## 3 Critical Analysis of Selected Literature
### Evil Twin Exploitation Technique  
As our focus is air-gapped networks, one of the ways to attack an isolated network is through **vulnerable** employees or rogue staff, for instance, a malicious Wi-Fi dongle IoT device with the same SSID as a valid corporate Wi-Fi SSID is attached by the attacker. To penetrate the air-gapped network and gain access to the camera's video feeds, the attacker copies the entire network and sniffs the username, password, and other pertinent information, as shown on Figure 6. According to the guides that can be easily found on the internet and different IT forums, the steps for this attack include (1) sniffing the packets in and around the network using the airodump-ng command; (2) identifying the Wi-Fi network that you want to clone; (3) setting up the evil twin access point (AP) using the airbase-ng command with the same SSID name as the legitimate one; (4) setting up a DHCP server to allocate the IP address and network submask for rogue access point and for clients and resolve DNS requests; (5) cut down the connection to the legitimate AP using the command aireplay-ng -death 0, which will send an infinite number of disassociate packets to the legitimate AP. A user with significantly greater access rights to the video system equipment or firewall unintentionally connects to the evil Wi-Fi that the attacker has broadcasted. At this point, all traffic is going through the evil twin, which is capturing sensitive information. A more significant **impact** can occur if an external attacker gains access to the target organization's network through the further exploitation of a vulnerable camera. This could lead to a chain reaction of security breaches, including infecting additional computers within the network and gaining unauthorized access to sensitive and confidential data. **Use case:** In 2020, an Interior IG IT team used an evil twin to deploy a fake access point with the same name as a true access point, and then recorded the credentials of all users attempting to log on. In this way, Wi-Fi networks of four departments were hacked [33]. **Security measures:** One of the innovative measures in the discovery of evil twin exploitation, as analyzed by [PERSON] et al. [30], involves using augmented reality to detect changes in network topology. However, this measure is often more for educational purposes than effective prevention. In practice, the primary defense against such attacks must come from the system administrator. Simpler mechanisms for mitigating this type of vulnerability, but which are still vulnerable to misconfiguration, include network segmentation and the use of authentication methods to restrict connections to rogue access points without proper digital certificates. Current methods for detecting evil twin attacks rely on various types of device information, such as MAC addresses or SSID names [34, 35], signal strength indicators (RSSIs) [36, 37] and network traffic analysis, including TCP/IP header inspection [38], monitoring changes in Simple Network Management Protocol (SNMP) MIBs like tcpActiveOpens, tcpPassiveOpens, and tcpAttemptFails, and the use of access  
Figure 6: Exploitation diagram for the evil twin exploitation technique in a logically air-gapped network. control lists [39]. [PERSON] et al. [40] pointed out that evil twin access points can enable an attacker to conduct further attacks, such as man-in-the-middle, flooding the network with useless data, denial of service, and service disruption. The authors emphasize the use of 802.1X-based authentication, which applies an extensible authentication protocol and leverages digital certificates for authentication and Video Server validation. To strengthen authentication, the blockchain mechanism can be used instead of digital certificates [41, 42, 43].