Evil Twin and Rogue AP Attacks Explained for the Security+ Exam

Two wireless attacks are constantly confused on the exam, and the distinction is straightforward once stated.

A rogue access point is any unauthorised AP connected to your network. An evil twin is an AP impersonating a legitimate one, broadcasting the same SSID to lure clients.

The key difference: a rogue AP is usually an internal problem — often installed innocently by an employee who wanted better coverage — and it creates an unmanaged entry point into the network. An evil twin is an external attack and need not be connected to your network at all.

Why clients connect to an evil twin

Understanding this explains why the attack works and what defeats it.

Devices remember networks and reconnect automatically by SSID. The SSID is not a secret and not authenticated in an open or personal-mode network — anything can broadcast it. Clients generally prefer the strongest signal with a matching SSID, so an attacker with a closer or more powerful transmitter wins.

Some devices also broadcast probe requests listing networks they have previously joined, which tells an attacker exactly which SSID to impersonate.

The attacker can accelerate this by sending deauthentication frames to force clients off the legitimate AP so they reconnect — and reconnect to the stronger signal, which is theirs.

What the attacker gets

Once traffic flows through the attacker's access point they are positioned in the middle. That enables passive capture of unencrypted traffic, DNS manipulation to redirect users, and — most commonly — a captive portal that imitates a familiar login page and harvests credentials.

The captive portal is effective because users are conditioned to expect one on public Wi-Fi, and a page asking for an email and password to "continue" does not look unusual.

Attempts to strip or downgrade TLS are the other standard move, which is why HSTS and certificate warnings matter so much on untrusted networks.

Detection

What a defender should be doing, and what CySA+ asks.

Wireless intrusion detection. Enterprise controllers continuously scan for APs broadcasting corporate SSIDs from unknown BSSIDs, and for known BSSIDs appearing with unexpected signal characteristics.

BSSID monitoring. The SSID can be copied; the MAC address of the radio is harder to disguise convincingly, and an unfamiliar BSSID advertising your SSID is a strong signal.

Signal anomalies. A legitimate AP suddenly appearing much stronger, or from an unexpected direction, during a site walk.

Deauthentication floods, which precede many evil twin attacks. Protected Management Frames make these impossible, so their presence also indicates PMF is not enabled.

Switch port monitoring for rogue APs specifically — an unexpected device with an AP vendor MAC, or multiple MAC addresses behind one access port, indicates something is bridging.

Periodic physical walks. Unsophisticated and effective for finding a rogue AP someone plugged in under a desk.

Prevention

802.1X with EAP-TLS or properly configured PEAP. This is the structural defence against evil twins, and the most important item. With mutual or server-certificate authentication, the client verifies the network before authenticating — an attacker cannot present a valid certificate for your RADIUS server, so the connection fails and no credentials are exposed. A client configured to validate the server certificate simply will not join a fake AP.

Protected Management Frames, mandatory in WPA3, which blocks deauthentication attacks.

802.1X on wired switch ports, preventing an unauthorised AP from getting network access in the first place. This addresses rogue APs rather than evil twins.

Port security limiting MAC addresses per port.

Removing saved networks and disabling auto-join for open networks on managed devices.

Always-on VPN for devices used on untrusted networks, so even a successful interception yields encrypted traffic.

User awareness — never enter credentials on a captive portal for a corporate account, and treat certificate warnings as a stop signal.

Why WPA3 helps

Enhanced Open provides encryption on open networks without a passphrase, so a public hotspot no longer means everything is in the clear. SAE removes the offline dictionary attack on personal mode. And mandatory Protected Management Frames block the deauthentication step. None of these individually ends the attack, but together they raise the cost considerably.

What to remember

A rogue AP is unauthorised and connected to your network; an evil twin impersonates a legitimate SSID and may not be connected at all. Clients connect because SSIDs are not authenticated and devices prefer the strongest matching signal. Captive portal credential harvesting is the usual payload. The decisive defence is 802.1X with server certificate validation, supported by wireless intrusion detection, Protected Management Frames and wired port security.

Related reading: Wireless security: WEP, WPA2 and WPA3 · EAP methods · SSID, BSSID and ESSID