TY - GEN

T1 - METDS - A Self-Contained, Context-based Detection System for Evil Twin Access Points

AU - Szongott, Christian

AU - Brenner, Michael

AU - Smith, Matthew

N1 - Publisher Copyright: © International Financial Cryptography Association 2015. Copyright: Copyright 2015 Elsevier B.V., All rights reserved.

PY - 2015

Y1 - 2015

N2 - Mobile Evil Twin attacks stem from the missing authentication of open WiFi access points. Attackers can trick users into connecting to their malicious networks and thereby gain the capability to mount further attacks. Although some recognition and prevention techniques have been proposed, they have been impractical and thus have not seen any adoption. To quantify the scale of the threat of evil twin attacks we performed a field study with 92 participants to collect their WiFi usage patterns. With this data we show how many of our participants are potentially open to the evil twin attack. We also used the data to develop and optimize a context-based recognition algorithm, that can help mitigate such attacks. While it cannot prevent the attacks entirely it gives users the chance to detect them, raises the amount of effort for the attacker to execute such attacks and also significantly reduces the amount of vulnerable users which can be targeted by a single attack. Using simulations on real-world data, we evaluate our proposed recognition system and measure the impact on both users and attackers. Unlike most other approaches to counter evil twin attacks our system can be deployed autonomously and does not require any infrastructure changes and offers the full benefit of the system to early adopters.

AB - Mobile Evil Twin attacks stem from the missing authentication of open WiFi access points. Attackers can trick users into connecting to their malicious networks and thereby gain the capability to mount further attacks. Although some recognition and prevention techniques have been proposed, they have been impractical and thus have not seen any adoption. To quantify the scale of the threat of evil twin attacks we performed a field study with 92 participants to collect their WiFi usage patterns. With this data we show how many of our participants are potentially open to the evil twin attack. We also used the data to develop and optimize a context-based recognition algorithm, that can help mitigate such attacks. While it cannot prevent the attacks entirely it gives users the chance to detect them, raises the amount of effort for the attacker to execute such attacks and also significantly reduces the amount of vulnerable users which can be targeted by a single attack. Using simulations on real-world data, we evaluate our proposed recognition system and measure the impact on both users and attackers. Unlike most other approaches to counter evil twin attacks our system can be deployed autonomously and does not require any infrastructure changes and offers the full benefit of the system to early adopters.

KW - 802.11

KW - Attack detection

KW - Evil twin access points

KW - Mobile device security

UR - http://www.scopus.com/inward/record.url?scp=84949988188&partnerID=8YFLogxK

U2 - 10.1007/978-3-662-47854-7_22

DO - 10.1007/978-3-662-47854-7_22

M3 - Conference contribution

SN - 978-3-662-47853-0

VL - LNCS 8975

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 370

EP - 386

BT - Financial Cryptography and Data Security - 19th International Conference, FC 2015, Revised Selected Papers

A2 - Okamoto, Tatsuaki

A2 - Bohme, Rainer

PB - Springer Verlag

ER -