A patron complains of a fake hotspot at a library branch. Branches publish “Library-Guest” as the official SSID. What should wireless OSINT start with?
Select an answer to reveal the explanation.
Short Explanation
Before yelling “imposter,” write down what the real library network is supposed to be called. Official names and any public BSSID vendor notes are the baseline. Knocking patrons off Wi-Fi or cloning the SSID is the opposite of OSINT.
Full Explanation
Impersonation findings require a baseline. When a patron complains of a fake hotspot at a library branch that publishes 'Library-Guest' as the official SSID, wireless OSINT should start by inventorying official SSIDs and any public BSSID or vendor details before labeling a nearby network as impersonation. That civic baseline—published names, dates, and optional OUI notes—makes later comparisons attributable and prevents false alarms based on substring coincidence.
Deauthenticating patrons so clients reveal preferred networks is an attack on library users, not research. Standing up a competing Library-Guest access point to see who connects is a rogue-AP operation outside PORP. Skipping the official list because any SSID containing 'Library' is authentic confuses naming similarity with authenticity and invites misidentification.
Exam caveat: look-alike SSIDs need careful wording; after baselining, report unexpected nearby names as observations for IT, not as finished attribution of a criminal impostor without more evidence.
Operational check: pull the branch-published SSID list and any public BSSID/vendor notes with retrieval date, then compare complained-of names against that baseline and refer mismatches to library IT—without deauth or rogue APs.