Summary. Web-based authentication is a popular mechanism implemented by Wireless Internet Service Providers (WISPs) because it allows a simple registration and authentication of customers, while avoiding high resource requirements of the new IEEE 802.11i security standard and backward compatibility issues of legacy devices. In this work we demonstrate two different and novel attacks against web-based authentication. One attack exploits operational anomalies of low-and middle-priced devices in order to hijack wireless clients, while the other exploits an already known vulnerability within wired networks which, in dynamic wireless environments, turns out to be even harder to detect and protect against.
Martinovic et al. proposed two different and novel attacks against web-based authentication in wireless environment REF .
Phishing in the Wireless: Implementation and Analysis
In Proceedings of the 22nd IFIP International Information Security Conference (SEC 2007
Computer Science