Rogue access points in plain English
An access point is the device that broadcasts a Wi-Fi network and connects laptops or smartphones to the wired network. In companies, the IT department plans and manages these devices centrally. It decides who can sign in, how, and which parts of the network they can reach. “Rogue” means renegade or uncontrolled: a rogue access point is one that nobody has approved and that IT doesn’t know about.
An everyday comparison: your office building has a main entrance with a reception desk and badge checks. Now someone takes it upon themselves to put an extra door in the outside wall – for convenience or with malicious intent. The main entrance remains secure, but the new door lets people slip in unnoticed. That’s exactly the role a rogue access point plays for your network.
Not every rogue access point is the work of attackers. Often, employees plug in their own router because the corporate Wi-Fi signal is weak in a particular room. That’s well-intentioned, but just as risky.
How a rogue access point works
- Connection to the network: A small router or access point is plugged into a free network jack or directly into a switch – a network distribution device – in a meeting room, under a desk, or behind a printer.
- Its own wireless network: The device broadcasts its own Wi-Fi network, often unencrypted or protected only by a simple password.
- Direct access: Anyone who connects to it lands directly in the internal network – without the sign-in that the official corporate Wi-Fi requires, and without the firewall that acts as a digital bouncer, for example by keeping the guest Wi-Fi separate from the corporate network.
- Access from a distance: Radio signals don’t stop at the office wall. An attacker can target servers, file shares, and other systems from the parking lot or the building next door.
A laptop that is connected to the corporate network by cable while also running a Wi-Fi hotspot can unintentionally become such a bridge, too.
Related, but not the same, is the evil twin: a fake access point that imitates the name of your real Wi-Fi network to lure devices and harvest passwords. A rogue access point, by contrast, opens a genuine entry point into your internal network.
A practical example
Here’s a typical scenario: At a tax advisory firm, Wi-Fi reception in the back meeting room is poor. An employee simply brings in his old router from home and plugs it into the network jack. Before long, the password for the new wireless network is written on a note stuck to the whiteboard.
During a wireless penetration test, the unknown network stands out immediately. The testing team connects from the parking lot and reaches the file server holding client files – with no firewall in between. The firm removes the router, improves the coverage of the official Wi-Fi, and disables unused network jacks.
Why does this matter for businesses?
In one fell swoop, a rogue access point bypasses much of what you’ve invested in securing your Wi-Fi: the encryption and authentication of the official wireless network no longer apply. Attackers often need neither your corporate network credentials nor access to your building. How far they can get from there depends on how consistently your network is divided into separate zones – what experts call network segmentation.
The consequences range from eavesdropping on network traffic and theft of confidential data to a foothold for extortion attacks with ransomware. If personal data is affected, this can turn into a data breach that must be reported under the GDPR. Organizations that process payment card data must also search for unauthorized wireless access points at least every three months under PCI DSS 4.0.1, the payment card industry’s security standard.
How to protect your organization
- Clear rules: Make it a rule that only the IT department may connect network devices, and explain to your team why.
- Network access control: With the IEEE 802.1X standard, devices have to authenticate at the network jack before they’re granted access – unknown devices stay out.
- Disable unused network jacks: Ports that aren’t needed should be shut off at the switch.
- Wireless monitoring: A wireless intrusion prevention system (WIPS) continuously monitors the airwaves and reports unknown access points.
- Regular wireless scans: Compare the Wi-Fi networks you detect against your list of approved access points – at branch locations, too.
- Good coverage: Corporate Wi-Fi that reaches every corner gives employees no reason to bring their own routers.
How Rootsektor can help
In a wireless penetration test, we conduct a targeted on-site search for unauthorized access points and hotspots, match them against your wired network, and check whether wireless access can be turned into access to your internal systems. You receive concrete remediation recommendations and, once the test is complete, a test certificate. You can request a fixed-price quote after scoping via our Pentest Quote page.