A threat actor uses a technique that allows devices to connect to an open authentication and then redirect the user’s browser to a fake captive portal that encourages the user to enter their network password. What is this technique? A.Evil twin B.Whaling C.Insider threat D.Spoofing
The correct answer and explanation is:
Correct Answer: A. Evil twin
Explanation (Approx. 300 words):
The technique described in the question is known as an “Evil Twin” attack.
An Evil Twin is a type of cyberattack where a threat actor sets up a malicious Wi-Fi network that mimics a legitimate one. The goal is to trick users into connecting to the fake network, often because it has the same name (SSID) and may have a stronger signal than the real one.
Once a user connects, they are typically redirected to a fake captive portal—a web page that appears authentic and prompts the user to enter login credentials or sensitive information such as a network password. Since many public Wi-Fi networks require sign-in or acceptance of terms, users often don’t suspect the portal is fake.
The attacker then harvests these credentials, which can be used for unauthorized access to networks, systems, or personal accounts. This type of attack is particularly dangerous in public spaces like airports, hotels, or cafes, where users are often seeking free Wi-Fi and may not carefully check the network they are joining.
Let’s review the other options to clarify:
- B. Whaling: This is a type of phishing attack targeting high-profile individuals like executives or politicians.
- C. Insider threat: This involves someone within an organization (e.g., an employee) misusing their access to cause harm.
- D. Spoofing: Refers to impersonating a trusted device or user (e.g., email or IP address spoofing), but it’s broader and doesn’t specifically describe the fake Wi-Fi and captive portal scenario.
Thus, the best answer for the described scenario—where a threat actor lures users into connecting to a fake Wi-Fi network with a bogus login page—is clearly:
✅ A. Evil twin.