Guests at a hotel join a wireless name that matches the front desk's posted network, but the access point is not on the hotel controller and it presents its own sign-in page. Which attack is this?
Select an answer to reveal the explanation.
Short Explanation
Someone hung a second sign over a fake storefront and your guests walked in because the name matched. That's an evil twin: a lookalike wireless name run by an access point the hotel does not control. A rogue access point that advertises some other name, or a flood that only kicks people off the real one, does not match what they joined.
Full Explanation
An evil twin is a wireless access point that advertises the same service set identifier as a legitimate network so clients associate to the attacker instead. The hotel guests selected the posted name, the access point is absent from the hotel controller, and the sign-in page belongs to that impostor. A rogue access point is any unauthorized access point. That label is the tempting one, because this radio is not on the controller, and it becomes the wrong choice when the SSID is not the name the guests actually joined. The stem's matching name is what makes the rogue an evil twin. An on-path device on the wired guest VLAN can sit between clients and the network, and it does not create a second wireless name or a wireless sign-in page. A deauthentication flood can push clients off a real access point and sometimes set the stage for an evil twin, but by itself it only causes disconnects. It does not stand up a second network with its own sign-in page. Exam caveat: call it a rogue access point when the SSID is foreign, and an evil twin when the SSID is the trusted one. Operational check: compare the BSSID clients are associated to with the BSSIDs the controller actually manages, and confirm that BSSID is advertising the posted hotel name.