01The open medium
Radio removes the assumption that an attacker must be physically connected. Anyone in range can passively capture every frame, and anyone with a cheap adapter can transmit frames that look like they came from your access point or your laptop.
Wireless security therefore needs three things a cable never had to provide: access control (who may join), link encryption (so captures are useless), and mutual authentication (so clients know the AP is genuine).
- Wireshark — capturing 802.11 traffic (monitor mode)
- Kismet — passive wireless discovery and monitoring
- NIST SP 800-153 — Guidelines for Securing Wireless LANs
02From WEP to WPA3
Wi-Fi security has been rebuilt three times, each generation answering the last one's failure.
| WEP | WPA (TKIP) | WPA2 (CCMP) | WPA3 | |
|---|---|---|---|---|
| Cipher | RC4 | RC4 + per-packet keys | AES-CCMP | AES-CCMP / GCMP-256 |
| Integrity | CRC-32 (linear) | Michael MIC | CBC-MAC | CBC-MAC / GMAC |
| Personal auth | Shared key | PSK | PSK (guessable offline) | SAE |
| Forward secrecy | No | No | No | Yes |
| Management frame protection | No | No | Optional (802.11w) | Required |
03Why WEP failed
WEP is the textbook example of strong primitives assembled badly. RC4 itself was not the main problem; the way WEP fed it keys was.
Tiny IV, repeated keystream
Each packet's key was a 24-bit IV plus the shared secret. After roughly 5,000 packets an IV repeat is likely; two packets under the same keystream leak their XOR.
Weak key scheduling
Certain IVs leak bits of the secret through RC4's first output bytes. Collect enough and the key falls out statistically.
CRC is not a MAC
CRC-32 is linear, so an attacker can flip ciphertext bits and fix the checksum without knowing the key. Integrity was illusory.
One key for everyone
No key management: the same static key on every device, rarely changed, shared with every guest who ever connected.
The lesson generalizes: never reuse a stream-cipher keystream, never use a checksum where you need a MAC, and never ship a protocol without a way to rotate keys.
- Aircrack-ng documentation — the classic WEP/WPA auditing suite (lab use only)
- Borisov, N., Goldberg, I. & Wagner, D. (2001). Intercepting mobile communications: the insecurity of 802.11. ACM MobiCom.
- Fluhrer, S., Mantin, I. & Shamir, A. (2001). Weaknesses in the key scheduling algorithm of RC4. SAC.
- Tews, E., Weinmann, R.-P. & Pyshkin, A. (2007). Breaking 104 bit WEP in less than 60 seconds. WISA.
04The WPA2 4-way handshake
WPA2 never sends the password. Both sides already hold a Pairwise Master Key (PMK), derived from the passphrase and SSID or delivered by 802.1X. The handshake proves each side has it and derives a fresh per-session key from two random nonces.
Where it broke
Offline dictionary attacks: the PMK is a deterministic function of the passphrase, so a weak passphrase is only as strong as an attacker's wordlist. KRACK (2017): replaying message 3 tricked clients into reinstalling an in-use key and resetting nonces, enabling decryption and injection. It was a flaw in the standard itself, so nearly every device needed a patch.
- krackattacks.com — attack explanation and demonstration
- hashcat — WPA/WPA2 auditing (mode 22000) — why passphrase length matters
- Vanhoef, M. & Piessens, F. (2017). Key reinstallation attacks: forcing nonce reuse in WPA2. ACM CCS.
- He, C. & Mitchell, J. (2005). Security analysis and improvements for IEEE 802.11i. NDSS.
05WPA3 and SAE
WPA3-Personal replaces the PSK-based PMK with SAE (Simultaneous Authentication of Equals, the "Dragonfly" exchange): a password-authenticated key exchange in which each side proves knowledge of the password through an elliptic-curve exchange that reveals nothing an eavesdropper can test offline.
No offline guessing
Each guess requires a live interaction with the AP, which can rate-limit it. A captured handshake is worthless to a cracker.
Forward secrecy
Every session gets an independent key. Learning the password later does not decrypt recorded past traffic.
Protected management frames
802.11w is mandatory, so forged deauthentication and disassociation frames are rejected.
Enhanced Open (OWE)
Open networks (cafés, airports) get unauthenticated Diffie–Hellman encryption, so passive sniffing no longer works even without a password.
WPA3 was not flawless at launch. The Dragonblood research found timing and cache side channels in early SAE implementations and downgrade paths in WPA2/WPA3 transition mode. Fixes include hash-to-curve (H2E) password element derivation, which removed the timing leak.
- Dragonblood — analysis of WPA3's Dragonfly handshake
- RFC 7664 — Dragonfly key exchange · RFC 8110 — Opportunistic Wireless Encryption
- hostapd — open-source AP software for WPA3 lab setups
- Vanhoef, M. & Ronen, E. (2020). Dragonblood: analyzing the Dragonfly handshake of WPA3 and EAP-pwd. IEEE S&P.
06Shared key vs. per-user authentication
A pre-shared key is one secret for every device. It cannot tell users apart, cannot revoke one person, and must be changed everywhere when anyone leaves. Enterprise mode replaces it with 802.1X: each user or device authenticates individually against a central server, and each session gets its own PMK.
| EAP method | Client proves identity with | Notes |
|---|---|---|
| EAP-TLS | Client certificate | Strongest; no passwords to phish. Needs device PKI. |
| PEAP / EAP-TTLS | Username + password inside TLS | Common. Safe only if clients validate the server certificate. |
| EAP-pwd / SAE-based | Password via PAKE | No certificates, resists offline guessing. |
The most common enterprise failure is clients configured to accept any server certificate. An attacker's fake AP then completes PEAP and collects password hashes.
- FreeRADIUS documentation
- RFC 3748 — EAP · RFC 5216 — EAP-TLS
- Bartoli, A., Medvet, E. & Onesti, F. (2018). Evil twins and WPA2 Enterprise: a coming security disaster? Computers & Security, 74.
07Common wireless attacks
Evil twin
An attacker AP with the same SSID. Devices pick it by signal strength. Defeated by SAE (attacker lacks the password) and by strict server-certificate validation in enterprise mode.
Rogue AP
An unauthorized AP plugged into the wired network, often by an employee for convenience. It bypasses every perimeter control. Found with wireless surveys and switch-port controls.
Deauthentication
Unauthenticated management frames kick clients off at will, forcing handshake captures or pushing them to an evil twin. Stopped by 802.11w PMF.
WPS PIN
The 8-digit setup PIN is checked in two halves, so about 11,000 guesses recover it, and the passphrase with it. Disable WPS.
Jamming
Raw RF interference. No cryptography helps; detection and physical response are the only defenses. Availability always depends on the medium.
Implementation flaws
FragAttacks (2021) showed frame aggregation and fragmentation design flaws dating to 1997 affecting every generation, including WPA3.
- fragattacks.com — fragmentation and aggregation attacks
- WiGLE — crowdsourced map of wireless networks, showing how visible SSIDs are
- Bellardo, J. & Savage, S. (2003). 802.11 denial-of-service attacks: real vulnerabilities and practical solutions. USENIX Security.
- Vanhoef, M. (2021). Fragment and forge: breaking Wi-Fi through frame aggregation and fragmentation. USENIX Security.
08Designing a secure wireless network
Strong link encryption is the start, not the end. A wireless network should be treated as just another untrusted access segment and fenced off accordingly.
Baseline
WPA3 (or WPA2-AES with PMF in transition), WPS off, TKIP off, long random passphrases, firmware patched.
Identity
802.1X with EAP-TLS for managed devices; clients pinned to the RADIUS server's CA and name.
Monitoring
A wireless IDS (WIDS) to detect rogue and twin APs, deauth floods, and unusual probes; periodic site surveys.
Physical
Tune transmit power and antenna placement so coverage stops near the walls, and secure APs against tampering.
The 2007 TJX retail breach shows the cost of skipping these steps: attackers cracked WEP at a store, then used that foothold to reach central payment systems over an unsegmented network and remained undetected for many months, exposing tens of millions of card records.
- CIS Controls — including wireless access control safeguards
- PCI DSS document library — wireless requirements for cardholder environments
- Vanhoef, M. & Piessens, F. (2016). Predicting, decrypting, and abusing WPA2/802.11 group keys. USENIX Security.
09Common misconceptions
—References
Peer-reviewed
- Bartoli, A., Medvet, E. & Onesti, F. (2018). Evil twins and WPA2 Enterprise: a coming security disaster? Computers & Security, 74. doi:10.1016/j.cose.2017.12.011
- Bellardo, J. & Savage, S. (2003). 802.11 denial-of-service attacks. USENIX Security. usenix.org
- Borisov, N., Goldberg, I. & Wagner, D. (2001). Intercepting mobile communications. ACM MobiCom. doi:10.1145/381677.381695
- Fluhrer, S., Mantin, I. & Shamir, A. (2001). Weaknesses in the key scheduling algorithm of RC4. SAC. doi:10.1007/3-540-45537-X_1
- He, C. & Mitchell, J. (2005). Security analysis and improvements for IEEE 802.11i. NDSS. ndss-symposium.org
- Tews, E., Weinmann, R.-P. & Pyshkin, A. (2007). Breaking 104 bit WEP in less than 60 seconds. WISA. doi:10.1007/978-3-540-77535-5_14
- Vanhoef, M. (2021). Fragment and forge. USENIX Security. usenix.org
- Vanhoef, M. & Piessens, F. (2016). Predicting, decrypting, and abusing WPA2/802.11 group keys. USENIX Security. usenix.org
- Vanhoef, M. & Piessens, F. (2017). Key reinstallation attacks. ACM CCS. doi:10.1145/3133956.3134027
- Vanhoef, M. & Ronen, E. (2020). Dragonblood. IEEE S&P. doi:10.1109/SP40000.2020.00031