Wireless Attacks: Evil Twin, Deauth, and Rogue AP

Wireless networks are particularly vulnerable because the signal cannot be contained to a physical boundary. Attackers can operate from a car in a parking lot, a neighboring office, or even use long-range directional antennas from hundreds of meters away. The primary wireless attack categories covered on Security+ are evil twin attacks, deauthentication attacks, and rogue access points. Each exploits different weaknesses in how Wi-Fi clients discover, connect to, and trust access points.

A rogue access point is an unauthorized wireless AP connected to a corporate network — either installed by an attacker who gained physical access or set up by a well-intentioned employee for convenience. A rogue AP can bypass the organization's wired security controls by giving attackers or malware a wireless entry point into the internal network. Wireless intrusion detection systems (WIDS) and regular RF surveys detect rogue APs by correlating MAC addresses seen over the air with the authorized AP inventory.

An evil twin is a rogue AP that impersonates a legitimate access point by broadcasting the same SSID (network name). Clients configured to auto-connect to known SSIDs may connect to the evil twin instead of the legitimate AP, especially if the attacker's signal is stronger. Once connected, the attacker can perform MitM attacks, capture credentials over HTTP, and intercept unencrypted traffic. Evil twin attacks are especially effective against public Wi-Fi networks where clients cannot distinguish the real AP from a fake one.

The 802.11 standard includes management frames for controlling connections, including deauthentication frames that tell a client it has been disconnected from the AP. Without 802.11w (Protected Management Frames), these frames are unauthenticated and anyone can forge them. A deauthentication attack sends spoofed deauth frames to a client, forcing it to disconnect and reconnect. Attackers use deauth attacks to force clients to reveal their 4-way handshake (for WPA2 cracking) or to redirect clients to an evil twin AP with a stronger signal.

Many public Wi-Fi networks use captive portals — web pages that require acceptance of terms or credential entry before granting internet access. Attackers can deploy a rogue AP that redirects clients to a fake captive portal, harvesting credentials or installing malware. Captive portals typically use HTTP (not HTTPS), making them susceptible to MitM. WPA3's OWE (Opportunistic Wireless Encryption) addresses open networks by providing unauthenticated encryption, but captive portals are still common and dangerous. Users should use VPNs on any captive-portal network.

Enterprises detect evil twin attacks using Wireless Intrusion Detection Systems (WIDS) that monitor the RF environment continuously. WIDS sensors identify APs broadcasting the corporate SSID with a BSSID not in the approved list, or detect clients connecting to unauthorized APs. Correlation with wired network data helps confirm whether a suspicious AP is actually connected to the internal network (rogue) or is purely external (evil twin). Enterprise WLAN controllers (Cisco, Aruba, Juniper) often have built-in WIDS capabilities that automate this detection.

RF jamming is the deliberate transmission of radio frequency signals on the same channel as a target network to cause interference and render it unusable — effectively a wireless DoS attack. Jamming may be illegal in many jurisdictions. Unintentional interference from microwave ovens, baby monitors, and neighboring networks on the same channel is more common and can cause similar symptoms. Organizations experiencing persistent interference should conduct RF spectrum analysis to distinguish jamming from interference and move to clear channels or the 5 GHz / 6 GHz bands where available.

WPA2-Enterprise with 802.1X prevents evil twin credential capture because clients authenticate to a RADIUS server using EAP (Extensible Authentication Protocol). The client should validate the RADIUS server's TLS certificate before sending credentials. If clients are not configured to validate the server certificate and pin the expected CA, an evil twin can run a rogue RADIUS server and capture EAP credentials. Certificate validation must be enforced through MDM profiles on corporate devices to prevent this downgrade.

The 802.11 standard defines two distinct management frame types used to terminate connections. A deauthentication frame tears down the authentication state, while a disassociation frame removes the client from the AP's association table but preserves authentication. Both can be forged without 802.11w. Security+ candidates should understand that both frame types are valid attack vectors for forcing reconnection. The 802.11w amendment (incorporated into WPA2 as optional, mandatory in WPA3) adds a Message Integrity Code (MIC) to these frames, preventing forgery.

Technical wireless security controls must be complemented by physical security. An AP installed in an accessible area can be factory-reset to default settings, bypassing all security configurations. Best practices include mounting APs in secured or elevated positions, using tamper-evident screws or AP security cages, disabling the reset button via software where possible, and including APs in asset inventory audits. PoE switches that power APs should also be in locked wiring closets so that an attacker cannot simply unplug a legitimate AP and connect their own device.

To defend against the full range of wireless attacks: enable WPA3 or WPA2-Enterprise to prevent PSK cracking; enforce PMF (802.11w) to block deauthentication attacks; deploy a WIDS to detect evil twins and rogue APs; validate RADIUS certificates to prevent evil twin RADIUS capture; disable WPS to eliminate PIN brute-force; and segment wireless networks by role (corporate, guest, IoT) using separate SSIDs mapped to different VLANs. Combine these controls for a defense-in-depth wireless posture.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: a rogue AP is an unauthorized access point on the corporate network that bypasses wired security controls, an evil twin impersonates a legitimate SSID to intercept client traffic via MitM, and deauthentication attacks forge 802.11 management frames to disconnect clients — a threat mitigated by Protected Management Frames (802.11w) required by WPA3. Next up we explore enterprise wireless with 802.1X and RADIUS.