~/moritzsamrock_

Evil Twin Attack

Evil Twin Attack: Counterfeit access point masquerading as a trusted wireless network. Defense requires robust preventionPreventionMeasures intended to stop security incidents or attacks before they occur., meaningful loggingLoggingThe recording of security-relevant events so activity can be monitored, investigated, and audited., timely detectionDetectionThe capability to identify suspicious activity, attacks, or policy violations in time., and clearly defined response measures.

How it works and where it fits

Technically, Evil Twin Attack describes an attack path or a concrete method rather than a single suspicious event. A sound assessment separates prerequisites, entry point, objective, intermediate steps, and expected effect. The same technique can produce very different outcomes depending on system architecture, available privileges, exposure, and existing safeguards.

Practical security relevance

In practice, both preventive measures and observable traces matter. Secure configuration, restricted privileges, robust input and identity checks, and telemetry at affected trust boundaries all contribute. A single indicator rarely proves an attack; reliable detection, containment, and remediation require the combined context of timing, source, target, and observed impact.

  • Rogue Access PointRogue Access PointUnauthorized or malicious access point within or near a corporate network.: Unauthorized or malicious access point within or near a corporate network.
  • Wi-Fi Protected Access 3Wi-Fi Protected Access 3Current security standard for wireless networks featuring stronger protection mechanisms.: Current security standard for wireless networks featuring stronger protection mechanisms.
  • Adversary-in-the-MiddleAdversary-in-the-MiddleAn attack in which an actor positions themselves between two communicating parties.: An attack in which an actor positions themselves between two communicating parties.
  • Network Access ControlNetwork Access ControlVerifies devices and users before granting network access.: Verifies devices and users before granting network access.

Related terms