How does WIFI password verification work in a WiFi evil twin?
Problem Statment
I am trying to guard against the following scenario.
I have a laptop and it connects over wifi, at home as well as at the workplace.
I am not familiar with the wifi protocol.
I however have some understanding of how it may happen - there is some sort of a device-identifier (I am guessing it looks like a mac-address 'AB:01:CD:23'....) and a user-identifer (Alice_and_Bob_Wifi) that is broadcast. I have configured the SSID's in my laptop.
The understanding is as follows -
As soon as my laptop comes within range, it matches (likely the machine identifier), recognizes it and initiates a protocol (wifi-authentication-protocol-version-x.y.z ??) to connect to the wifi router.
To do that it sends out a password.
Wifi verifies the passwords and lets the client (my-laptop) 'in' (establishes a connection).
My questions:
a) Are both user-identifier (Alice_and_Bob_Wifi) and device-identifier (AB:01:CD:23) broadcast?
b) Is there any secret (like ssh-certificate) that is exchanged during the first handshake that would help guard against an evil twin attack?
c) When my laptop thinks that the rogue router is the legitimate one, it would send out the password to authenticate itself. Does the rogue router acknowledge it and gain knowledge of the password? (or is only a hash of the password sent, to guard against the actual password being revealed in such cases)?
d) If the actual password is transmitted instead of a hash, then would the hacker now be able to login to the legitimate router and use the network masquerading as that router's owner?
e) Is there any equivalent to TLS handshake that happens during wifi connection handshake such that the transmitted password is over an encrypted channel rather than broadcast in clear?
References
- How would you detect an Evil Twin attack, especially in a new environment?
- https://searchsecurity.techtarget.com/definition/evil-twin
- https://null-byte.wonderhowto.com/how-to/hack-wi-fi-creating-evil-twin-wireless-access-point-eavesdrop-data-0147919/
- How to mitigate evil twin WIFI social engineering attack?
- https://null-byte.wonderhowto.com/how-to/hack-wi-fi-capturing-wpa-passwords-by-targeting-users-with-fluxion-attack-0176134/
