44. Mobile Device Security – Android, iPhone, Bluetooth and Wi-Fi
44.8 Wi-Fi on Phones – Evil Twin and Captive Portal Awareness
Evil twin = attacker AP uses a familiar SSID (e.g. Sahyadri-Guest) to lure phones. Captive portal = "click Accept to get internet" page – sometimes real (hotel), sometimes a phishing skin asking for Microsoft / Google passwords.
Blue habits on phones:
- Prefer known office SSIDs; ask IT for the real name
- On untrusted Wi-Fi: prefer HTTPS sites / apps; consider company VPN
- Do not type passwords into odd captive pages that ask for Google / bank login
- Forget café networks after use; turn off auto-join for random SSIDs
- Lab evil-twin demos = OWN lab AP / host-only only – never café customers
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Spins twin SSID near office | Staff training; EAP-TLS / known portals; VPN |
| Captive page steals Google password | Password managers that check domain; reject lookalikes |
| Downgrades / strips TLS where possible (awareness) | HTTPS / HSTS habits; VPN on untrusted nets |
Ravindra Bagale's Tip
Students airport Wi-Fi var corporate ERP open kartat without VPN. Interview: "Untrusted Wi-Fi → VPN + HTTPS; I never practise evil twin against the public." Dhyan rakho.
Lab
Design-only: draw Raja phone joining fake Sahyadri-Guest. Mark where VPN would protect app traffic. Optional OWN lab: host a captive test page on 192.168.56.50 HTTP for your emulator only – never bridged to real users.