Ravindra BagaleCourses & study guides मराठी Track your progress

25. Wireless Security

25.4 Evil Twin and Deauth Attacks (Concept)

By Last updated:

Do common Wi-Fi halle, samajnyasathi:

  • Deauth (denial of service): the attacker floods deauth frames so devices keep disconnecting – the Wi-Fi becomes unusable. WPA3 and "Protected Management Frames" (802.11w) defend against this.
  • Evil twin: the attacker sets up a fake access point with the same name (SSID) as a real one (say "Free_Airport_WiFi" or a copy of your office Wi-Fi). Victims connect to it, and the attacker sees or manipulates their traffic – often with a fake login page to steal passwords.

Defence: connect only to known networks, distrust open Wi-Fi, use a VPN, and check for HTTPS (Chapter 24). On your own network, enable Protected Management Frames and WPA3 where possible.

Ravindra Bagale's Tip

When people see "Free WiFi", they connect right away – that is exactly what an evil twin relies on. Tell students: never do banking or logins on open/free Wi-Fi, and if you must, use a VPN. This is a practical, everyday lesson.

Practice task

Write, in words only, how an evil-twin attack tricks a user at a cafe, and list three things a user can do to stay safe. No need to build a fake AP.

Recognising and reducing evil-twin risk

An evil twin is a fake access point with a trusted name. Defenders teach users and harden networks rather than practising the attack on public airspace (which can be illegal).

  1. Prefer networks that need a password or enterprise login.
  2. Use HTTPS and VPNs so a fake portal cannot read your traffic easily.
  3. On corporate networks, use certificate-based Wi-Fi (802.1X).
  4. Report suspicious SSIDs that mimic your company name.

Real examples

Global: security conferences often demonstrate evil twins in controlled areas to teach awareness. Everyday: a "Free Airport WiFi" open network next to the real one. Use official networks or your phone hotspot.

Recap

  • Concept for awareness. Do not broadcast attacks on public networks.
  • HTTPS, VPN and enterprise Wi-Fi reduce the damage.

Defender's worksheet (do this today)

  1. Write the lesson title and date in your notebook.
  2. List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
  3. Run one safe command or checklist item from the lesson on a lab system only.
  4. Paste the command and its output under an Evidence heading.
  5. Write one fix you would give a teammate in two sentences.
  6. Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

  • Skipping written permission just for a quick scan.
  • Practising on hostel or office Wi-Fi targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Teach one other person the warning from this lesson.