Rogue Access Point Detection

Relevant source files

The following files were used as context for generating this wiki page:

• app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt
• app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt
• app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt
• app/src/main/kotlin/com/shadowcheck/mobile/data/Entities.kt

The Rogue Access Point (AP) Detection system is a core security component of the ShadowCheck Mobile platform designed to identify malicious or unauthorized wireless infrastructure. It analyzes environmental WiFi data to detect common attack vectors such as Evil Twins, WiFi Pineapples, and hidden surveillance networks.

This module operates by correlating real-time scan results from background services with known threat patterns and heuristic scoring models. It provides users with visual alerts and detailed suspicion indicators to mitigate risks of credential harvesting and Man-in-the-Middle (MitM) attacks.

System Architecture and Data Flow

The detection system relies on a multi-layered architecture where raw signal data is captured by background services, persisted in a local database, and then processed by specialized detection logic.

The diagram shows the flow from raw hardware scanning to the end-user interface.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/service/CompleteScannerService.kt:47-81, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:15-30, app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:119-166

Detection Mechanisms and Heuristics

ShadowCheck employs several specific heuristic checks to identify rogue infrastructure. These are categorized by their technical signatures and assigned suspicion scores.

Evil Twin Detection

The system groups all detected networks by their SSID. If multiple Access Points (BSSIDs) are broadcasting the same SSID—especially in environments where this is unexpected—the system flags a potential "Evil Twin" attack.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:133-138, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:66-81

Suspicious Hardware Identification

The detector inspects the BSSID (MAC address) of networks to identify vendors often associated with security tools or anomalies:

• WiFi Pineapple Detection: Specifically searches for SSIDs containing keywords like "Pineapple", "attwifi", or "xfinitywifi" combined with open security profiles.
• OUI Analysis: MAC addresses starting with suspicious or spoofed prefixes (e.g., 00:00:00 or FF:FF:FF) are penalized with higher suspicion scores.
  Sources: app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:151-155, app/src/main/kotlin/com/shadowcheck/mobile/domain/model/SurveillanceDetector.kt:120-143

Signal and Configuration Anomalies

The system evaluates the physical and logical configuration of the network:

Indicator	Threshold/Logic	Suspicion Score
Hidden Signal Strength	SSID is empty AND Signal > -50 dBm	+0.3
Weak Encryption	Capabilities do not contain "WPA"	+0.2
Open Common Name	SSID in ["Free WiFi", "Guest"] AND No WPA	+0.4
Unusual Proximity	Signal > -30 dBm	High Severity

Sources: app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:125-156, app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:156-167

Real-time Monitoring and Threat Events

The NetworkMonitorService provides active defense by listening to system-level connectivity changes. This is particularly effective for detecting "Deauthentication Attacks," which are often precursors to forcing a device onto a Rogue AP.

This sequence illustrates how disconnect reasons are mapped to threat detections.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:79-106, app/src/main/kotlin/com/shadowcheck/mobile/service/NetworkMonitorService.kt:135-151

Data Structures

The system uses specific data models to represent and communicate detected threats.

RogueAPCandidate

Used specifically in the Rogue AP UI to represent a single suspicious network and the logic behind its classification.

• network: The raw WifiNetwork object.
• suspicionScore: A float from 0.0 to 1.0.
• reasons: A list of strings detailing specific triggers (e.g., "Suspicious MAC address").
  Sources: app/src/main/kotlin/com/shadowcheck/mobile/ui/screens/security/RogueAPScreen.kt:14-18

Threat (Generic)

A broader model used for general threat detection throughout the app.
Sources: app/src/main/kotlin/com/shadowcheck/mobile/rebuilt/ui/screens/ThreatDetectionScreen.kt:21-30

data class Threat(
    val id: String,
    val type: String, // "Rogue AP", "Evil Twin", "Deauth Attack", etc.
    val severity: String, // "Critical", "High", "Medium", "Low"
    val title: String,
    val description: String,
    val timestamp: Long,
    val bssid: String = "",
    val signalStrength: Int = 0
)

Conclusion

The Rogue Access Point Detection system provides a comprehensive defensive layer by combining passive signal analysis with active network monitoring. By utilizing heuristic scoring based on SSIDs, BSSID OUIs, and signal strength thresholds, it enables users to identify and avoid sophisticated surveillance and interception hardware in their vicinity.