Rogue access points, evil twin networks and deauthentication attacks are all examples of wireless intrusions, which occur when unauthorized devices or attackers most commonly use your Wi-Fi airspace. Defend in layers: On wired ports implement 802.1X, on wireless ports use a Protected Management Frames (PMF) setting of Required, and install a wireless intrusion detection or prevention system (WIDS or WIPS) to find and thwart intrusions.
The Three Threats to Know
The need-to-know on the Three Threats.
Two threats that are often confused. An unauthorized, intentional point physically connected through you that is attached to your wired network is rogue and can bypass your firewall, intrusion detection and network access controls. An evil twin is not that: It’s not attacking the network, it’s attacking the user and it’s not connected to your wired infrastructure in any way.
One useful security expert has explained how evil twins are put into practice: the attacker exploits strong signal and employees’ laptops connect to the attacker’s access point unaware of your signal’s presence. The deauthentication is one of the techniques that are used to force people to join such a network. Attacks 802.11 management frames: attacker spoofs the mac of the access point or client, and sends deauthentication fake frames. Overall, such attacks can discontinue cameras, IoT devices and point-of-sale terminals, not to mention once again directing users to an evil twin.
Threat Triage Table
Original Comparison
The following table offers a summary of the three threats as presented by published guides to security.
| Threat | What it is | Main risk | Typical response |
| Very low danger, though a 30% chance exists that the GMAW becomes more readily accessible. | |||
| Rogue access point | (Unauthorized AP connected to your wired network) | Bypass firewalls and access controls | Locate the rogue AP, trace the switch port and close the port |
| Evil twin” | Fake AP pretending to be yours, not plugged into your network | Users connect ingest traffic | Detect by BSSID and SSID mismatch and contain and alert |
| Deauthentication attack | Spoofed management frames that kick clients off | Disruption and pushing users to a fake AP | Requires monitor for floods, and PMF |
How a WIDS Works
The operation of a WIDS is fairly straightforward.
A WIDS or WIPS will utilize sensors which listen to the radio environment and compare what they detect with an approved list of access points. One of the technical guides explains that the BSSID (the MAC address of the radio interface of an indoor access point) is a good way to distinguish among legitimate APs and impersonators.
Response is the difference between the two terms:
- WIDS discovers and warns.
- WIPS can also react, e.g. block a rogue device.
For rogue access points, according to one of the guides, the safest approach is to use “port suppression” to correlate a rogue AP’s wireless MAC address to a physical switch port. For evil twins, which aren’t on your wired network, some systems use wireless containment by sending targeted deauthentication frames. However, in certain locations, Containment may be legally unfeasible since interfering or disrupting other networks may violate local regulations; consult the regulations and the vendor’s recommendations before turning on Containment.
PMF Changes the Picture
Deauthentication attacks against IEEE 802.11w supported clients will be more difficult due to the capability to use IEEE 802.11w Protected Management Frames. WPA3 (required) is PMF – it requires management frames such as deauthentication and disassociation to be encrypted before being transmitted or received. That is simply to set PMF to Required, NOT Capable or Optional, for SSIDs where all of the clients support PMF.
Here is something that costs a little but you will need to understand the trade-off. Because traditional WIPS containment is based on deauthentication frames, PMF protects, it can reduce the level of WIPS contention against some targets. One guide’s discussion was that even with PMF running you should also consider using of WIDS or WIPS for business areas or high risk areas. Another also points out that PMF does not prevent an attacker from creating an evil twin, rather only complicates the deauthentication phase of attack.
Prevent-Detect-Respond Layers
The Prevent-Detect-Respond Layers (Original Framework) was a Playbook initiative that was created to address the various layers of detection and response.
The defence-organising system as referred to in an editorial. It’s not a standard for the industry.
| Layer | Controls | Purpose |
| Prevent | 802.1X network access control on wired edge ports; WPA3 or WPA2 with PMF Required; strong enterprise authentication | Stop rogue devices and spoofed management frames |
| Find rogue APs and evil twins quickly; detect WIDS or WIPS sensors; alerts for unknown APs and BSSIDs; use an approved list of APs and BSSIDs for alerts. | ||
| Respond | Port shutdown; incident procedure; notification to users; Legal review of containment | Limit damage and document incident |
Some sources describe 802.1X as the cheapest method to prevent rogue APs from even being plugged in, as no network access will be granted to a plugged-in device that is not authorized to connect to the network.
Compliance Note
One guide states that PCI DSS mandates testing for wireless access points, including detection of all unauthorized (as well as authorized) access points, quarterly. With the updates to PCI DSS, don’t take the PCI DSS citation on its own, but double check the requirement numbers and PCI DSS versions in use. While compliance does not equal security, it provides you with a plan on when to do it.
Wireless Defense Checklist
A checklist of items that might be considered when involving a wireless test.
- Created a list of all approved entry points and SSIDs
- Record a BSSID each time it is approved
- Turned on 802.1X on wired edge switches:
- When clients do support it, set PMF to Required
- Installed WIDS or WIPS sensor or turned on built-in sensor on my controller
- Create alarms for unknown AP and SSID impersonation
- Implemented response procedure for rogue APs/evil twins
- Consulted local ordinance prior to deployment of wireless containment
- Regular wireless scans that are scheduled.
- Self-education of the staff to report any unexpected prompts in wi-fi.
Guest Post Angles
The following topics are appropriate for network security/IT administration publications:
- When it comes to APs, there are two threats, and two responses: Rogue AP and evil twin.
- What PMF and WPA3 prevent/Don’t prevent.
- Wireless security for small offices: a minimum setup.
