Wireless Networks: 5 Checks

This rule inspects a single wireless access point. This rule fails when more than one transmitter has been seen beaconing this access point's SSID and BSSID.

A BSSID is a radio's hardware address, so exactly one transmitter should ever beacon a given network name and hardware address pair. The competing beacons are recorded on the access point as each endpoint's wireless scan is collected, so the check reads only this object. The transmitters are told apart by the channel they beacon on — one radio beacons on one channel — so an attacker sitting on the exact channel of the radio they are cloning is not separable this way and is not detected here.

The rule fails on the recorded detection, not on whether the impostor is transmitting at this moment. An access point is visible only to endpoints within radio range, so an impostor that has gone quiet, moved, or is simply out of range of whichever endpoint scanned most recently is not evidence the attack did not happen. The finding reports separately whether the impostor is still audible. The detection clears when it ages out of your organization's data retention window.

Rationale: An attacker who clones both the SSID and the BSSID of a legitimate access point is running an evil twin. They de-authenticate the legitimate access point's clients with forged management frames, then out-shout it with a stronger signal so those clients re-associate to the attacker's radio on the way back. The attacker then sits between the client and the network.

Impact: Traffic from every device drawn onto the attacker's radio passes through the attacker, who can read anything unencrypted, inject content, harvest credentials through a fake captive portal, and pivot into the network from there. Two radios sharing one identity also wrecks the air on its own: client frames collide, and devices roam back and forth between the two, losing connectivity.

This rule inspects a wireless (Wi-Fi) network that has been seen by an endpoint's WLAN interface. This rule fails when the network advertises an insecure 802.11 authentication algorithm (such as open, WEP, dynamic WEP, or a legacy WPA mode) or an insecure cipher (such as WEP or TKIP), as reported by the platform's insecureAuthAlgo / insecureCipherAlgo classification.

Rationale: Open and WEP/TKIP-based networks provide little or no confidentiality and are trivial to intercept or join. Their presence near managed endpoints is a risk, and an unexpected insecure SSID can also indicate a rogue or evil-twin access point.

Impact: Endpoints that associate with an insecure network expose their traffic to interception and manipulation on the local RF segment.

This rule finds endpoints connected to a wireless network on which an access point flagged as a possible evil twin has been seen in the last 30 days: a hardware address advertised under more than one network name. This rule fails for each such endpoint.

Rationale: An evil twin on the network an endpoint uses can lure it, or other devices, onto attacker equipment at the next reconnect or roam, even if its current access point is legitimate.

Impact: Once joined, the attacker can intercept, modify, or redirect traffic and harvest credentials.

This rule inspects an endpoint WLAN interface's active connection to a wireless network. This rule fails when the connection's authentication algorithm is insecure (open, WEP, dynamic WEP, or a legacy WPA mode) or its cipher is insecure (WEP or TKIP).

Rationale: When an endpoint is actively connected over open or WEP/TKIP-based Wi-Fi, its network traffic has little or no cryptographic protection on the wireless link and can be intercepted or altered by anyone in RF range.

Impact: Credentials, session tokens, and sensitive data traversing the connection are exposed to eavesdropping and adversary-in-the-middle attacks.

This rule finds endpoints whose wireless interface is connected to an access point flagged as a possible evil twin: a hardware address advertised under more than one network name. This rule fails for each such endpoint.

Rationale: An evil twin impersonates a trusted wireless network so nearby devices join it instead. An endpoint connected to one sends its traffic through equipment the attacker controls.

Impact: The attacker can intercept, modify, or redirect the endpoint's traffic, harvest credentials from captive portals or cleartext protocols, and serve malicious content.