Rogue Wifi Access Point Discovery with Bastille

Balint Seeber, Director of Vulnerability Research at Bastille, walks through a rogue access point scenario on an office floor plan. Bastille sensors give full-floor coverage, localize legitimate corporate access points and employee devices, and quickly spot a rogue AP that masquerades as legitimate infrastructure, alerting on the malicious activity and showing exactly where the device is.

Key Takeaways

• Bastille sensors provide complete floor coverage, localizing legitimate access points and connected employee devices
• A rogue access point masquerades as legitimate infrastructure to lure devices for man-in-the-middle attacks
• Bastille localizes the rogue AP and recognizes it does not match the established infrastructure
• The system alerts on the malicious activity and pinpoints the device’s location so responders know where to look

Video Transcript

Hello, my name is Balint Seeber, and I'm the director of vulnerability research at Bastille. Here is a typical deployment scenario of the Bastille solution. We have an office here, the floor plan, and the floor plan as it would exist within the Bastille user interface. We've established and deployed these Bastille sensors to give you complete coverage of this floor. And these legitimate corporate Wi-Fi access points have been discovered and localized as these points, as well as an employee's laptop that's using that corporate Wi-Fi.

And we can see them being localized at their cubicle. One particular attack scenario within the corporate environment is the use of a rogue access point. So imagine somebody sets up their own Wi-Fi access point that is going to masquerade as a legitimate access point. It's used to have employees devices connect to it, having a stronger signal rather than the legitimate infrastructure. And this allows an attacker to do man in the middle attacks, and try to glean any sensitive information from these connections from employees devices.

So once you've set up a rogue access point, since the Bastille sensors are monitoring all sorts of different Wi-Fi protocols, as well as Wi-Fi, we can then very quickly have the system localize that rogue access point, and then discover that it doesn't quite match the existing established, legitimate infrastructure. And especially when somebody's equipment tries to communicate with the access point, we can actually detect that happening as well.

And in either instance, actually throw an alert that there is some sort of malicious activity taking place. Being able to localize it here on the map is also advantageous, because then you know where to look for that particular device. [MUSIC PLAYING] PLAYING]