📡 Wireless Network Security
Why WiFi is uniquely vulnerable — and how to secure it⏱ ~2 min
Wired networks are like conversations through a closed pipe — only the people at each end can hear. WiFi is like having that conversation in a room full of strangers. Anyone within range with the right tools can capture the radio signals. Encryption (WPA3) is what makes those signals unintelligible to eavesdroppers — without it, WiFi is essentially a public broadcast.
Common Wireless Threats
| Threat | What Happens | Why It's Dangerous |
|---|---|---|
| Packet Sniffing | Attacker captures raw WiFi packets with tools like Wireshark on open/unencrypted networks | On open WiFi, all unencrypted traffic (HTTP, cleartext apps) is readable |
| Rogue Access Point | Attacker sets up an unauthorized WiFi AP inside the organization's building | Employees unknowingly connect; traffic bypasses corporate security controls |
| Evil Twin Attack | Fake AP with the same SSID as a legitimate network (e.g., 'Airport_Free_WiFi') | Devices auto-connect; attacker becomes man-in-the-middle for all traffic |
| Denial of Service | Deauthentication flood sends forged 802.11 disconnect frames, kicking clients off the network | Can repeatedly disconnect specific users or all clients from an AP |
| KRACK Attack | Key Reinstallation Attack exploits WPA2 handshake to decrypt traffic | Patched in 2017; highlights that protocol-level vulnerabilities affect all implementations |
Wireless Security Protocols — Evolution
| Protocol | Year | Encryption | Status | Key Weakness |
|---|---|---|---|---|
| WEP | 1997 | RC4 (40-bit) | ❌ Broken — never use | IV reuse allows key recovery in minutes with freely available tools |
| WPA | 2003 | TKIP | ❌ Deprecated | Faster RC4 but still vulnerable; transition standard |
| WPA2 | 2004 | AES-CCMP | ⚠️ Acceptable with strong password | Vulnerable to KRACK; dictionary attacks on weak PSKs; no forward secrecy |
| WPA3 | 2018 | AES-GCMP + SAE | ✅ Current standard | SAE (Simultaneous Authentication of Equals) eliminates offline dictionary attacks |
Securing a Wireless Network — Key Controls
- •Use WPA3 (or WPA2-Enterprise with certificates if WPA3 unavailable); never WEP or WPA
- •Strong, unique WiFi password — minimum 16 characters, not a dictionary word; WPA3-SAE makes offline cracking computationally infeasible anyway
- •Change default router credentials — 'admin/admin' or 'admin/password' are the first credentials attackers try
- •Disable SSID broadcast is NOT security — tools like airodump-ng detect hidden networks instantly; it only adds inconvenience for legitimate users
- •Guest network isolation — visitors get internet access but cannot reach internal network resources
- •Wireless IDS (WIDS) — detects rogue APs and deauthentication attacks; enterprise-grade AP controllers include this
- •MAC filtering — low value; MAC addresses can be spoofed trivially; do not rely on it
- •VPN on public WiFi — encrypts traffic end-to-end even if the WiFi itself is compromised
- •Auto-join disabled — prevents devices from silently connecting to evil twin networks
You're at a coffee shop and connect to 'CoffeeShop_Free'. You notice there's another network also called 'CoffeeShop_Free' with a slightly stronger signal. You connect to the stronger one and browse normally. Later you find out your bank login was stolen. What most likely happened, and how could you have protected yourself?