Mikebyne Posted June 26, 2014 Share Posted June 26, 2014 I was on a friends network today and we noticed an open SSID "Evil" within range.This network was on the same channel and signal strength as his. When we turned off the router it disappeared, powered it back on and it reappeared.I swapped out the router with a spare one and it seem to solve the issue.What sort of attack would cause this? How can he prevent this in the future?Any help would be great! Quote Link to comment Share on other sites More sharing options...
digininja Posted June 27, 2014 Share Posted June 27, 2014 Way to vague to comment on but did you try looking at the interface for the AP to see if someone had just added the second ESSID? Quote Link to comment Share on other sites More sharing options...
Mikebyne Posted June 27, 2014 Author Share Posted June 27, 2014 Way to vague to comment on but did you try looking at the interface for the AP to see if someone had just added the second ESSID? It was a stock router from a broadband provider in Ireland. I dont think it had an option to add another SSID The mac address for "evil" was near identical to the main router bar the last digit Quote Link to comment Share on other sites More sharing options...
digininja Posted June 27, 2014 Share Posted June 27, 2014 Can't think of any specific thing that would cause this. Without looking at the device I'd go for it being someone messing with the device and adding a second ESSID. hostapd behaves like this when it hosts multiple ESSIDs and is what most AP creators use. Quote Link to comment Share on other sites More sharing options...
Mikebyne Posted June 27, 2014 Author Share Posted June 27, 2014 Can't think of any specific thing that would cause this. Without looking at the device I'd go for it being someone messing with the device and adding a second ESSID. hostapd behaves like this when it hosts multiple ESSIDs and is what most AP creators use. I'm sure it wasn't anything too malicious because I doubt they'd call the new "Evil" Just thought Id ask about it as I haven't seen this type of attack before Quote Link to comment Share on other sites More sharing options...
digininja Posted June 27, 2014 Share Posted June 27, 2014 I'd go for friend/room mate with access adding it for a laugh. Quote Link to comment Share on other sites More sharing options...
Mikebyne Posted June 27, 2014 Author Share Posted June 27, 2014 I'd go for friend/room mate with access adding it for a laugh. It was actually in a friends shop. Nobody would have had direct access only me and him Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.