At a downtown transit hub, a malicious responder answers preferred-network probes from city tablets for popular SSIDs the devices remember, luring them to associate. Which attack behavior is this?
Select an answer to reveal the explanation.
Short Explanation
Phones shout “is CoffeeShop here?” and the attacker yells “yes!” even when it is not—that is KARMA-style lure. The tablet walks into the wrong network because it trusted its own probe list. Band steering and BSS coloring are not credential traps.
Full Explanation
At a downtown transit hub, a malicious responder that answers preferred-network probes from city tablets for popular SSIDs the devices remember is exhibiting KARMA-style opportunistic association that exploits client probe behavior for preferred SSIDs. Clients broadcasting preferred network lists can be lured to attacker APs that simply claim to be whatever was probed. Strict BSS coloring collisions that only reduce OFDMA efficiency are PHY efficiency issues, not probe lure attacks. WPA3-Enterprise 192-bit mode negotiating GCMP-256 normally is a successful strong negotiation, not an attack. Controller-based band steering moving clients from 2.4 GHz to 5 GHz is a legitimate optimization. Transit hubs with dense transient RF are fertile ground for KARMA-style lures against municipal tablets that roam and remember many networks. Exam caveat: reducing probe leakage (for example, randomized MAC policies and minimizing stored open preferred networks) complements WIPS detection of opportunistic responders. Operational check: audit preferred-network lists on city tablets, remove unnecessary open SSIDs, enable WIPS detection for KARMA-like behavior, validate that enterprise SSIDs require proper EAP and certificate checks, and train field staff not to accept unexpected associations at hubs.