At a downtown transit hub, a malicious responder answers preferred-network probes from city tablets for popular SSIDs the devices remember, luring them to associate. Which attack behavior is this?
Select an answer to reveal the explanation.
Short Explanation
Phones shout “is CoffeeShop here?” and the attacker yells “yes!” even when it is not—that is KARMA-style lure. The tablet walks into the wrong network because it trusted its own probe list. Band steering and BSS coloring are not credential traps.
Full Explanation
KARMA-class attacks exploit active probing: malicious APs or soft APs respond as if they host SSIDs the client is seeking, enabling opportunistic association and subsequent MITM. Reducing probe leakage, using carefully managed preferred networks, and validating enterprise authentication endpoints reduce this client-side risk. The stem targets recognition of probe-driven opportunistic association attacks.