Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security analyst reviews Wireless Intrusion Detection System (WIDS) logs after users report sudden drops in wireless network connectivity followed by requests to re-enter network credentials. The logs show a rapid burst of IEEE 802.11 broadcast deauthentication frames sent from MAC address 00:11:22:33:44:55, followed immediately by client devices associating with a nearby access point displaying MAC address 00:11:22:33:44:99 that advertises the exact same SSID. Which of the following attack types is most consistent with these technical indicators?

  1. Evil Twin attackAnswer
  2. B
    Radio Frequency (RF) Jamming
  3. C
    Initialization Vector (IV) replay attack
  4. D
    WPS PIN brute-force attack

Answer

An Evil Twin attack is indicated by spoofed 802.11 deauthentication frames used to force clients off the legitimate network, followed by client auto-reconnection to an unauthorized rogue access point operating under the same SSID.
An Evil Twin attack involves setting up an unauthorized wireless access point configured with the same SSID as a legitimate network. Attackers frequently transmit 802.11 deauthentication frames to disconnect legitimate users from their valid APs, forcing client devices to automatically reconnect to the attacker's stronger rogue AP (indicated by the differing BSSID MAC address 00:11:22:33:44:99).

Step-by-Step Solution

1
Analyze the observed frame types in the log dump.
Identified IEEE 802.11 deauthentication management frames sent to the broadcast address.
Deauthentication frames disconnect active wireless clients from their current access point.
2
Examine client behavior and BSSID changes following disconnection.
Clients re-associated with a new MAC address (00:11:22:33:44:99) while retaining the original corporate SSID.
Attackers deploy rogue access points with stronger signal strength or identical SSIDs to entice disconnected clients.
3
Correlate indicators with wireless attack profiles.
The combined pattern confirms an Evil Twin attack aimed at harvesting credentials via a rogue AP.
Forced disassociation followed by rogue SSID spoofing is the primary indicator of an Evil Twin deployment.

Key Concept

Evil Twin and Wireless Deauthentication Indicators
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic