What Is a Rogue Access Point?
A rogue access point is an unauthorized Wi-Fi access point in or near a network. It might be a malicious device an attacker planted to lure victims, or an unsanctioned one an employee connected for convenience. Both are dangerous: the first intercepts traffic, the second punches an uncontrolled hole in the perimeter. The attacker’s version is a wireless route to man-in-the-middle.
The evil twin attack#
The most potent malicious form is the evil twin — a rogue AP that impersonates a legitimate network:
- The attacker sets up an AP broadcasting the same name (SSID) as a trusted network, often with a stronger signal.
- Devices configured to auto-connect to that network may join the twin instead.
- All the victim’s traffic now flows through the attacker.
- From there they can read unencrypted data, attempt downgrades, or serve fake pages.
A deauth attack is often used to push victims off the real network so they reconnect to the twin.
How do you detect and defend?#
| Control | Effect |
|---|---|
| Wireless intrusion detection | Spot unexpected APs broadcasting your SSID |
| WPA3 / enterprise auth | Mutual auth resists impersonation |
| Client config (no auto-join open networks) | Fewer devices fooled |
| Encryption (TLS) | Interception yields ciphertext |
Rogue access points are a wireless man-in-the-middle vector. More at the Network Security hub.
Frequently asked questions#
What is a rogue access point?
A rogue access point is an unauthorized wireless access point on or near a network. It may be a malicious device set up by an attacker to lure victims, or an unsanctioned one an employee plugged in. Either way it creates an uncontrolled entry point; the malicious kind is used to intercept traffic from devices tricked into connecting.
What is an evil twin attack?
An evil twin is a rogue access point that impersonates a legitimate network by copying its name (SSID), often with a stronger signal. Devices set to auto-connect to that network may join the evil twin instead, routing all their traffic through the attacker for interception — a wireless man-in-the-middle.