What is an evil twin?

Evil twins in plain English

An evil twin is a wireless access point that an attacker sets up as a look-alike of a trusted network. It uses the same network name – the SSID – as a company’s Wi-Fi, a hotel’s guest Wi-Fi, or the network at a café. To laptops and smartphones, the fake is indistinguishable from the original at first glance.

Imagine a second mailbox hanging right next to the real one and looking exactly the same. Anyone who drops a letter into it doesn’t notice a thing. But the letter ends up with the wrong person, who can read it, alter it, or quietly pass it on.

The attacker doesn’t need access to your building. A laptop or a small radio device within range is enough – in the parking lot, in the stairwell, or in the office next door.

How an evil twin attack works

1. Reconnaissance: Using freely available tools, the attacker determines which Wi-Fi networks are broadcasting nearby and how they are secured.
2. Cloning: The attacker sets up their own access point with the same name, often with a stronger signal than the original.
3. Luring: Many devices automatically connect to networks whose names they recognize – such as an open hotel Wi-Fi they have used before. Some attackers also disrupt the connection to the real network so that devices reconnect – possibly to the look-alike.
4. Harvesting: Now the traffic flows through the attacker. They can display a fake login page like those familiar from hotels (a captive portal) and ask for the Wi-Fi password or corporate credentials there. They can also read unencrypted traffic or redirect users to manipulated websites.

Corporate Wi-Fi networks where employees sign in with their personal user account (WPA2- or WPA3-Enterprise using 802.1X) are particularly lucrative targets. If the devices don’t check whether the authentication server’s certificate – its digital ID – is genuine, the evil twin accepts the sign-in. The attacker then obtains a kind of fingerprint of the credentials, from which weak passwords can be cracked offline. Because the same user account often also works for email and other services, the damage quickly extends beyond the Wi-Fi network.

A practical example

Here’s a typical scenario: A manufacturer of electronic components runs a corporate Wi-Fi network on its plant premises where employees sign in with their user accounts. During a wireless penetration test, the testing team sets up an access point with the same network name in the visitor parking lot. Shortly afterward, the first laptops connect automatically, because certificate validation was never enabled when the devices were set up.

From the captured sign-ins, the team cracks a weak password and uses it to log in to the real network. The remedy is straightforward. IT centrally configures all laptops to accept only the company’s own server certificate. After that, it gradually introduces authentication with device certificates.

Why does this matter for businesses?

An evil twin bypasses the firewall at your internet gateway, because the attack takes place over the air. It leaves hardly any traces in conventional logs and can be carried out from some distance. Employees who work on the road – in hotels, on trains, or in cafés – are particularly at risk.

The consequences range from intercepted passwords and monitored communications to a foothold in the internal network. From there, an attacker can spread further. If personal data is affected, reporting obligations under the GDPR may apply as well. A closely related threat is the rogue access point: an unauthorized access point directly inside the corporate network.

How to protect your organization

• Enforce certificate validation: Centrally configure company devices to accept only the certificate of your own authentication server.
• Certificates instead of passwords: With certificate-based authentication (EAP-TLS), there is no password that could be intercepted.
• Use WPA3: Deploy WPA3 and run mixed mode with WPA2 only as long as necessary. Protected Management Frames, which are mandatory with WPA3, safeguard management messages and make it harder to deliberately knock devices off the real network.
• Restrict automatic connections: Prevent company devices from automatically connecting to open or unknown networks.
• Use a VPN on the go: A VPN creates an encrypted tunnel into the corporate network that an evil twin cannot read – even on Wi-Fi networks you don’t control.
• Monitor your wireless environment: A wireless intrusion prevention system (WIPS) detects suspicious access points that use your network name.
• Raise employee awareness: Make it clear to your team that a web page asking for their company account password when they connect to Wi-Fi is a warning sign.

How Rootsektor can help

In our wireless penetration test, we recreate evil twin scenarios on site in a controlled manner. We check whether your devices trust the look-alike, how strong your Wi-Fi passwords are, and whether there is a path from the guest Wi-Fi into the internal network. Tests that briefly interrupt connections are carried out only in agreed time windows. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person. You can get a fixed-price quote after scoping via our Pentest Quote page.