the exposed password.

What You'll Learn in Evil Twin Wi-Fi

• Recognize that a Wi-Fi network name is not proof of who runs the access point behind it.
• Explain how an open lookalike network lets an attacker sit between you and the sites you use.
• Confirm a genuine network name out of band, from the venue, rather than the Wi-Fi list.
• Tether to a phone hotspot for anything you sign in to when a network cannot be trusted.

Evil Twin Wi-Fi — Training Steps

1. The name on the wall

   Bob is at Wrenloft Coffee too, one table over. He does not need to break anything. He starts by listing the Wi-Fi networks in range, because the one he wants to copy is broadcasting its name to everyone.

2. The script that clones it

   Bob opens the small script that stands up his own access point. Before he runs it, look at what it is set to broadcast.

3. Two lines do the work

   Two lines are all that matter. One sets the network name to a near-copy of the cafe's. The other leaves it open, with no password, so anyone joins with a single tap.

4. Bring the twin up

   Bob runs the script. His access point comes up broadcasting the cloned name, from his own laptop, louder than the real one.

5. Getting online

   Alice finds a table at Wrenloft Coffee and opens her laptop to start work. First she needs Wi-Fi. Her receipt from the counter is on the table, with the guest network printed at the bottom.

6. Two networks, one name

   The network list has two entries that read like the cafe. They look the same at a glance. Look closely at each before choosing.

7. Join the strong one

   The open network has the strongest signal and needs no password. The real one would mean typing the password off her receipt. Alice joins the open one, the way most people would.

8. Open the work portal

   Online now, Alice opens the Ostmere portal to sign in and start her day.

9. Sign in to work

   Alice signs in to the portal. It is the Ostmere sign-in page she uses every day, but it came through Bob's access point, and he kept it on plain HTTP. The address bar reads http with an open lock, not https. The portal normally switches every visitor to HTTPS. On a network Bob controls, he answers her first unencrypted request himself and never lets that switch happen, so the form posts unencrypted and passes through his machine readable. The http badge in the address bar was the only sign on her screen.

10. The session lands

    Back on his laptop, Bob reads what his access point captured. A client joined and signed in.