WiFish Finder Who Will Bite the Bait

Architecture and Background

Wi-Fish Finder: Who Will Bite the Bait MD Sohail Ahmad Senior Wireless Security Researcher, AirTight Networks Prabhash Dhyani Wireless Security Researcher Threat of Evil Twin and Honeypots lurking at office parking lots and public hotspots are well known yet awareness level among WiFi users about exposure to such threats remains quite low. Security conscious WiFi users and IT administrators too don't have any simple tools to assess security posture of WiFi clients active in their airspace. Wi-Fish Finder is a tool for assessing whether WiFi devices active in the air are vulnerable to "phishing" attacks. Assessment is performed through a combination of passive traffic sniffing and active probing techniques. Most WiFi clients keep a memory of networks (SSIDs) they have connected to in the past.

Vulnerability Analysis

Wi-Fish Finder first builds a list of probed networks and then using a set of clever techniques also determines security setting of each probed network. A client is a fishing target if it is actively seeking to connect to an OPEN or a WEP network. Clients only willing to connect to WPA or WPA2 networks are not completely safe either! To find out why , come and attend this talk and witness some live action. There is less than 50% chance that your laptop will bite the bait!

Exploitation and Demonstrations

MD Sohail Ahmad is a senior wireless security researcher at AirTight Networks. Mr Ahmad possesses strong background in secure driver development, protocol development, and open source tool development. His areas of interests include WiFi security, 802.11n, 802.11w protocol development, Network security assessment and vulnerability analysis etc. Prior to this, he has also demonstrated the more potent form of Evil Twin Attack called "Multipot" in Defcon-15. He discovered "Caffe Latte" attack which was presented in ToorCon9, which was about retrieving WEP key from an isolated client in the absence of its authorized access point.

Remediation and Defensive Strategies

In Defcon-16, he had presented "Autoimmunity disorder in Wireless LANs". Prabhash Dhyani is a wireless security researcher working with Airtight Networks. His interest includes wireless and network security research and tool building. His recent work "New Avatars of Honeypot Attacks on WiFi Networks" was presented in Hack.In 2009 conference held at IIT Kanpur, India. He holds BTech in Information Technology (IT) from IIIT Allahabad. For copies of the slides and additional materials please see the DEF CON 17 Archive here: