'Evil Twin' Threat to Wireless Security

BarryNorton writes "The BBC are currently reporting on research from Cranfield University on the ability of unscrupulous third parties to spoof wireless networking clients into believing they are connected to a 'valid base station' and compromising their passwords for Internet banking etc. Of course the rest of the connection through the Internet, even from a trusted router, is insecure in any case and such sites should be using end-to-end security like SSL. Is there, therefore, anything (other than the cute name 'evil twin') to this story?"

Comments

Re:Yes

[scovetta]

How often do you look at the name in the SSL certificate for each page that you're on? Do you regularly review your CA trust configuration? SSL is *very* susceptible to MITM attacks. Are you also using a local DNS server or are you asking the router for the IP of "www.capital1.com"? Are you at least resolving the IP independently and verifying?

Anyone who thinks SSL is secure needs to get their learn-on.