[gipsies]

This is misleading. When using WPA the client and access point perform mutual authentication. This means that if you don't know the password, you cannot set up a rogue access point that "copies the target access point's settings". Because you don't know the password! And if you'd use a random password, the client will refuse to connect to the rogue AP.

The tool is actually creating a second, unencrypted network. On Windows it will give you a warning that the configuration of the network has changed. On Android you'd have to manually reconnect to the unencrypted network. So their method doesn't automatically perform a man-in-the-middle attack. A decent setup will warn you about this. Sure, if a user ignores all OS warnings, connects to an unencrypted network anyway, and feels the need to type his password in random fields s/he never saw before, then this will work [3].

What would be more interesting is to jam the target network, using an actual jammer [1], and then perform a KARMA man-in-the-middle attack [2]. The idea is to listen for probe requests to unencrypted networks, and then clone that unencrypted network. In this case the user would automatically connect, making the attack more likely to succeed...

[1] http://people.cs.kuleuven.be/~mathy.vanhoef/papers/acsac2014...

[2] http://www.theta44.org/karma/

[3] Perhaps I'm a bit cynical, but I suppose it might actually work some of the time... :(

[vletmixutechre]

I suspect many average end-users will click 'whatever' in order to try to make things work again.

[bjornsing]

Or setup an exact replica of the targeted device's (WPA-protected) home AP, and then tunnel the raw encrypted 802.11 frames back to that AP over the Internet. Ta-da - your target now has absolutely seamless remote access to their own home Wi-Fi, with mutual authentication and end-to-end hardware accelerated AES encryption. :P

Only "drawback" (if you're of a malicious nature) is that you can't do any evil. The only thing you'll see is the raw encrypted Wi-Fi traffic, flowing straight through your "rogue AP" and into the Wi-Fi over IP tunnel. :)

Disclaimer: That's what http://anyfi.net does and I'm on the team that built it.

[HackinOut]

Yes, that is why this password is called a Pre-Shared Key.

[jagermo]

agree. However it is a crafty mix between a classic attack (the deauth-part) and social engineering (the password part).

The KARMA way is more elegant, however you still might have to crack the actuall pre-shared key. I'd put it in as another helpful tool that might ease your pentest approach, besides Reaver, maybe.