AirMagnet Separates ''Evil Twins''; Fake Hot Spots Pose Serious Wi-Fi Phishing Threat.

SUNNYVALE, Calif. -- AirMagnet, the leader in wireless LAN (WLAN) security and performance solutions, addresses the "evil twin" problem that has been plaguing Wi-Fi networks for several years, but has received recent attention in the press. AirMagnet products first protected customers, such as hot spot providers and hotels, from spoofed wireless access points (APs) and similar attacks in 2002, which have recently come to be known as "evil twins."

In the "evil twin" example, a hacker sets its service identifier (SSID) to be the same as an access point at the local hot spot or coffee shop, or even a corporate wireless network. He then disrupts or disables the legitimate AP by disconnecting it, directing a denial of service against it, or creating sufficient RF interference around it with a metal or another obstacle to prevent it from communicating with nearby laptops or other devices. Users that were connected to the legitimate AP lose their connections and re-connect to the "evil twin," allowing the hacker to intercept all the traffic to that device.

"While many corporate wireless networks have security measures in place to prevent hackers from gaining access to sensitive information, users of hot spots and other public wireless networks are more at risk," said Dean Au, AirMagnet President and CEO. "The growing menace of phishing scams, and the increasing use of Wi-Fi networks for e-commerce transactions make securing these networks absolutely critical. AirMagnet customers already have the tools to locate and defeat 'evil twins' and hundreds of other Wi-Fi issues."

AirMagnet users can use remote or mobile products to identify "evil twin" and similar attacks in several different ways, at multiple stages of the process:

--AirMagnet identifies 20 different types of denial-of-service attacks, which is most often the hacker's first move in an "evil twin" attack.

--AirMagnet identifies multiple devices with the same MAC address, a circumstance that is a very good indication that a spoof is being attempted.

--AirMagnet identifies rogue devices with legitimate SSIDs that do not match up with a legitimate vendor, or are on the wrong wireless channel or band.

--AirMagnet also identifies excessive AP power cycling and configuration changes, which may indicate a failing device or tampering by a user.

--AirMagnet also identifies APs that should be active, but have gone silent (stopped transmitting), which may be a performance malfunction, but could be an indication of foul play.

About AirMagnet

Founded in 2001, AirMagnet, Inc. provides the most trusted WLAN management and security software systems in handheld, laptop and Enterprise configurations. Used by IT professionals at more than 3,000 companies worldwide in manufacturing, financial, retail, service, health care, utility, transportation, education and government sectors, AirMagnet solves Wi-Fi connection problems, tracks down unauthorized access, simplifies site surveys, and locks in unprecedented levels of network performance, security and reliability. Additional information about AirMagnet and its products is available on the Web at www.AirMagnet.com.

(C)2005 AirMagnet, Inc. All rights reserved. AirMagnet and AirWISE are registered trademarks, and the AirMagnet logo is a trademark, of AirMagnet, Inc. All other product names mentioned herein may be trademarks of their respective companies.