Question 171 · 856 in bank
A security administrator is analyzing the corporate wireless network. The network only has two access points running on channels 1 and 11. While using airodump-ng, the administrator notices other access points are running with the same corporate ESSID on all available channels and with the same BSSID of one of the legitimate access points. Which of the following attacks is happening on the corporate network?
Show answer
Answer: B
Explanation
In an evil twin attack, an attacker sets up a rogue wireless access point that impersonates a legitimate access point (the corporate ESSID in this case) with the same Service Set Identifier (SSID) and Basic Service Set Identifier (BSSID). The rogue access point is typically set to use the same or similar channel as the legitimate access point to further deceive users and force them to connect to the rogue network. The goal of the evil twin attack is to trick users into connecting to the rogue access point, which allows the attacker to intercept sensitive information, perform man-in-the-middle attacks, and potentially gain unauthorized access to the network. In the scenario described, the presence of access points with the same ESSID, BSSID, and running on all available channels indicates that an evil twin attack is being carried out on the corporate wireless network. The security administrator should take immediate action to identify and remove the rogue access point to prevent further security risks.
Source: Adapted from community discussion — ApplebeesWaiter1122