Mohamed Idris developed an open source tool (EvilAP Defender) to help wireless network administrators discover malicious pages (or in English as the developer calls them Evil Access Points – AP) and carry out DoS attacks on the attackers.
The EvilAP Defender published on GitHub can be run by administrators periodically to help them determine if attackers are trying to lure users of their wireless systems to connect to identical malicious networks.
These attacks, which use clones of the legitimate website (AP), essentially copy the login page in an attempt to convince users who want to log in that it is real. This is how they manage to collect sensitive data such as names and passwords.
Idris says his tool will not only send email alerts to admins when it detects malicious APs, but will also immediately launch distributed denial of service (DDoS) attacks to buy time.
“In addition, you can configure the tool to perform DoS attacks when it detects malicious clones, in order to give the administrator more time to react,” says Idris.
“However, the attack will only be performed on cloned AP sites that have the same SSID, but a different BSSID, or run on a different channel, to avoid a DoS on your legitimate network.”
Administrators who want to try out the EvilAP Defender can run it in learning mode so they can detect friendly networks.
Disclaimer: Distributed denial of service (DDoS) attacks against something you don't own, even if it's a very obvious malicious site, are illegal. Idris' tool is effective, smart, but also illegal.
