Evil-Twin Wi-Fi Detection: Mobile Threat Defense Engine

MTD Engine Status

SEARCHING…

Risk score

0 / 100

Candidate AP

—

SSID: OfficeWiFi-5G
BSSID: —
Cert SHA-256: — vs pinned 3F9A…7C21

Blocked attempts

Data exposed

0 KB

Attacker Controls

Rogue AP boost +8 dB

MTD Configuration

Auto-block threshold 55

Certificate pinning

Phone patrol speed 1.0×

Detection log

How it works

Each access point radiates signal power that decays with distance under the log-distance path-loss model:

RSSI(d) = TxPower − 10·n·log₁₀(d / d₀)
d₀ = 1 m,  n ≈ 2.6 (indoor path-loss exponent)

The phone's radio always associates with whichever AP broadcasting the target SSID has the strongest RSSI — signal strength alone says nothing about identity, which is exactly what an evil-twin attack exploits by out-shouting the legitimate APs with the boost slider above.

The on-device MTD engine then scores the chosen AP against three independent identity checks and sums weighted penalty flags into a 0–100 risk score:

risk = 40·[BSSID ∉ trust list]
     + 45·[cert hash ≠ pinned hash]  (only if pinning is ON)
     + 15·[RSSI exceeds best trusted AP here by >12 dB]

BSSID check — the MAC address of a genuine AP is enrolled in a trust list; a clone broadcasting the same SSID almost always uses different hardware, so its BSSID is unknown.
Certificate pinning — the strongest signal: even a perfect BSSID clone cannot forge the TLS certificate pinned to the corporate network during the 802.1X/WPA-Enterprise handshake. Switch it off to see why MTD vendors treat pinning as the primary evil-twin defense — without it, a strong-enough rogue signal alone can slip under the threshold.
RSSI anomaly — a weak secondary signal: real APs are fixed and calibrated, so a sudden signal far stronger than any known-good AP at this location is itself a soft indicator of a rogue transmitter forcing association.

When the score reaches the auto-block threshold, the MTD engine refuses the association before any traffic flows — the connection you see in the log as BLOCKED. Below threshold, the phone connects; if that AP was in fact the rogue twin, simulated data continues to flow to the attacker for as long as the link stays up.

Trusted AP Rogue evil-twin AP Phone (safe link) Phone (compromised)

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.