"Wi-Bear: Intelligent Autonomous Wi-Fi Honeypot Detection"

No ratings

Presented at BSidesCanberra 2019 by

Vivek Ramachandran

Wi-Fi networks are now the pervasive gateways to the Internet. Unfortunately, billions of Wi-Fi clients remain vulnerable to the age old Honeypot attacks where an attacker creates access points which mimic the SSID and settings of an authorized network. Due to easy availability of mature honeypot creation tools, this attack is a slam dunk for even the most novice of Wi-Fi attackers. Enterprise security products have tried but failed to solve this problem with rule and lockdown based approaches. These challenges have compounded with pervasive BYOD and the advent of billions of Wi-Fi enabled home-industrial IoT devices. In our talk, we will practically demonstrate how using machine learning techniques we can make Wi-Fi clients “intelligent” so they can autonomously detect Honeypot attacks without needing any central servers. It is important to note that our solution does not need the Wi-Fi radio to be set to monitor mode and uses existing telemetry data provided by the operating system. This makes our technique practically feasible to apply to existing security products without requiring high privileges or underlying low-level operating system changes. We will show that our intelligent Wi-Fi clients can, without exception, detect honeypots created by all popular honeypot tools used in the wild by attacker today.