Wireless Security Overview
Wireless security concerns mirror wired security — the same requirements apply: confidentiality, integrity, availability, authenticity, and accountability. The difference is the medium: the most significant source of risk in wireless is the underlying communications medium itself — radio waves anyone nearby can intercept.
Core idea
Wired networks confine your signal to a cable. Wireless broadcasts it through open air — there's no way to physically stop someone from listening in; you can only make what they hear useless (encryption).
Wireless Network Modes (802.11)
802.11 wireless networks operate in two basic modes:
- Each wireless client connects directly to a central Access Point (AP)
- No direct connection between wireless clients themselves
- The AP acts as a wireless hub, handling all connections between clients
- Each wireless client connects directly with each other — no central device
- Enables rapid deployment of a temporary network where no infrastructure exists (e.g. disaster response)
- Each node must maintain its own authentication list
Key Factors Contributing to Wireless Risk
Mnemonic — C.M.R.A
"Careless MonkeysRarely Attend" = Channel, Mobility, Resources, Accessibility — the four risk factors baked into every wireless network.
Wireless Networking Components (Points of Attack)
1. Wireless Client
Wi-Fi laptop/tablet, cell phone, Bluetooth device, etc.
2. Access Point
Cell towers, Wi-Fi hotspots, wireless routers.
3. Transmission Medium
The air itself — carries the radio signals between client and AP.
Wireless Network Threats
Accidental Association
A device unintentionally connects to a neighboring/overlapping wireless network.
Malicious Association
Attacker's AP tricks a client into associating with it instead of the legitimate one.
Ad Hoc Networks
Unmanaged peer networks that bypass normal security controls.
No Central Point of Control
Makes it harder to enforce consistent security policy across all devices.
Non-Traditional Networks
Bluetooth, PDAs — vulnerable to spoofing and eavesdropping.
Identity Theft (MAC Spoofing)
Attacker clones a legitimate device's MAC address to impersonate it.
Man-in-the-Middle Attacks
Attacker secretly relays/alters communication between two parties.
Denial of Service (DoS)
Jamming or flooding disrupts wireless availability.
Network Injection
Bogus reconfiguration commands sent to routers/switches to degrade performance.
Mnemonic — A Whole Zoo of Threats
"A Man Always Nags Idiots Nonstop, Denying Control" = Accidental association, Malicious association, Ad hoc networks, Nontraditional networks, Identity theft, Network injection, DoS, no Central point of control, Man-in-the-middle. Nine threats swarming any open-air network.
Securing Wireless Networks — the Basics
Foundational Steps
- Use encryption
- Enable anti-virus, anti-spyware, and a firewall
- Turn off SSID broadcasting
- Change the default identifier on the router
Physical / Access Steps
- Change the router's preset password
- Apply MAC filtering
- Reduce signal strength (away from windows/exterior walls)
- Use directional antennas
IEEE 802.11 Wireless LAN
IEEE 802 is the committee responsible for LANs in general. IEEE 802.11 is the sub-committee responsible for developing wireless protocols specifically (with many sub-standards). The Wi-Fi Alliance became popular starting with 802.11b, and it's the body behind WPA/WPA2 branding.
Physical Layer
Encodes/decodes the radio signals.
MAC Layer
Assembles/disassembles MAC frames and performs address recognition.
LLC Layer
Keeps track of frame transmission.
A MAC frame (MPDU — MAC Protocol Data Unit) is the basic unit exchanged at this layer.
Extended Service Set (ESS)
Wireless Security: WEP → WPA → WPA2 → WPA3
Four generations of 802.11 security, each fixing the last one's flaws:
WEP — Wired Equivalent Privacy
The original native security mechanism for WLANs. Provides confidentiality (protects against eavesdropping), access control (prevents unauthorized access), and message integrity (prevents tampering) — in theory giving users a level of privacy "equivalent" to a wired network.
How WEP Works
WEP Flaws
Weak keys: attacker can discover the default key used by the AP/clients, decrypting all traffic. IV reuse & small size: only ~2²⁴ different IVs exist — on a busy network the IV is reused, letting the original message be recovered relatively easily. Result: WEP-encrypted networks can be cracked in as little as 10 minutes by collecting enough IVs (attackers can speed this up by injecting packets to generate more IVs faster).
WPA — Wi-Fi Protected Access
Introduced in 2002 as a replacement for WEP's security flaws. Improved data encryption and strong user authentication. Because static keys caused so many WEP attacks, WPA minimizes the shared secret key's exposure in line with frame transmission — still uses RC4, but more properly, providing fast data transfer before an attacker can decrypt it.
WPA2 — Wi-Fi Protected Access 2
Based on the IEEE 802.11i standard. Comes in two versions: Personal and Enterprise. The primary enhancement over WPA is use of the AES (Advanced Encryption Standard) algorithm — encryption is done via AES or TKIP.
WPA2 has immunity against:
- Man-in-the-middle attacks
- Authentication forging
- Replay attacks
- Key collision
- Weak keys
- Packet forging
- Dictionary attacks
WPA3 — the latest generation
WPA3 superseded WPA2 in 2018. Note: WPA3 support isn't automatic — devices need new WPA3-capable hardware or a manufacturer update.
New features:
- 256-bit Galois/Counter Mode Protocol encryption (GCMP-256)
- 384-bit Hashed Message Authentication Mode (HMAC)
- 256-bit Broadcast/Multicast Integrity Protocol (BIP-GMAC-256)
Mnemonic — WEP, WPA, WPA2, WPA3 Timeline
"Weak Eggs Poach; We Protect Assets; We Protect Assets 2x; We Protect Assets 3x" — WEP (weak, RC4 + tiny IV, crackable in 10 min) → WPA (2002, better RC4 usage) → WPA2 (802.11i, AES, immune to MITM/replay/dictionary) → WPA3 (2018, GCMP-256/HMAC-384/BIP-GMAC-256). Each generation literally doubles down on "Protect."
| Standard | Year / Basis | Cipher | Key Weakness / Strength |
|---|---|---|---|
| WEP | Original 802.11 | RC4 | Weak keys, small/reused IV → cracked in ~10 min |
| WPA | 2002 | RC4 (improved use) | Fixed static-key weaknesses of WEP |
| WPA2 | 802.11i | AES / TKIP | Immune to MITM, replay, dictionary attacks, key collision |
| WPA3 | 2018 | GCMP-256 | 384-bit HMAC, 256-bit BIP-GMAC-256; hardware support required |
Securing Wireless Transmission & the Access Point
Securing Transmission
- Signal hiding / SSID hiding
- Reduce signal strength
- Encrypt all wireless transmissions
Securing the Access Point
- Disallow unauthorized access to the AP
- Require authentication for any device attaching to the AP
Use Encryption
MAC-filter Access
Anti-virus/spyware + Firewall
Change Default Router Password
Turn Off SSID Broadcasting
Change Router Identifier from Default
Association Services
Association
Establishes the initial link between a station and an AP.
Reassociation
Transfers an established association from one AP to another, letting a mobile station roam between BSSs.
Disassociation
A notification (from either station or AP) that an existing association has ended.
Wireless Hacking Methodology
Attackers follow a structured methodology to make sure they find every entry point into the target wireless network:
Wi-Fi Discovery
Footprint the wireless network, find in-range networks (including via Wi-Fi chalking symbols), locate WPS-enabled APs, and use discovery tools.
GPS Mapping
Geolocate discovered access points to build a physical map of targets.
Wireless Traffic Analysis
Capture and analyze traffic to learn about the network before attacking.
Launch of Wireless Attacks
Execute the actual attacks — see the sub-attacks below (Aircrack-ng, hidden SSID detection, MAC spoofing, DoS, MITM, rogue AP, evil twin, misconfigured AP, ad hoc connection attack, jamming).
Wi-Fi Encryption Cracking
Crack WEP (or weaker WPA) encryption to gain full network access.
Mnemonic — D.G.T.L.C
"Don't Go Talk, Listen Carefully" = Discovery → GPS mapping → Traffic analysis → Launch attacks → Crack encryption. Five phases, in order, from finding the network to owning it.
Sub-Attacks Within "Launch of Wireless Attack"
Aircrack-ng Suite
The go-to toolkit for capturing packets and cracking WEP/WPA keys.
Hidden SSID Detection
Even with SSID broadcasting off, probing traffic can reveal the hidden network name.
MAC Spoofing Attack
Attacker clones an authorized device's MAC address to bypass MAC filtering.
DoS: Disassociation / Deauthentication
Forges disassociation/deauth frames to kick clients off the AP (often used to force a re-handshake capture for cracking).
Man-in-the-Middle Attack
Attacker intercepts traffic between client and AP by inserting themselves in the path.
Rogue Access Point
An unauthorized AP plugged into the network, creating a backdoor entry point.
Evil Twin
A fake AP mimicking a legitimate one's SSID to trick users into connecting.
Misconfigured AP Attack
Exploits an AP whose security settings were accidentally changed — hard to detect since it's a legitimate, authorized device.
Ad Hoc Connection Attack
Exploits peer-to-peer ad hoc mode connections that bypass normal AP-based controls.
Jamming Signal Attack
Floods the radio frequency with noise to disrupt/deny wireless service.
Both are unauthorized access points, but they differ in intent and appearance.
Any unauthorized AP connected to the network — may just be an employee's personal router plugged in without permission.
A deliberately malicious AP that copies a legitimate SSID to lure users into connecting so the attacker can intercept their traffic.
- SSID Broadcast (leaves the network name discoverable)
- Weak Password (easy to guess/crack)
- Configuration Error (unintended change in AP security settings)
Because it's a legitimate device on the network, a misconfigured AP won't trigger alerts even while being abused — making it especially dangerous.
Wi-Fi Encryption Cracking & Defenses
Since WEP relies on a small, reusable IV space, the attacker's job is simply to collect enough IVs (by capturing or injecting packets) until the key can be mathematically derived. This is why WEP networks fall in minutes with tools like Aircrack-ng.
How to Defend Against Wireless Attacks
Encryption & Authentication
- Use WPA2/WPA3, never WEP
- Use strong, unique passwords / enterprise 802.1X authentication
- Disable WPS if not needed (common attack vector)
Network Hygiene
- Hide/disable unnecessary SSID broadcast
- Apply MAC filtering
- Regularly audit for rogue APs
- Monitor for deauth floods and jamming with wireless IDS
Exam Tips & Tricks
WEP uses RC4 + small IV
Memorize: WEP's fatal flaw is the tiny (2²⁴) IV space combined with RC4 — reused IVs let attackers recover keys in ~10 minutes.
WPA2 = AES via 802.11i
The single biggest jump from WPA to WPA2 is the addition of AES encryption, standardized under IEEE 802.11i.
WPA3 numbers
256-bit GCMP, 384-bit HMAC, 256-bit BIP-GMAC — these exact bit-lengths are exam bait.
Rogue AP ≠ Evil Twin
Rogue AP = any unauthorized AP. Evil Twin = specifically impersonates a legitimate SSID to deceive users. Don't conflate them.
Infrastructure vs Ad-hoc
Infrastructure mode = central AP required. Ad-hoc mode = clients connect directly, no AP, good for rapid/disaster deployment.
5-phase methodology
Discovery → GPS Mapping → Traffic Analysis → Launch Attack → Crack Encryption. Attacks live entirely inside phase 4.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Wireless security requirements | Confidentiality, integrity, availability, authenticity, accountability (same as wired) |
| Biggest wireless risk | The broadcast medium itself (air) — easy to eavesdrop/jam |
| Infrastructure mode | Clients connect via a central AP; no direct client-to-client links |
| Ad-hoc mode | Clients connect directly, no AP, good for rapid temporary deployment |
| Risk factors | Channel, Mobility, Resources, Accessibility |
| Attack surface components | Wireless client, Access point, Transmission medium |
| Wireless threats | Accidental/malicious association, ad hoc networks, no central control, nontraditional networks, identity theft, MITM, DoS, network injection |
| Basic hardening | Encryption, AV/firewall, disable SSID broadcast, change default ID/password, MAC filtering, reduce signal, directional antennas |
| IEEE 802 | Committee for LANs in general |
| IEEE 802.11 | Sub-committee for wireless protocols specifically |
| 802.11 layers | Physical (encode/decode), MAC (frame assembly/address recognition), LLC (tracks transmission) |
| BSS / ESS | BSS = smallest building block; ESS = 2+ BSSs connected via APs (bridges) |
| WEP | Original WLAN security; RC4 + small/reused IV; crackable in ~10 minutes |
| WPA | 2002; fixed WEP's static key issue; improved RC4 usage |
| WPA2 | 802.11i-based; adds AES; immune to MITM, replay, dictionary, key collision |
| WPA3 | 2018; GCMP-256, HMAC-384, BIP-GMAC-256; needs new hardware |
| Securing transmission | Signal/SSID hiding, reduce signal strength, encrypt everything |
| Securing the AP | Disallow unauthorized access; require authentication for all connections |
| Association | Initial link between station and AP |
| Reassociation | Moves an association from one AP to another (roaming) |
| Disassociation | Notification that an association has ended |
| Hacking methodology (5 phases) | Wi-Fi discovery → GPS mapping → traffic analysis → launch attack → crack encryption |
| Aircrack-ng | Primary toolkit for capturing/cracking WEP/WPA keys |
| MAC spoofing | Clones an authorized MAC to bypass filtering |
| Disassociation/deauth attack | Forces clients off the AP, often to capture a handshake |
| Rogue AP | Any unauthorized AP connected to the network |
| Evil Twin | Malicious AP impersonating a legitimate SSID |
| Misconfigured AP | Legitimate but insecurely configured AP; hard to detect, triggers no alerts |
| Ad hoc connection attack | Exploits peer-to-peer connections bypassing AP controls |
| Jamming attack | Floods RF spectrum with noise to deny wireless service |
| WEP cracking method | Collect enough IVs (via capture/injection) to derive the key |
| Key wireless defenses | Use WPA2/WPA3, strong passwords, disable WPS, MAC filtering, hide SSID, monitor for rogue APs/jamming |