Wireless Hotspot Hacks

Did you know that it is relativly easy to phish Wi-Fi hotspot subscription credentials ? The process involves only two steps and requires a wireless network card that supports the HostAp drivers which makes it look like the signal is actually coming from a hotspot and not from an ad hoc network.

You have to setup your computer to look like a legit Access Point broadcasting the actual SSID of the service and you will have to fake a login page to resemble the login page of the service that you are emulating. The ethical hacker network describe everything with lots of screenshots. The most important part of the article is of course the way to defend against this fake Access Points.

It is highly difficulty for the normal user to validate an access point. You could check the AP settings if offered, for example the Authenticity Certificate of the Access Point and of the login website that you are visiting. Another way to prevent a MITM attack would be to utilize server host authentication, which prevents an attacker from being able to impersonate the access point because they do not have access to the AP’s private key.