Rogue Wi-Fi Access Points

Layer 2: Data link Medium risk

How it works

A rogue access point is a wireless network that should not be there. It might be a cheap router an employee plugs in for convenience, creating an unsecured opening into the office network. It can also be an "evil twin" set up by an attacker in a coffee shop, airport or near your office, using the same name as a trusted network. Small travel routers and personal hotspots are inexpensive and easy to hide in an office.

Devices often connect automatically to network names they have seen before. Once connected to an attacker's network, users may be shown fake login pages or have unencrypted traffic observed and altered. An unauthorized access point inside your building can let someone in the parking lot reach internal systems without ever coming through the front door. These problems can persist for months if no one is checking the wireless environment.

Warning signs

• Unfamiliar network names that resemble your company Wi-Fi
• Networks appearing with the same name but different security
• Devices connected to the office network that IT does not recognize
• Unexpected captive portal or login pages on familiar networks
• Certificate warnings when visiting common sites

How to defend against it

• Use business-grade Wi-Fi with rogue access point detection
• Secure office Wi-Fi with enterprise authentication
• Separate guest Wi-Fi from internal systems
• Block unauthorized devices from network ports
• Require a VPN or secure connection on public Wi-Fi

If it happens to you

1. Disconnect from the suspicious network
2. Locate and remove any unauthorized access point
3. Change passwords used while connected
4. Review network logs for unusual access