1

I have been facing this issue since a month where a neighbour access point is acting like a honeypot, all the nearby android devices are getting connected to it even after forgetting the network.

The issue is much like described in this link

I need to find a way to get rid of this since its also found to do some active network attacks by stealing creds, though I can't prove it. But still its getting connected unusually even after forgetting. Please help.

Firdous
  • 123
  • 5
  • 2
    So it's just an open AP that people auto authenticate to? Maybe turn off auto-connect on your devices of choice would be a good first step. Second step, well After that it's all kinda gray hat and I don't condone taking someone network down. I would gather as much evidence as possible and give that to the ISP and maybe even notify the city. – Joshua Faust Jul 17 '17 at 23:00
  • *its also found to do some active network attacks [..] though I can't prove it*... How do you know, if you can't prove it? – FMaz Jul 18 '17 at 08:03

1 Answers1

1

Does the honeypot have a singular SSID, or is it more like the question where he's constantly changing the name so that phones automatically connect?

If it's a singular SSID, what's the name of it? If he's named it a common hotspot name like "attWifi" or something, your phone might be seeing it and automatically thinking it's a public hotspot. There could also be a feature that allows the phone to connect to unsecured networks when a known one isn't available.

Jamming his router is illegal, but kicking people off of it isn't. An overkill solution would be to setup a wireless device with tools like the airocrack suite. Just script it so that if your device connects to a network that isn't whitelisted, it'll kindly use aireplay to send it a deauth packet.

Unfortunately without more information, we can't be of much help

zzarzzur
  • 1,112
  • 8
  • 8
  • The hotspot name is same all the time, it appears from the answers from the link that I ve shared that he might be changing his SSID, I am just seeing the behavior similar to question in that link. I am not a network skilled guy but interested to know/fix things. – Firdous Jul 21 '17 at 16:56