1. Have access to their computer to retrieve the wpa key.
2. Create a clone of the wifi network, spoof a bunch of sites and hope to catch one that doesn't use http.
Why can't I replace step 2 with: Install a root kit since I already have access to their machine.
1. Find some one to steal a key from but which I don't care about.
2. Locate a third person that I want to target and move close to them in non office hours.
3. Create a clone of their wifi and try to spoof some website. Hopefully I can be close enough to their device that it would join my clone instead of their other preferred networks.
At step 2 seems like a better idea to move close to the office and start probing around?
To get that close to the office would be very obvious. You'd have to loiter all day or set up a remote host with some power.
To get near a target in the wild isn't that hard, especially if you know where they like to go on a regular basis.
It's lot easier than a lot of other methods, especially for a high level target like a C-level exec who might have access to bank accounts with millions of dollars and like to work at a local coffee shop on weekends.
You don't have to spoof sites. If you capture the client they will invariably use DHCP to get an address and you can pass along that you are the web proxy for HTTP/HTTPS. Voila, all your bases are belong to us, right?
That might work nicely for plain TCP traffic, but it's not very useful for TLS encrypted connections by itself.
An attacker wants to decrypt the packets passed on as the man in the middle without alerting the victim. A big red "insecure connection" browser warning due to an untrusted certificate used by the MITM can easily thwart the attack.
To make this work, the attacker needs access to a CA the victim trusts to sign certificates on the fly. If the attack is limited to a single target page, stealing the associated private key from the legitimate website operator is an option, too.
Block port 443 and hope sites aren't configured to upgrade insecure requests.
Redirect all traffic to a site which looks like the corporation you're spoofing, asking for corporate login credentials, how many will enter them reflexively, especially with poor corporations that ask for authentication on a frequent basis.
From memory captive hotspot popups on apple devices at least don't even show the URL they have loaded, but www.targetcorp.com-secure.com etc works well in many cases.
