Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst is investigating reports from branch office employees who experienced sudden wireless disconnections followed by prompts to re-enter corporate network credentials on an unfamiliar browser landing page. Wireshark captures and wireless intrusion prevention system (WIPS) logs collected during the incident reveal specific anomalous indicators. Which TWO of the following technical indicators confirm that an Evil Twin attack was executed against the wireless network?

  1. The broadcasting access point advertises the legitimate corporate SSID but uses an unapproved BSSID MAC address with a vendor prefix that does not match enterprise hardware inventoryAnswer
  2. A sudden spike in 802.11 management frames containing deauthentication subtypes sent from a spoofed access point MAC address to force client re-associationAnswer
  3. C
    Sustained high radio frequency noise floor and wideband signal degradation across all 2.4 GHz channels causing high packet error rates
  4. D
    Multiple DHCP DECLINE messages issued by clients following MAC address randomization upon connecting to the primary VLAN switch port

Answer

The correct indicators are the rogue broadcasting access point exhibiting an unapproved BSSID MAC address with an unauthorized hardware vendor prefix while broadcasting the corporate SSID, and a sudden spike in spoofed 802.11 deauthentication management frames used to disconnect clients and force re-association.
An Evil Twin attack involves deploying a unauthorized rogue access point configured with the target network's exact SSID. Technical indicators verifying this include observing an unauthorized BSSID (MAC address) that does not match enterprise asset registries, along with a stream of 802.11 deauthentication management frames crafted to disconnect target clients from the legitimate access point and push them onto the rogue device.

Step-by-Step Solution

1
Analyze the scenario attack vector
The scenario describes users being disconnected and prompted for corporate credentials on an unexpected landing page, which aligns with an Evil Twin wireless credential harvesting attack.
Evil Twin attacks rely on creating a duplicate wireless network that mimics a legitimate SSID to deceive clients into connecting and submitting sensitive information.
2
Evaluate wireless indicators for Evil Twin confirmation
An unauthorized BSSID (MAC address) broadcasting the legitimate corporate SSID identifies rogue hardware. Spoofed 802.11 deauthentication frames explain the sudden client disconnections preceding connection to the rogue AP.
Combining deauthentication frame floods with identical SSID broadcasting from unauthorized BSSID hardware is the classic mechanism used by attackers to operationalize an Evil Twin.
3
Differentiate from non-relevant wireless and network attack indicators
Channel-wide RF noise floor increases indicate RF jamming (denial of service), while DHCP DECLINE messages point to IP address allocation conflicts, neither of which confirms an Evil Twin scenario.
Accurate threat diagnosis requires distinguishing between availability disruption attacks (jamming) and impersonation/credential theft attacks (Evil Twin).

Key Concept

Evil Twin Attack Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic