HP Aruba-ACNSA HPE6-A78 Question # 22 Topic 3 Discussion

A honeypot in the context of wireless networks is a rogue access point (AP) set up by an attacker to lure wireless clients into connecting to it, often to steal credentials, intercept traffic, or launch further attacks. A man-in-the-middle (MITM) attack involves the attacker positioning themselves between the client and the legitimate network to intercept or manipulate traffic.

Option D, "It examines wireless clients' probes and broadcasts the SSIDs in the probes, so that wireless clients will connect to it automatically," is correct. Wireless clients periodically send probe requests to discover available networks, including SSIDs they have previously connected to (stored in their Preferred Network List, PNL). A honeypot AP can capture these probe requests, identify the SSIDs the client is looking for, and then broadcast those SSIDs. If the honeypot AP has a stronger signal or the legitimate AP is not available, the client may automatically connect to the honeypot AP (especially if the SSID is in the PNL and auto-connect is enabled). Once connected, the attacker can intercept the client’s traffic, making this an effective MITM attack.

Option A, "It uses ARP poisoning to disconnect wireless clients from the legitimate wireless network and force clients to connect to the hacker’s wireless network instead," is incorrect. ARP poisoning is a technique used on wired networks (or within the same broadcast domain) to redirect traffic by spoofing ARP responses. In a wireless context, ARP poisoning is not typically used to disconnect clients from a legitimate AP. Instead, techniques like deauthentication attacks or SSID spoofing (as in Option D) are more common.

Option B, "It runs an NMap scan on the wireless client to find the client's MAC and IP address. The hacker then connects to another network and spoofs those addresses," is incorrect. NMap scans are used for network discovery and port scanning, not for launching an MITM attack via a honeypot. Spoofing MAC and IP addresses on another network does not position the attacker as a honeypot to intercept wireless traffic.

Option C, "It uses a combination of software and hardware to jam the RF band and prevent the client from connecting to any wireless networks," is incorrect. Jamming the RF band would disrupt all wireless communication, including the attacker’s honeypot, and would not facilitate an MITM attack. Jamming might be used in a denial-of-service (DoS) attack, but not for MITM.

The HPE Aruba Networking AOS-8 8.11 User Guide states:

"A common technique for launching a man-in-the-middle (MITM) attack using a honeypot AP involves capturing wireless clients’ probe requests to identify SSIDs in their Preferred Network List (PNL). The honeypot AP then broadcasts these SSIDs, tricking clients into connecting automatically if the SSID matches a known network and auto-connect is enabled. Once connected, the attacker can intercept the client’s traffic, performing an MITM attack." (Page 422, Wireless Threats Section)

Additionally, the HPE Aruba Networking Security Guide notes:

"Honeypot APs can be used to launch MITM attacks by spoofing SSIDs that clients are probing for. Clients often automatically connect to known SSIDs in their PNL, especially if the legitimate AP is unavailable or the honeypot AP has a stronger signal, allowing the attacker to intercept traffic." (Page 72, Wireless MITM Attacks Section)