Inspiration

Half of this idea came from just sitting in a coffee shop and realizing how little thought goes into connecting to WiFi. You see a name you recognize, you tap it, done. Nobody checks anything. That's the whole vulnerability right there — your phone just wants to find a network with the right name, and it'll happily connect to a total stranger's device if it says the magic word.

Then we found out this isn't even hypothetical — some guy in Australia got charged with nine cybercrimes for doing exactly this at airports, just carrying around a little wireless box and letting people connect to him instead of the real network. That sealed it. We wanted to build something that actually catches this while it's happening, not just a slide explaining why it's bad.

What it does

ALIBI listens to the WiFi around it and catches fake access points using one dead-simple rule: a real router doesn't have multiple identities. If we see one radio pretending to be five different networks, that's not suspicious — that's just a lie, full stop. The second it catches one, the detector lights up, beeps, and shoves a live alert to an app on your phone showing exactly which network is lying and what names it's using.

How we built it

The detector itself is a tiny XIAO ESP32-S3 sniffing raw WiFi packets — not connecting to anything, just eavesdropping on beacon frames flying through the air and pulling out the network name and the radio's actual hardware ID. When one radio shows up under more than one name, it flags it, blinks an LED, sets off a buzzer, and streams the whole thing over Bluetooth to an Android app we built from scratch.

For the demo, we needed something to actually attack with, so a second ESP32 running Ghost ESP plays the villain — pumping out a pile of fake network names so we could show the detector catching it live instead of just trusting us that it works.

Challenges we ran into

We bricked a WiFi Pineapple. Like, actually bricked it — mid firmware update, boom, stuck in recovery mode forever, tried everything, it just wasn't coming back. That was supposed to be our attack device. Instead of burning the rest of the night mourning it, we just swapped in a second ESP32 and honestly ended up with a cleaner setup anyway.

Also spent way too long confused why our first attack method wasn't triggering anything, before realizing it only responds if a phone is already looking for that specific network — which obviously never happens with made-up test names. Switched approaches, worked immediately.

And then Android just... didn't send notifications. No errors, no crash, just silence. Turns out Chrome on Android flat out refuses to fire notifications the normal way and makes you go through a background worker instead, which nothing tells you until you go dig for it. Bluetooth had its own version of this too — writing the password and turning on notifications back to back just silently dropped the second one, because apparently Android can only do one Bluetooth thing at a time and doesn't bother telling you that either.

Accomplishments that we're proud of

Honestly, just that it all works. Real detection, real hardware alert, real app, live demo, in one night, after losing a chunk of hours to a dead piece of hardware. And we didn't just slap together something that looks like it works — the actual detection logic is based on something that can't really be faked, so we're not standing up there hoping nobody asks a hard question about false positives.

What we learned

A lot about how WiFi packets are actually structured under the hood, way more about Android's Bluetooth quirks than we ever wanted to know, and that sometimes the right move isn't fixing the broken thing, it's putting it down and grabbing a different piece of hardware.

What's next for ALIBI

Making it remember rogue networks it's seen before instead of starting fresh every time. Handling the legit case where one real router broadcasts multiple networks properly, so we don't ever flag something that's actually fine. Getting a few of these talking to each other for actual building-wide coverage instead of one handheld unit. Maybe an iOS version. And at some point, an enclosure that doesn't look like a breadboard taped to a 9V battery.