Reflective Literature Review on Detection and Prevention of Evil Twin Attack

This literature review provides an overview of the concept of Evil Twin Attack, its risks, and the techniques for detection and prevention. The report summarizes previously published literature and identifies research and professional aims. The report highlights the need to analyze the techniques by which these attacks can be easily detected and prevented. The risks and the risk mitigation techniques of the Evil Twin attack are discussed in the literature review section of the report. The literature review section further explains the detection and the prevention technique of Evil Twin Attacks.

Running head: LEVEL 2 PROJECT
Level 2 Project: Detection and Prevention of Evil Twin Attack
Name of the Student
Name of the University
Author Note

1
LEVEL 2 PROJECT
Table of Contents
1. Introduction......................................................................................................................2
2. Research Aims.................................................................................................................2
3. Professional Aims............................................................................................................3
4. Literature Review............................................................................................................3
5. Conclusion.......................................................................................................................6
References............................................................................................................................7

2
LEVEL 2 PROJECT
Reflective Literature Review on Detection and Prevention of Evil Twin Attack
1. Introduction
Evil Twin attack is a false Wi-Fi access point, which seems to be legitimate. This type of
se up is generally made with an aim to eavesdrop and gather information on wireless
communication. It results of evil twin attack can be described as phishing scam as well. Evil twin
is therefore considered as a rogue or false access point that generally masquerades as a legitimate
access point of WI-FI (Gupta and Jha 2015). This is generally set up by the attackers with an aim
of gathering the personal and corporate confidential information without the knowledge of the
end user. In order to initiate evil twin attack, an attacker generally sets the service identifier
number much similar to the access point of a local hotspot and the wireless network of an
organization. The hacker then disconnects the legitimate AP by disabling it. The disconnection is
done by directing a denial of service attack. This reflective literature survey report summarizes
different resources that provide a detailed overview of the Evil Twin Attack and the process of
detection and prevention of the same (Szongott, Henne and Smith 2012). The report highlights
the research and the professional aims associated with the research topic and summarises the
findings of previously published literature in this field (Cassola et al., 2013). The risks and the
risk mitigation techniques of the Evil Twin attack is discussed in the literature review section of
the report. The literature review section further explains the detection and the prevention
technique of Evil Twin Attacks.
2. Research Aims
The purpose or aim of the research is to analyze the concept and the process of Evil Twin
attack for understanding the risks involved with Evil Twin Attack. In order to prevent the loss of
confidential information as a result of the Evil Twin attacks, it is necessary to analyze the
techniques by which these attacks can be easily detected (Alotaibi and Elleithy 2016). This
research study therefore aims at analyzing the different techniques by which an evil twin attack
can be detected so that the risks associated with the Evil Twin Attack can be easily mitigated.
After detection of a possible evil twin attack, it is necessary to prevent the attacker in gaining
access to the Wireless network (Gupta and Jha 2015). Therefore, this research aims at identifying
the different techniques that can be applied against the Evil Twin Attack so that the attacker fails
to obtain the access to the confidential information stored in the wireless network on which the
attack is initiated.
The questions that this research study is expected to answer are as follows-
1. What is an Evil Twin Attack?
2. What are the Risks associated with an Evil Twin Attack?
3. What are the suitable techniques of detecting an evil twin attack?
4. What are the suitable and suggested prevention methods of Evil Twin Attack?
These research questions are identified on basis of the research aims that are discussed
previously. The literature review is performed with an intention of finding the answers of the
research questions that are identified.

3
LEVEL 2 PROJECT
3. Professional Aims
This research study will help me in increasing the professional knowledge and will
further help in gaining a clear understanding of the different security issues associated with the
wireless networks. I have conducted this research study with an aim of gaining a detailed
understanding of evil twin attacks, which will further help me in my professional carrier as well.
I have conducted this research study in order to gather new experiences and knowledge about the
different risk mitigation techniques, that will further help me to resolve this type of issues, if
arises in my professional carrier. Doing a detailed research on the topic of evil twin attacks will
make me accustomed with the different risk that I may face while working with the wireless
networks in my professional carrier as well (Noor and Hassan 2013). One of the major
profession aim for conducting this research is to improve by ability to manage the different
security issues associated with the wireless network by gaining a detailed understanding of the
different risks and identifying the various risk mitigation techniques.
However, in order to deliver this project, I will need to develop a good observation skill
to understand and identify the different risks associated with an evil twin attack. Furthermore, for
delivering the project in a scheduled time, I need to have a time management skill in order to
schedule the different project works. Furthermore, adaptability is a major skill that is required to
successfully deliver a project.
4. Literature Review
Nakhila et al. (2015), in their research paper, “User-side wi-fi evil twin attack detection
using ssl/tcp protocols”, described Evil Twin attack or ETA as certain rogue Wi-Fi access points
that often appears legitimate, but in reality, has been set up with an aim to eavesdrop a wireless
communication. The Wi-FI or 802.11 based wireless networks is generally adopted by different
organizations and are used by majority of the people in their daily work. The Evil Twin Attack is
generally planned and set up with an aim of stealing the information from these wireless network
or wireless access points. It is possible to plan and setup an evil twin attack as the major wireless
network has a lack of security protection and therefore, the Wi-Fi hotspots are more vulnerable
to the attack (Matos, Romao and Trezentos 2012). In order to initiate an evil twin attack, an
attacker generally configures a rogue AP instead of the legitimate and free wireless service.
Therefore, it can be said that an Evil Twin attacks are easy to initiate in the wireless networks
that has less protection or in a network that is not encrypted. Public Wi-FI is therefore more
prone to face an Evil Twin attack. However, a more sophisticated attack can put in danger, the
confidential data of the organization.
Figure 1: Representing the process of Evil Twin Attack

4
LEVEL 2 PROJECT
(Source: Nakhila et al. 2015)
Yang, Song and Gu (2012), in their paper “Active user-side evil twin access point
detection using statistical techniques” discussed that ith the increasing technological
advancements, the evil twin attacks are becoming extremely popular (). Different users can
therefore, access the public Wi-FI connection more easily. This is targeted by an attacker in
gaining an access to the confidential information that is being exchanged between users through
the wireless network. Evil Twin attacks are therefore termed as wireless version of Phishing
scams as well. This attack is therefore studied by different security researchers in order to easily
detect and prevent the cause of an evil twin attack.
Figure 2: Diagrammatic Representation of an Evil Twin Attack
(Source: Yang, Song and Gu 2012)
Researchers have found out that the attacks of evil twin are very easy to initiate since an
attacker can easily configure a laptop to make it act as a rogue access point. This access point
will be used to falsify the legitimate access point. This rogue access point then attacks the target
victim’s wireless connection by sending de associated frames, which in turn will force the
victims in changing their connection (Kolias et al. 2016). Once a victim changes his/her
connection to the rogue network, all the personal information of the Victim is accessed by the
attacker. Therefore, it becomes essential to detect and prevent the Evil Twin Attacks.
It is therefore, very clear that Evil twin attacks bring in certain risks, major one of which
being the privacy risk. The attacker quite easily gains the access to the private and personal
information of the victim who is using a compromised network. Therefore, it can be said that
there is threat and an imminent danger to the public as well as the users of private WLANs
because of Evil Twin attacks. Since Evil Twin is a phony Wireless Access point falsifying
legitimate access point, it can monitor the activities of the victim passively and can further
launch many other attack on the network, which is another major risk associated with Evil Twin.

5
LEVEL 2 PROJECT
Figure 3: Diagrammatic representation of compromised AP by Evil Twin
(Created by author)
Any victim who is using a compromised network is redirected to the fake web pages that
solicit the credit card number of the users, usernames and passwords. Furthermore, any request
by the users can return malicious responses from the local host through DNS spoofing. Evil Twin
attack can therefore be described as a menace of wireless network. Evil twin hotspot is becoming
a significant risk in the field of wireless communication and therefore the security experts are
raising the level of alerts in method of stealing the data of the user. This attack is mainly initiated
in a publicly accessible Wi-FI connection and therefore, the major risk is associated with the
publicly accessible wireless communication. The users should therefore limit the use of public
WI-Fi for carrying out with the confidential works or with communication that involves use of
confidential data. It is furthermore essential to evaluate the different techniques of detecting an
Evil Twin attack and the prevention methods that can be employed against such attacks.
The openness of the public Wi-Fi network is the main reason of its vulnerability to the
Evil Twin Access point attack. Furthermore, since the Evil Twin attack is very simple to launch,
there has been a considerable increase in the number of evil twin attack. Therefore, it becomes
essential to address the different techniques of for detection of rogue access point that will in turn
help in preventing such attacks. However, on evaluating the different techniques of detecting an
Evil Twin attack, it is found out that the solutions are designed for the infrastructure network
instead of the client devices. One such detection method is the monitoring of the packets at the
gateways and routers. This might be possible by installing extra customer devices in monitoring
the packets in the network gateways and the routers. Mustafa and Xu (2014), in their paper,
“Detecting evil twin access point attacks in wireless hotspots” discussed the different techniques
of detecting the access point of an evil twin, one of which is detection of the evil twin attack
without any infrastructure support. The detection technique is CETAD, which is designed
according to the idea of the ISP, IP address and the RTT value of the rackets that are travelling
through the two legitimate access points. The CETAD generally possess two phases, a phase for
secure data collection and the phase for detection of the attack. In this paper, the research is
based on android phones and an experiment is set up in order to determine whether the setup is
able to detect an evil twin attack. It yields a positive result. Other techniques of detecting and
evil twin attack include detection based of route option of the IP packet header, detection based
on the TCP connection (Nakhila et al. 2015). In this technique, the ETA is detected by making
use of a different gateway as compared to the gateway used by a legitimate Wi-Fi hotspot. This
type of detection technique is however, a light weight client side approach that was evaluated in
a real world. The experiment gives a positive result and therefore, use of a different gateway in
public connection can possibly detect an evil twin attack. Not only the detection of evil twin
attack, but also the prevention of evil twin attack is necessary. The different techniques of the
prevention of evil twin attack are evaluated as well in order to understand the different
techniques that can be used to address the risk that is associated with Evil Twin Attack.
Kumar and Paul, (2016), in their paper “Security analysis and implementation of a simple
method for prevention and detection against Evil Twin attack in IEEE 802.11 wireless LAN”
have summarised the different techniques of preventing and eliminating the risks associated with
the evil twin attack (Lanze et al. 2014). Some basic ways to prevent an evil twin attack is to
disable the auto connect option to any network. Furthermore, the use of WEP2 encryption

6
LEVEL 2 PROJECT
technology is highly recommended for prevention of evil twin attack (Robyns et al. 2014). The
password set by the user in securing a private network should be a combination of the
punctuation marks, combination of different alphabets and the numbers. Connection to unknown
WLAN should be avoided in order to eliminate the risk of data loss through an evil twin attack
(Szongott, Henne and Smith 2012). Furthermore there is a considerable risk associated with use
a same network for connecting many computers. Therefore, in order to prevent an evil twin
attack, it is essential to use Wi-FI protected Access options and virtual private network. Use of
virtual private networks is a very good option for preventing an evil twin attack as it develops a
secure tunnel in ensuring a secure exchange of communication among the two parties.
Furthermore, with the use of VPN, the option for connecting to the wireless network should be
disabled although it might result in a significant limitation to the users. Use of certain tools can
automate a defence against evil twin attack in a corporate organization. Example of one such tool
is EvilAp_Defender. Furthermore, proper monitoring of the access point can further help in
preventing the evil twin attack (Nakhila and Zou 2016). Use of latest security protocol and latest
security patches in the network can possibly prevent an evil twin attack. The use of the
unauthorized access points should be prevented in order to eliminate the possible risks of facing
an evil twin attack.
Knowledge about the different detection and prevention techniques of evil twin attack
will help me in developing the base for my research project where I will be evaluating the
different methods that can be put to use in detection and prevention of Evil Twin Attacks.
5. Conclusion
The report gives an overview of the concept of Evil twin attack and its working principle.
Based on the topic of the research, the major research questions are identified that will help me
in carrying out with the research work. The report discusses the different detection techniques
that different researchers have made use of, in detecting evil twin attack. The basic prevention
methods of evil twin attacks are further discussed in the report. The project will aim at
identifying a more structured detection and prevention technique for the evil twin attack. It is
seen that the evil twin attack mainly target unsecured and public wireless network by replacing a
legitimate access point with a rogue access point. The main target of Evil twin attack is to gain
confidential information from the users who are using a wireless network to communicate. In
order to develop the project ideas, the different evil twin detection techniques will be thoroughly
reviewed. There are certain other methods of detection of evil twin which needs to be researched
well for the project. The wireless hotspots are mostly targeted for the evil twin attack as there is
no proper authentication in WIFI access points. Therefore, in this project it is very essential to
address the problems associated with the detection of rogue access points.

7
LEVEL 2 PROJECT
References
Alotaibi, B. and Elleithy, K., 2016. Rogue access point detection: Taxonomy, challenges, and
future directions. Wireless Pe
Cassola, A., Robertson, W.K., Kirda, E. and Noubir, G., 2013, February. A Practical, Targeted,
and Stealthy Attack Against WPA Enterprise Authentication. In NDSS.
Gupta, A. and Jha, R.K., 2015, May. Security threats of wireless networks: A survey.
In Computing, communication & automation (ICCCA), 2015 international conference on (pp.
389-395). IEEE.
Gupta, A. and Jha, R.K., 2015, May. Security threats of wireless networks: A survey.
In Computing, communication & automation (ICCCA), 2015 international conference on (pp.
389-395). IEEE.
Kolias, C., Kambourakis, G., Stavrou, A. and Gritzalis, S., 2016. Intrusion detection in 802.11
networks: empirical evaluation of threats and a public dataset. IEEE Communications Surveys &
Tutorials, 18(1), pp.184-208.
Kumar, A. and Paul, P., 2016, March. Security analysis and implementation of a simple method
for prevention and detection against Evil Twin attack in IEEE 802.11 wireless LAN.
In Computational Techniques in Information and Communication Technologies (ICCTICT),
2016 International Conference on (pp. 176-181). IEEE.
Lanze, F., Panchenko, A., Ponce-Alcaide, I. and Engel, T., 2014, September. Undesired
relatives: protection mechanisms against the evil twin attack in IEEE 802.11. In Proceedings of
the 10th ACM symposium on QoS and security for wireless and mobile networks (pp. 87-94).
ACM.
Matos, A., Romao, D. and Trezentos, P., 2012, October. Secure hotspot authentication through a
near field communication side-channel. In Wireless and Mobile Computing, Networking and
Communications (WiMob), 2012 IEEE 8th International Conference on (pp. 807-814). IEEE.
Mustafa, H. and Xu, W., 2014, October. Cetad: Detecting evil twin access point attacks in
wireless hotspots. In Communications and Network Security (CNS), 2014 IEEE Conference
on (pp. 238-246). IEEE.
Nakhila, O. and Zou, C., 2016, November. User-side wi-fi evil twin attack detection using
random wireless channel monitoring. In Military Communications Conference, MILCOM 2016-
2016 IEEE (pp. 1243-1248). IEEE.
Nakhila, O., Dondyk, E., Amjad, M.F. and Zou, C., 2015, January. User-side wi-fi evil twin
attack detection using ssl/tcp protocols. In Consumer Communications and Networking
Conference (CCNC), 2015 12th Annual IEEE (pp. 239-244). IEEE.
Noor, M.M. and Hassan, W.H., 2013. Wireless networks: developments, threats and
countermeasures. International Journal of Digital Information and Wireless Communications
(IJDIWC), 3(1), pp.125-140.

8
LEVEL 2 PROJECT
Robyns, P., Bonné, B., Quax, P. and Lamotte, W., 2014, July. Short paper: exploiting WPA2-
enterprise vendor implementation weaknesses through challenge response oracles.
In Proceedings of the 2014 ACM conference on Security and privacy in wireless & mobile
networks (pp. 189-194). ACM.
Sharma, P., Kaushal, P.K. and Sharma, P.R., 2015. Survey on Evil Twin Attack. International
Journal of Scientific Engineering and Research (IJSER), 4(4), pp.54-58.
Szongott, C., Henne, B. and Smith, M., 2012, December. Mobile evil twin malnets–the worst of
both worlds. In International Conference on Cryptology and Network Security(pp. 126-141).
Springer, Berlin, Heidelberg.
Yang, C., Song, Y. and Gu, G., 2012. Active user-side evil twin access point detection using
statistical techniques. IEEE Transactions on Information Forensics and Security, 7(5), pp.1638-
1651.