Wireless & Mobile Security · beginner · ~10 min
- Explain the **WPA2 4-way handshake** and why it can be attacked *offline* - Describe **deauthentication** and **evil-twin / rogue-AP** attacks at a mechanism level (for defence) - Choose hardening that actually removes the risk: **WPA3**, **802.11w (PMF)**, long random passphrases, EAP/Enterprise - Detect rogue access points and deauth floods with a **WIDS** and by monitoring management frames - Keep all wireless practice inside **your own lab** (a spare AP + a device you own)
Wi-Fi security comes down to one question: can an attacker who is merely nearby — with no cable and no account — read or hijack your traffic? This lesson explains the common wireless attacks for the purpose of defending against them, then focuses on the hardening and detection that stop them.
It builds on Wi-Fi and WPA: you know WPA2/WPA3 exist; here you learn where WPA2 is weak, why, and what to change. Everything is strictly lab-only — practice only against an access point and clients you own. Testing anyone else's Wi-Fi is unauthorized access.
The defender's takeaways: strong passphrases (or Enterprise), WPA3 + Protected Management Frames, and monitoring for the tell-tale signs of an attack.
Wireless is a broadcast medium — the radio signal reaches anyone in range, so the only thing protecting it is cryptography and configuration. A weak passphrase or a missing setting (like Protected Management Frames) turns "physically nearby" into "on your network."
For defenders and auditors, wireless findings are common and high-impact: a captured handshake with a weak passphrase, or a rogue AP that clients trust, can expose an entire office. Knowing the mechanism is what lets you close it.
Definition. When a client joins a WPA2-PSK network, it and the access point run a 4-way handshake to prove they share the passphrase and to derive session keys.
Why it can be attacked. An observer in radio range can capture that handshake, then try passphrase guesses offline against it — no need to stay near the network, no lockout. So WPA2-PSK's real strength is passphrase entropy.
Mitigation: a long, random passphrase makes offline guessing infeasible; WPA3-SAE replaces this exchange with one that resists offline guessing entirely.
A deauth frame is an unauthenticated management frame that tells a client "you've been disconnected." Historically these weren't protected, so anyone could forge them to knock clients off (a denial of service) or force a handshake to capture.
Mitigation: 802.11w Protected Management Frames (PMF) authenticate management frames, so forged deauths are rejected. PMF is mandatory in WPA3.
An evil twin is a rogue access point broadcasting the same SSID as a legitimate one, hoping clients auto-connect and route traffic through the attacker.
Client --(sees two "OfficeWiFi")--> Real AP (legit)
\--> Evil twin (attacker) <-- captures/relays traffic
Defence: WPA3/Enterprise (mutual auth), certificate validation, WIDS, user awareness
Mitigation: Enterprise auth with server-certificate validation stops clients trusting a look-alike; a WIDS flags unexpected APs advertising your SSID.
Knowledge check:
No code syntax — the "grammar" is a hardening comparison you apply to any AP:
| Weak / legacy | Harden to |
|---|---|
| WEP / WPA / WPA2-PSK with short passphrase | WPA3-SAE, or WPA2 with a long random passphrase |
| Management frames unprotected | 802.11w PMF (required by WPA3) |
| PSK shared by everyone | WPA2/3-Enterprise (EAP) with per-user creds + server cert |
| Hidden-SSID "security" | Treat SSID hiding as not a control |
This is the wireless attack surface, taught for defense and only within strict authorization.
For WPA2-PSK, an attacker targets the 4-way handshake (the exchange a client and access point use to confirm they share the same passphrase).
The attacker can wait passively for a handshake, or force one. Sending a deauthentication frame (a management frame that disconnects a client) makes the client reconnect and re-send the handshake.
Once captured, the handshake is cracked offline using a wordlist. Cracking offline means the attacker does not need to stay near the network.
Defense: use a long, random passphrase, or WPA3/Enterprise.
An evil twin is a fake access point that impersonates a legitimate SSID (network name).
Victims connect to it, often automatically, because their devices auto-connect to known SSIDs. The attacker can then capture credentials or run a captive-portal phishing page.
A rogue AP is an unauthorized access point plugged into a corporate network. It bypasses the network perimeter.
Defense:
Guest Wi-Fi should be isolated from the internal network. Use its own VLAN and client isolation.
This prevents a guest, or an attacker on the guest network, from reaching internal systems.
Wireless findings go in the report with their business impact. Examples: WEP or weak PSK, rogue APs, guest-network bridging, and WPS enabled.
Again: only test wireless you are explicitly authorized to test. Capturing other people's traffic is illegal.
A defensive access-point configuration (the kind you'd set on a lab AP or in an enterprise controller), plus what a rogue-AP detector watches for. This is configuration, not an attack.
# Hardened AP profile (conceptual config, for a lab AP you own)
security = wpa3-sae # or wpa2/3-mixed during migration
pmf = required # 802.11w: authenticate management frames
passphrase = <32+ random chars> # only if PSK; prefer Enterprise
band_steering = on
wps = off # WPS PINs are a known weakness
management_vlan = isolated
# Rogue-AP / evil-twin detection (WIDS rule, conceptual):
# ALERT if an AP advertises SSID "OfficeWiFi" with a BSSID (AP hardware
# address) NOT in the approved list -> possible evil twin
# ALERT on a burst of deauthentication frames -> possible deauth attack
What it does. The profile removes the weak options (WEP/WPS, un-protected management frames) and enables WPA3 + PMF so forged deauths and offline handshake attacks stop working. The WIDS rules describe the two signals a defender monitors: an unknown AP using your SSID, and a flood of deauth frames.
Expected result. On a hardened lab AP, forged deauths are ignored (PMF), and the WIDS raises an alert if you stand up a second AP with the same SSID — exactly the behaviours you want.
Reading the hardened profile as a defender:
| Setting | What it stops | Why |
|---|---|---|
security = wpa3-sae |
Offline handshake cracking | SAE resists offline guessing |
pmf = required |
Forged deauth / mgmt-frame attacks | Management frames are authenticated |
passphrase = <32+ random> |
Wordlist attacks (if PSK) | High entropy defeats guessing |
wps = off |
WPS-PIN brute force | Removes a known weak path |
| WIDS SSID rule | Evil twin trust | Unknown BSSID on your SSID = alert |
| WIDS deauth rule | Deauth flood / capture attempt | Sudden mgmt-frame burst = alert |
The pattern: remove weak options, require WPA3/PMF, and watch for the two classic signals.
Mistake 1 — trusting a short passphrase because "WPA2 is encrypted."
Wrong: password123 on WPA2-PSK.
Why wrong: the handshake can be captured and cracked offline; weak passphrase = quick crack.
Fix: 32+ random chars, or WPA3-SAE / Enterprise.
Mistake 2 — leaving PMF off. Wrong: WPA2 without 802.11w. Why wrong: forged deauths can disconnect clients and force handshake capture. Fix: enable PMF (required by WPA3).
Mistake 3 — hiding the SSID and calling it secure. Wrong: relying on a hidden network name. Why wrong: the SSID is still discoverable and offers no cryptographic protection. Fix: use real controls (WPA3/PMF/Enterprise); treat SSID hiding as cosmetic.
Recognize it: if the plan is "nobody will guess our Wi-Fi," it's a mistake.
Questions to ask: Is PMF actually required? Is the passphrase high-entropy or a word? Are all APs advertising this SSID on my approved list?
Security & safety — detection & lab hygiene.
Beginner habits: long random passphrase; enable PMF; disable WPS; keep firmware updated. Advanced habits: move to Enterprise auth with cert validation; deploy WIDS with an approved-BSSID baseline; segment guest Wi-Fi onto its own VLAN.
Beginner 1 — Passphrase entropy. Objective: explain in 2–3 sentences why a random 32-char passphrase defeats offline cracking while summer2024 does not. Concepts: handshake, entropy.
Beginner 2 — Harden a profile. Objective: given a WPA2-PSK AP config with WPS on and PMF off, rewrite it to a hardened profile and note what each change stops. Concepts: WPA3, PMF, WPS.
Intermediate 1 — Evil-twin defence. Objective: describe two independent controls that prevent clients from trusting a look-alike AP, and how each works. Concepts: Enterprise auth, WIDS.
Intermediate 2 — Detection rules. Objective: write two WIDS alert rules (in plain English) — one for a rogue AP on your SSID, one for a deauth flood — and one likely false positive for each. Concepts: detection, baselining.
Challenge — Lab hardening + verification. Objective: for a spare AP you own, write a hardening plan (WPA3/PMF/WPS/passphrase/segmentation) and a verification step for each item (how you'd confirm it's actually in effect). Requirements: lab-only; no testing of any network you don't own. Concepts: everything in this lesson.
Next: the mobile app security model — how phones sandbox apps and where mobile findings actually concentrate.