Wireless & Network Security
Wireless networks extend your attack surface beyond physical boundaries. From WPA2 vulnerabilities to Bluetooth eavesdropping and IoT device exploitation, wireless security requires specialized knowledge and defensive strategies. This module covers enterprise and consumer wireless security.
WiFi Security Protocols
WiFi security has evolved through several generations. Understanding protocol weaknesses and strengths is essential for securing wireless infrastructure.
WEP (Wired Equivalent Privacy)
BrokenUses RC4 cipher with 40/104-bit keys. Vulnerable to IV collision attacks.
WPA (WiFi Protected Access)
DeprecatedUses TKIP encryption. Vulnerable to MIC attacks, packet forgery.
WAP2 (WiFi Protected Access II)
Secure with ConfigUses AES-CCMP encryption with 128-bit key. Requires strong passphrase.
WPA3 (WiFi Protected Access III)
RecommendedUses SAE (Simultaneous Authentication of Equals) for dragonfly key exchange.
Common Wireless Attacks
Wireless attacks exploit protocol weaknesses, misconfigurations, and human factors. Each attack requires specific tools and techniques.
Evil Twin
Attacker sets up AP with same SSID as legitimate network to intercept traffic.
Tools: Kali Linux, hostapd, dnsmasq
Defense: Verify network certificates. Use 802.1X/EAP-TLS authentication.
KRACK (Key Reinstallation Attack)
Forces reuse of encryption keys by manipulating handshake messages.
Tools: kali tools, custom scripts
Defense: Apply vendor patches. Use VPN for sensitive traffic.
Deauthentication Attack
Floods target with deauth frames to disconnect from network.
Tools: aireplay-ng, mdk3, mdk4
Defense: Monitor for unusual deauth frames. Use 802.11w protected management frames.
PMKID Attack
Captures PMKID from AP to crack WPA2-PSK without handshake.
Tools: hashcat, hcxdumptool
Defense: Use strong passphrases (>20 chars). Consider WPA3 or 802.1X.
Bluetooth Security
Bluetooth connects devices over short ranges but introduces security risks through pairing mechanisms and protocol implementations.
Bluetooth Classic
High - Legacy pairing vulnerable to Just Works attacks.
T1557.3 - Adversary-in-the-Middle
Bluetooth Low Energy (BLE)
Medium - Limited range but lacks encryption in many implementations.
T1040 - Network Sniffing
Bluetooth Mesh
Medium - Network key compromise affects entire mesh network.
T1557.2 - ARP Cache Poisoning
IoT Device Security
Internet of Things devices multiply entry points into networks. Their constrained resources and diverse hardware make them challenging to secure.
Default Credentials
Manufacturers ship devices with hardcoded usernames/passwords.
Unencrypted Communications
Traffic between device and cloud unencrypted or weakly encrypted.
Firmware Updates
No secure update mechanism or infrequent security patches.
Physical Access
Tampering with device hardware exposes secrets, modifies behavior.
Key Takeaways
- WPA3 is the current standard—WEP, WPA, TKIP are all broken or deprecated.
- Evil twin attacks require user verification—certificate pinning or 802.1X.
- IoT devices need network segmentation—separate VLAN with restricted access.
- Bluetooth data should be encrypted at application layer—protocol alone insufficient.