Question

The Abstract and List of Alternatives, from the answer of " Explain how it would be possible to use a man-in-the-middle attack if the legitimate AP does not implement 802.11i. Also explain how a user could be persuaded to use an evil twin AP. "

Answer 1

It would possible -- ARP poisoning

ARP poisoning technique re-enable the presence of AP's that are connected to the switch/hub along with other wired client.

ARP is used to determine the MAC address of a device whose IP address is known. The ARP cache accumulates the host continues to network. If ARP cache does not have any entry for an IP address, the outgoing IP packet that efficiently request "If your IP address matches this target IP address, then please let me know what your ethrnet address is" is broadcast.

The host with target IP is expected to respond with an ARP reply, which contains the MAC address of the host. Once table is updated because of receiving the response, all the queued IP packet can now be sent. The entries in the table expires after a set time in order to account for possible hardware address change for the same IP address.

Unfortunately, the ARP does not provide for any verification that the responses are from valid hosts or that is receiving a responce as if it has sent an ARP Request.

ARP poisoning is one of the technique that enable the man-in-the-middle attack. An attacker on machine X inserts himself between two host B and C by---

i)) poisoning B so that C's IP address is associated with X's MAC address

ii)) poisoning C so that B's IP address is associated with X's MAC address

iii)) relaying the packet X receive.