WA man faces charges for alleged evil twin attack

A Western Australian man is facing cybercrime charges for allegedly creating fake wifi networks that mimicked legitimate ones at airports, on flights, and at other locations.

Image credit: Australian Federal Police.

The 42-year-old allegedly harvested “dozens” of personal credentials from people that tried to connect to the insecure and fraudulent free wifi networks.

Australian Federal Police cybercrime investigators allege that the networks were operated “at airports in Perth, Melbourne and Adelaide, on domestic flights and at locations linked to the man’s previous employment.”

“Analysis is ongoing to determine the extent of the alleged offending,” the Federal Police said in a statement.

The investigation began in April after an airline “reported concerns about a suspicious wifi network identified by its employees during a domestic flight.”

A search of the man’s hand luggage at Perth Airport in mid-April resulted in the seizure of “a portable wireless access device, a laptop and a mobile phone”, police said.

“Police allege the man used a portable wireless access device to create ‘evil twin’ free wifi networks, which he used at multiple locations to lure unsuspecting users into believing they were legitimate services,” the AFP said in a statement.

“The AFP alleges that when people tried to connect their devices to the free wifi networks, they were taken to a fake webpage requiring them to sign in using their email or social media logins. 

“Those details were then allegedly saved to the man’s devices.

“The email and password details harvested could be used to access more personal information, including a victim’s online communications, stored images and videos or bank details.”

The AFP added that “anyone who connected to free wifi networks in airport precincts and on domestic flights is recommended to change their passwords and report any suspicious activity on their accounts via cyber.gov.au.”

The man is facing a number of charges, the most serious of which is unauthorised impairment of electronic communication, which carries a maximum penalty of 10 years’ imprisonment.