Wi-Fi users warned of fake base station threat

Wi-Fi hotspot users should be on their guard for malicious wireless access points that steal data.

Researchers at Cranfield University, are claiming "Evil Twin" hotspots, networks set up by hackers to resemble legitimate hotspots, present the "latest security threat" to Web users.

The hacker's wireless network jams the connection to the legitimate network by sending a stronger signal within close proximity to the wireless client and turns itself into an "Evil Twin".

Dr Phil Nobles, wireless internet and cybercrime academic, explained: "Evil twin hotspots present a hidden danger for web users. Because wireless networks are based on radio signals they can be easily detected by unauthorised users tuning into the same frequency."

Once an unknowing user has connected to an evil twin, a hacker can intercept transmitted data. Users are invited to log into the evil twin with bogus login prompts and can be lured into passing sensitive data such as user names and passwords.

Cranfield's head of information systems, professor Brian Collins, said: "Users can also protect themselves by ensuring that their Wi-Fi device has its security measures activated because in the vast majority of cases base stations taken out of the box direct from the manufacturer are automatically configured in the least secure mode possible."

Cranfield University believes this is a new area of cyber crime where more research is required. However, in October 2002, security company ISS published details of base-station cloning, otherwise known as an evil twin traffic interception. If true, this would mean that the idea is almost two-and-a-half years' old.

In its 2002 document, ISS defines the technique as:

"BaseStation Clone (Evil Twin) intercept traffic - An attacker can trick legitimate wireless clients to connect to the attacker's honeypot network by placing an unauthorized base station with a stronger signal within close proximity of the wireless clients that mimic a legitimate base station. This may cause unaware users to attempt to log into the attacker's honeypot servers. With false login prompts, the user unknowingly can give away sensitive data like passwords."