Evil Twin Detection

What Is an Evil Twin Attack?

An evil twin is a rogue access point that broadcasts the same SSID as a legitimate network. From a client device's perspective, it looks identical to the real network. The device sees the same network name, and if the attacker has done their homework, the same encryption type and channel configuration.

The attack is straightforward. The attacker sets up a WiFi access point, configures it with the target network's SSID, and waits. Client devices that have previously connected to the legitimate network will often auto-connect to the evil twin - especially if the evil twin's signal is stronger than the real AP. Once connected, all of the victim's traffic flows through the attacker's hardware.

Evil twin attacks have been practical for over a decade, and the hardware requirements keep dropping. A laptop with a USB WiFi adapter can do it. A Raspberry Pi can do it. Purpose-built devices can do it in a form factor that fits in a pocket.

Why Evil Twins Are Dangerous

The core danger is the auto-connect behavior built into every modern operating system. When your phone sees a network SSID it has connected to before, it connects again automatically. It does not verify that the access point is the same physical device. It does not check the BSSID (the AP's MAC address). It does not confirm geographic location. It just connects.

This means an attacker does not need to be at the same location as the target network. If you have "Starbucks_WiFi" saved on your phone from a coffee shop visit last month, an attacker broadcasting "Starbucks_WiFi" in a park, on a bus, or in your office building can capture your connection. Your phone will connect without prompting you.

graph TD
    subgraph "Normal Connection"
        A[Client device] -->|Sees saved SSID| B[Legitimate AP - BSSID aa:bb:cc:dd:ee:ff]
        B --> C[Internet via trusted router]
    end
    subgraph "Evil Twin Attack"
        D[Client device] -->|Sees same SSID - stronger signal| E[Rogue AP - BSSID 11:22:33:44:55:66]
        E --> F[Traffic routed through attacker]
        F --> G[Attacker inspects and forwards traffic]
        G --> H[Internet - victim unaware]
    end
    A -.->|Auto-connect picks stronger signal| E

Evil twin exploits auto-connect behavior - the client joins the stronger signal without verifying the access point identity

Once traffic flows through the evil twin, the attacker can perform DNS spoofing (redirecting you to fake websites), SSL stripping (downgrading HTTPS to HTTP where possible), credential harvesting via fake captive portals, and passive monitoring of any unencrypted traffic. The combination of automatic connection and full traffic control makes this one of the most effective WiFi attacks available.

Client-Side Detection

Detecting an evil twin from the client side is difficult because the attack is designed to be invisible. However, several indicators can raise suspicion.

Unexpected captive portal on a trusted network. If you connect to your home WiFi or a corporate network you use daily and suddenly see a captive portal login page, something is wrong. Trusted networks do not spontaneously add captive portals. This is a strong signal that you have connected to an evil twin running a phishing portal.

Certificate errors on familiar sites. If you visit your bank's website on a network you trust and get a certificate warning, the connection may be intercepted. An evil twin performing SSL stripping or DNS spoofing will trigger certificate mismatches on HTTPS sites.

BSSID change for the same SSID. This requires technical awareness, but it is the most reliable client-side indicator. Every access point has a unique BSSID (its MAC address). If you note the BSSID of your home or office AP, you can check whether the BSSID changes unexpectedly. On macOS, holding Option and clicking the WiFi icon shows the current BSSID. On Linux, iwconfig displays it. A different BSSID for a known SSID is a red flag.

Performance anomalies. Evil twins often route traffic through a cellular hotspot or a secondary internet connection. If a normally fast network suddenly feels sluggish, or if latency spikes significantly, the traffic path may have changed.

Network-Side Detection

Network administrators have more tools available for detection than individual users. The key advantage is visibility across the entire RF environment.

Wireless Intrusion Detection Systems (WIDS). Enterprise WIDS solutions continuously scan the wireless environment and alert on anomalies. A WIDS that detects two access points broadcasting the same SSID with different BSSIDs will flag it as a potential evil twin. The alert triggers investigation.

BSSID monitoring. Maintaining a list of authorized BSSIDs for each SSID is the most direct detection method. Any BSSID broadcasting an authorized SSID that is not on the approved list is either a rogue AP or a misconfiguration. Either way, it needs investigation.

graph TD
    subgraph "WIDS Monitoring"
        A[WIDS Sensors] --> B[Scan RF environment]
        B --> C{Duplicate SSID detected?}
        C -->|No| D[Normal operation]
        C -->|Yes| E[Compare BSSIDs to authorized list]
        E --> F{BSSID authorized?}
        F -->|Yes| G[Known AP - no alert]
        F -->|No| H[Alert - possible evil twin]
        H --> I[Log BSSID and signal strength]
        I --> J[Admin investigates]
    end

Network-side evil twin detection flow - WIDS sensors compare detected BSSIDs against an authorized list

802.1X authentication failures. On networks using WPA Enterprise (802.1X), an evil twin cannot replicate the RADIUS server's certificate. Clients configured to verify the server certificate will refuse to authenticate to the evil twin. However, clients that skip certificate validation - a common misconfiguration - will connect happily.

Signal Strength Analysis

Signal strength patterns provide a subtle but powerful detection method. Legitimate access points have relatively stable signal strength from fixed locations. An evil twin, likely operating from a different physical location, will show a different signal pattern.

If a WIDS detects two BSSIDs broadcasting the same SSID, the signal strength profiles from multiple sensors can triangulate their approximate locations. If one BSSID is in the server room where the AP should be, and the other appears to be in the parking lot, the parking lot source is almost certainly a rogue device.

Even without multiple sensors, a single monitoring device can observe that a known BSSID that normally shows -45 dBm signal strength is suddenly showing -70 dBm, while a new BSSID with the same SSID shows -30 dBm. The legitimate AP did not move. Something new appeared, and it is louder.

This kind of analysis requires baseline data. You need to know what normal looks like before you can identify anomalies. Regular RF surveys - even informal ones with a WiFi scanning tool - build the baseline that makes anomaly detection possible.

Using the BLEShark Nano for Detection

The BLEShark Nano's WiFi scanner provides a practical tool for evil twin detection. When you scan for WiFi networks, the scanner shows every access point it finds, including the BSSID for each one. If an SSID appears with multiple BSSIDs, they are all listed separately.

For home users, this means you can check whether anyone is broadcasting a copy of your home WiFi SSID. Run a scan, note the BSSIDs associated with your SSID. You should see your own router's BSSID and nothing else. If you see a second BSSID broadcasting your home SSID, you have a problem.

For security professionals conducting site surveys, the BLEShark Nano provides a portable way to scan for duplicates across a building. Walk the premises, scan at multiple locations, and compare results. A rogue AP will show stronger signal in certain areas and weaker signal in others, creating a pattern that helps locate it physically.

The device's compact size makes it practical for spot checks that would be inconvenient with a laptop and directional antenna. Clip it to your badge, walk the floor, review the results. That five-minute check catches problems that might otherwise go unnoticed for weeks.

802.11w PMF as Partial Mitigation

Protected Management Frames (PMF), defined in the 802.11w amendment, encrypt management frames like deauthentication and disassociation. This is relevant to evil twin attacks because one common technique involves the attacker sending deauth frames to disconnect clients from the legitimate AP, forcing them to reconnect - hopefully to the evil twin with its stronger signal.

With PMF enabled, deauth frames must be authenticated. An attacker who does not have the network's encryption key cannot forge valid deauth frames. This means they cannot forcibly disconnect clients from the legitimate AP.

graph TD
    subgraph "Without PMF"
        A[Attacker sends forged deauth] --> B[Client disconnects from real AP]
        B --> C[Client scans for SSID]
        C --> D[Evil twin has stronger signal]
        D --> E[Client auto-connects to evil twin]
    end
    subgraph "With PMF Enabled"
        F[Attacker sends forged deauth] --> G{Management frame authenticated?}
        G -->|No - forged| H[Client ignores the frame]
        H --> I[Client stays on legitimate AP]
        G -->|Yes - valid| J[Legitimate disconnect]
    end

PMF prevents forced disconnection - without it, attackers can push clients toward the evil twin

PMF is mandatory in WPA3 and optional in WPA2. Enabling it on WPA2 networks requires both the AP and all client devices to support it. Check your router's settings for "Protected Management Frames" or "802.11w" and enable it if all your devices support it.

However, PMF is only a partial mitigation. It prevents the deauth-then-reconnect attack, but it does not prevent a client from voluntarily connecting to an evil twin that happens to have a stronger signal. If a client device encounters the evil twin before it encounters the legitimate AP - for example, when entering a building from the parking lot where the attacker is positioned - PMF does not help.

Defense Summary

Defending against evil twins requires a layered approach because no single countermeasure eliminates the threat entirely.

For individuals: Remove saved SSIDs for public networks after use. Verify the BSSID when connecting to critical networks. Use a VPN. Watch for unexpected captive portals and certificate warnings on trusted networks.

For network administrators: Maintain a BSSID whitelist. Deploy WIDS or periodic RF scanning. Enable PMF on all access points. Use WPA Enterprise with server certificate validation. Conduct regular scans for unauthorized SSIDs.

For security teams: Include evil twin testing in wireless security assessments. Use portable scanning tools like the BLEShark Nano for spot checks during site surveys. Train employees to recognize the warning signs of a rogue network.

The evil twin attack exploits the fundamental trust model of WiFi: networks are identified by name, and devices trust that name without verification. Until that model changes, detection and awareness remain the primary defenses.