Gemini detector-Client side solutions to detect the evil twin access point

• Main Authors: Yu-Liang Hsu, 徐裕量
• Other Authors: Fu-Hau Hsu
• Format: Others
• Language: en_US
• Published: 2016
• Online Access: http://ndltd.ncl.edu.tw/handle/avjd93

博士 === 國立中央大學 === 資訊工程學系 === 104 === This paper proposes two passive and one active user-side solutions, called Evil Twin Detector(ET-Detector), Wi-Fi Legal AP Finder (LAF) and Wi-Fi Malicious Rouge AP Finder (RAF), to the notorious evil twin access point problem which in turn can result in diverse security problems, such as fraud, identity theft, and man-in-the-middle attacks. Due to the severe security threats created by evil twins, many promising solutions have been proposed. However, the majority of these solutions are designed for the administrators of wireless networks, not for Wi-Fi users. Hence, they are either too expensive or need some data that are usually not accessible to normal users. ET Detector detects wireless packets and forwarding behavior. LAF utilizes the TCP three-way handshake-related packets and packet forwarding property created by evil twins to find legal APs, called good twins, at public hotspots or unencrypted WLANs; thus, it does not need any data or assistance from wireless network administrators. LAF does not send exploring packets actively; hence, evil twins cannot sense its existence. If the evil twins connected the Internet by 3G/4G network, LAF can't collect the TCP packets between evil twins and the Internet. RAF utilizes the routing path to find out the rogue AP, the routing path is not the same with good AP and rogue AP. No matter when and where a user needs to utilize an AP to connect to the Internet at a hotspot, he can use ET Detector,LAF and RAF to find a good twin AP to connect to.