A network security engineer locates an unapproved wireless bridge connected to the corporate LAN that is broadcasting a hidden SSID, providing unauthenticated access to internal resources. Which of the following types of attacks BEST describes this finding?
Correct Answer: A
* QUE rogue access point is an unauthorized wireless device that is connected to a network without the knowledge or consent of the network administrator12. It can provide unauthorized access to internal resources, bypass security policies, and expose the network to various attacks12.
* A hidden SSID is a wireless network name that is not broadcasted by the access point. It is intended to increase security by preventing unauthorized users from discovering the network, but it can also be used by rogue access points to avoid detection3 .
* A wireless bridge is a device that connects two or more wireless networks or segments. It can extend the range of a wireless network, but it can also be used by rogue access points to connect to the corporate LAN .
* Therefore, the scenario described in the question is an example of a rogue access point attack, where an unapproved wireless bridge is connected to the corporate LAN and broadcasts a hidden SSID, providing unauthenticated access to internal resources.
* The other options are not correct because:
* An evil twin is a malicious access point that mimics a legitimate one, usually by using the same SSID and security settings. It is used to trick users into connecting to the fake network and steal their credentials or data . This is different from a rogue access point, which does not necessarily impersonate a legitimate network, but rather creates a new one2.
* ARP spoofing is a technique that allows an attacker to intercept or modify network traffic by sending fake ARP messages that associate their MAC address with an IP address of another host
* or device. It is used to perform man-in-the-middle attacks, denial-of-service attacks, or session hijacking . This is different from a rogue access point, which does not involve ARP messages or MAC address spoofing2.
* VLAN hopping is a technique that allows an attacker to access or send traffic to a VLAN that they are not authorized to. It can be done by exploiting misconfigured switches, trunk ports, or tagging protocols . This is different from a rogue access point, which does not involve VLANs or switches2.
References:
* 1: Rogue Access Points and Evil Twins - Baeldung
* 2: Whats the difference between an evil twin and a rogue access point? - Information Security Stack Exchange
* 3: What is a Hidden SSID? - How-To Geek
* : How to Find Hidden & Saved Passwords in Windows - Lifewire
* : What is a Wireless Bridge? - Linksys
* : How to Set Up a Wireless Bridge - PCMag
* : What is an Evil Twin Attack? - Norton
* : Which attack is more dangerous: Evil Twin or ARP spoofing? - Information Security Stack Exchange
* : What is ARP Spoofing? - Palo Alto Networks
* : How to Prevent ARP Spoofing - Cloudflare
* : What is VLAN Hopping? - Cisco
* : How to Prevent VLAN Hopping Attacks - Pluralsight
