Wi-fi users warned to beware of evil twins

From Times Online
January 20, 2005
Wi-fi users warned to beware of evil twins
By Holden Frith, Times Online

Wireless internet users were warned today that they could be at risk from “evil twins”, bogus internet connections set up by fraudsters to mimic the real thing.

People connecting to the internet using wireless technology, known as wi-fi, may think that they have logged in to a bona fide internet provider and then unknowingly submit personal details such as bank passwords and credit card numbers to criminals.

Firewalls and other internet security devices offer little protection as the user has, in effect, voluntarily logged on to the fraudster's network.

“Users need to be wary of not using their wi-fi enabled laptops or other portable devices in order to conduct financial transactions or anything that is of a sensitive personal nature,” said Professor Brian Collins from Cranfield University, a former chief scientist at GCHQ, the Government's electronic eavesdropping station.

Instead of using cables, wi-fi devices link to the internet by sending radio waves to a nearby “hotspot” which relays data to the internet service provider. This makes them more vulnerable to attack, as anyone with suitable equipment can locate a hotspot and take its place, substituting their own “evil twin”.

Dr Phil Nobles, a wireless internet and cybercrime expert at Cranfield University, near Swindon, said that the evil twin hotspots present a hidden danger for web users.

“In essence, users think they've logged on to a wireless hotspot connection when in fact they've been tricked to connect to the attacker's unauthorised base station,” he said. “The latter jams the connection to a legitimate base station by sending a stronger signal within close proximity to the wireless client.

“Cybercriminals don't have to be that clever to carry out such an attack. Because wireless networks are based on radio signals they can be easily detected by unauthorised users tuning into the same frequency.”

Unwitting web users are invited to log into the attacker's server with bogus login prompts that may masquerade as a bank or email login page, tempting them to give away sensitive information such as user names and passwords.

Users may be unaware that they have been duped until well after the incident has occurred, allowing fraudsters time to make use of the stolen details.

Dr Nobles spelled out the warning today at a wireless crime event held at the Dana Centre, the Science Museum's forum for discussing controversial science, in London.

Lisa Jamieson, head of programmes at the Dana Centre, said, “Half of all business wireless networks in this country have inadequate security controls in place, making their information vulnerable to attack.”