In this paper, we introduce a powerful hardware-based rogue access point (PrAP), which can relay back and forth traffic between a legitimate AP and a wireless station, and act as a man-in-the-middle attacker. Our PrAP is built of two dedicated wireless routers interconnected physically, and can relay traffic rapidly between a station and a legitimate AP. Through experiments, we demonstrate that the state-of-the-art time-based rogue AP (rAP) detectors cannot detect our PrAP, although perhaps effective against software-based rAP. In demonstrating that, we unveil new insight into fundamentals of time-based detectors for software-based rAPs and their operation: such techniques are only capable of detecting rAPs due to the speed of wireless AP bridging. To address the threat of such PrAPs, we propose a new tool for network administrators, a PrAP-Hunter based on intentional channel interference. Our PrAP-Hunter is highly accurate, even under heavy traffic scenarios. Using a high-performance (desktop) and low-performance (mobile phone) experimental setups of our PrAP-Hunter in various deployment scenarios, we demonstrate close to 100 percent of detection rate, compared to 60 percent detection rate by the state-of-the-art. We show that our PrAP-Hunter is fast (takes 5-10 seconds), does not require any prior knowledge, and can be deployed in the wild by real-world experiments at 10 coffee shops.

中文翻译：

---

如果可以，请抓住我：使用故意信道干扰检测恶意接入点

在本文中，我们介绍了一个强大的基于硬件的恶意接入点 (PrAP)，它可以在合法 AP 和无线站之间来回中继流量，并充当中间人攻击者。我们的 PrAP 由两个物理互连的专用无线路由器构建而成，可以在站点和合法 AP 之间快速中继流量。通过实验，我们证明了最先进的基于时间的流氓 AP (rAP) 检测器无法检测到我们的 PrAP，尽管可能对基于软件的 rAP 有效。在证明这一点时，我们揭示了对基于时间的检测器的基本原理的新见解，用于基于软件的 rAP 及其操作：由于无线 AP 桥接的速度，此类技术只能检测 rAP。为了解决此类 PrAP 的威胁，我们为网络管理员提出了一种新工具，基于故意信道干扰的PrAP-Hunter。即使在交通繁忙的情况下，我们的 PrAP-Hunter 也非常准确。在各种部署场景中使用我们的 PrAP-Hunter 的高性能（桌面）和低性能（移动电话）实验设置，我们展示了接近 100% 的检测率，相比之下，状态检测率为 60% -艺术。我们展示了我们的 PrAP-Hunter 速度快（需要 5-10 秒），不需要任何先验知识，并且可以通过在 10 家咖啡店的真实世界实验部署在野外。我们展示了接近 100% 的检测率，而最先进的检测率为 60%。我们展示了我们的 PrAP-Hunter 速度快（需要 5-10 秒），不需要任何先验知识，并且可以通过在 10 家咖啡店的真实世界实验部署在野外。我们展示了接近 100% 的检测率，而最先进的检测率为 60%。我们展示了我们的 PrAP-Hunter 速度快（需要 5-10 秒），不需要任何先验知识，并且可以通过在 10 家咖啡店的真实世界实验部署在野外。