Other meanings of Rogue access point
Cybersecurity
A rogue access point is an unauthorized wireless access point connected to a secure network, often installed without the network administrator's knowledge. It creates a backdoor that bypasses perimeter security, allowing attackers to intercept traffic, steal credentials, or launch further attacks. Rogue access points are a primary threat in enterprise wireless security and are typically detected through wireless intrusion prevention systems (WIPS) or periodic site surveys.
A rogue access point is any wireless access point that is installed on a secure network without explicit authorization, typically by an employee or an attacker. It can be a physical device plugged into an Ethernet port or a software-based virtual AP running on a compromised host. The rogue AP often mimics a legitimate network (an evil twin) to trick users into connecting, after which the attacker can capture credentials, inject malware, or perform man-in-the-middle attacks. Unlike a misconfigured AP, a rogue AP is deliberately malicious or at least grossly negligent, and it bypasses the network's security policies and monitoring.
Detection relies on wireless intrusion prevention systems (WIPS) that scan the airwaves for unauthorized SSIDs, MAC addresses, or unusual signal patterns. Periodic site surveys using spectrum analyzers can also identify rogue devices. Once detected, administrators can locate the AP via RF triangulation and physically disconnect it. Mitigation includes enforcing 802.1X authentication to prevent unauthorized devices from joining the network, using wired-side NAC to block unknown MAC addresses, and implementing strict physical security for network ports. Regular audits and employee training reduce the risk of accidental rogues.
Rogue access points can also be created by malware that turns an infected machine into a wireless hotspot, a technique used in advanced persistent threats. Some rogues operate on non-standard channels or use directional antennas to evade detection. In penetration testing, ethical hackers deploy rogues to demonstrate vulnerabilities. A notable edge case is the 'plug-and-play' rogue: a consumer router plugged into a corporate network that creates a second, unsecured network, often without malicious intent but equally dangerous. The term also appears in legal contexts, where rogue APs have been used to commit identity theft in public Wi-Fi hotspots.
IEEE 802.11 standards and the Wi-Fi Alliance have developed protocols to mitigate rogues, including secure fast roaming and management frame protection. The Payment Card Industry Data Security Standard (PCI DSS) explicitly requires wireless scanning for rogue APs in cardholder data environments. Enterprise solutions integrate WIPS with SIEM systems for real-time alerting. Best practices include disabling unused ports, using wired-side authentication, and maintaining a current inventory of authorized APs. Despite these measures, the rise of IoT devices with wireless capabilities has expanded the attack surface, making rogue AP detection an ongoing challenge.
Rogue access points remain a top wireless security risk, and detection is a mandatory compliance requirement in many industries.
Help improve the encyclopedia. Reports go straight to the site manager.