METDS - A Self-contained, Context-Based Detection System for Evil Twin Access Points

Abstract

Mobile Evil Twin attacks stem from the missing authentication of open WiFi access points. Attackers can trick users into connecting to their malicious networks and thereby gain the capability to mount further attacks. Although some recognition and prevention techniques have been proposed, they have been impractical and thus have not seen any adoption. To quantify the scale of the threat of evil twin attacks we performed a field study with 92 participants to collect their WiFi usage patterns. With this data we show how many of our participants are potentially open to the evil twin attack. We also used the data to develop and optimize a context-based recognition algorithm, that can help mitigate such attacks. While it cannot prevent the attacks entirely it gives users the chance to detect them, raises the amount of effort for the attacker to execute such attacks and also significantly reduces the amount of vulnerable users which can be targeted by a single attack. Using simulations on real-world data, we evaluate our proposed recognition system and measure the impact on both users and attackers. Unlike most other approaches to counter evil twin attacks our system can be deployed autonomously and does not require any infrastructure changes and offers the full benefit of the system to early adopters.

Appendices

A METDS Sample Configuration

In Table 1 the most important configuration parameters for our sample configuration are shown. These values have been used for the mentioned simulations from Sect. 6. As one can see the algorithm only reacts to connections to unencrypted networks. For future research other encryption schemes can be enabled to analyze similar attacks on encrypted wireless networks. The BSSID thresholds define, how often an access point needs to be detected or missed, until it is added to or removed from the according access point profile. The maximum distance threshold defines how close to each other two locations have to be at least, until the algorithm regards them as equal. The length of the learning period of an access point is defined by the next parameter. Within this period the algorithm learns the access points environment and adapts itself. The current value represents one week. The last two parameter enable the Jaccard index comparison of network environments and set the threshold to 0.7 as discussed in Sect. 5.

Table 1. Configuration parameters of the METDS

Fig. 5.

Amount of warnings a user would receive per 100 connections. In the first diagram only BSSID warning are shown, in the second all remaining warnings have been plotted.

B User Perspective

Figure 5 shows the user’s perspective. Both diagrams show the number of warnings each user (along the Y-axis) sees on average per 100 connections. In the first graph only warning messages for unknown BSSIDs are shown. As stated above we believe these warnings are necessary since they definitively present an unknown access point and a connection should not be established without the users consent. The second graph only shows the false-positives at our current configuration of METDS. Also as stated above the number of warnings shown here is configurable and is down to user preferences.