WiFi Security Basics: Protecting Wireless Networks

The Unique Challenges of Wireless Security

Wireless networks introduce security challenges that wired networks do not face. Radio waves propagate through walls and into public spaces, meaning anyone within range can intercept your wireless communications. Unlike wired networks where physical access is required to tap into the network, wireless attackers only need to be within signal range.

Understanding WiFi security protocols, common attack techniques, and defensive measures is essential for both home users and security professionals.

WiFi Security Protocols

Wireless security has evolved through several protocols, each addressing weaknesses in its predecessor.

WEP (Wired Equivalent Privacy)

WEP was the original WiFi security protocol, introduced in 1997. It proved catastrophically flawed. WEP uses the RC4 cipher with a static encryption key and a 24-bit initialization vector (IV), which guarantees IV reuse after enough traffic. Tools like aircrack-ng can crack WEP keys in minutes by capturing enough packets. WEP is considered completely broken and should never be used.

WPA (WiFi Protected Access)

WPA was an interim solution designed to address WEP's most critical flaws without requiring hardware upgrades. It introduced TKIP (Temporal Key Integrity Protocol), which dynamically changed keys to prevent the IV reuse attack that broke WEP. However, TKIP itself was later found to have vulnerabilities, particularly the Beck-Tews attack and the Michael MIC countermeasure exploit.

WPA2

WPA2 replaced WPA as the mandatory WiFi security standard in 2004. It introduced CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) based on AES encryption, a significant improvement over TKIP. WPA2 supports two authentication modes:

Despite its strength, WPA2 has vulnerabilities. The KRACK (Key Reinstallation Attack) exploit discovered in 2017 targets the four-way handshake to force nonce reuse, allowing attackers to decrypt traffic.

{@visual wpa-handshake-capture}

WPA3

WPA3, introduced in 2018, addresses WPA2's weaknesses. Key improvements include:

WPA3 is backward compatible with WPA2 devices through transition mode, though this can introduce weaknesses if not configured carefully.

Common WiFi Attacks

Evil Twin Attack

An evil twin is a rogue access point that mimics a legitimate WiFi network. The attacker sets up an access point with the same SSID as a nearby legitimate network. Unsuspecting users connect to the evil twin, allowing the attacker to intercept traffic, steal credentials, or serve malicious content.

Detecting evil twins requires monitoring for multiple access points with the same SSID but different BSSID (MAC addresses). WPA2-Enterprise with certificate validation can prevent this attack by verifying the access point's identity.

Deauthentication Attack

Deauthentication attacks send forged deauth frames to disconnect clients from an access point. Since WiFi management frames are typically unencrypted (even on WPA2 networks), an attacker can broadcast deauth packets with a spoofed source address, disconnecting all clients.

This attack enables several malicious activities: forcing clients to connect to an evil twin, capturing the WPA handshake for offline cracking, or simply disrupting network connectivity. WPA3's Protected Management Frames help prevent this attack.

KRACK Attack

KRACK (Key Reinstallation Attack) exploits a vulnerability in the WPA2 four-way handshake. By manipulating and replaying handshake messages, the attacker forces the client to reinstall an already-in-use encryption key. This causes nonce reuse, enabling decryption of subsequent traffic.

The vulnerability affects the client side specifically, so patching client devices is critical. WPA3 completely eliminates this vulnerability.

WPS Attack

WiFi Protected Setup (WPS) was designed to simplify connecting devices by using an 8-digit PIN instead of the full password. Unfortunately, the WPS PIN verification process reveals whether the first half of the PIN is correct, reducing the effective search space from 10^8 to roughly 10^4 attempts. Tools like Reaver can crack WPS PINs in hours. Disable WPS on your router.

Securing WiFi Networks

Router Configuration

Start by changing the default administrator username and password on your router. Disable remote administration. Use WPA2 or WPA3 encryption — never WEP or open networks. Choose a strong, unique SSID that does not reveal personal information. Disable WPS, UPnP, and unnecessary services.

Network Segmentation

Create separate VLANs for different types of devices. Keep IoT devices (smart home gadgets, cameras) on a separate network from your computers and phones. Most consumer routers support guest networks, which effectively segment traffic.

Monitoring

Regularly check connected devices on your network. Monitor for unknown devices that could indicate an unauthorized user. Enable router logging if available. Use network monitoring tools like Wireshark or ntopng for advanced analysis.

WiFi Security Tools

Aircrack-ng Suite

Aircrack-ng is the most widely used wireless security assessment toolkit. It includes:

Kismet

Kismet is a wireless network detector, sniffer, and intrusion detection system. It can discover hidden networks, detect deauthentication attacks, and track devices across multiple channels. Kismet works with any wireless card that supports monitor mode.

Wifite

Wifite automates wireless auditing by running multiple attacks against target networks. It automatically selects the best attack method based on the target's configuration, making it useful for efficiency but also requiring careful ethical consideration.

Legal and Ethical Considerations

Only test WiFi security on networks you own or have explicit written permission to test. Intercepting or accessing unauthorized wireless networks is illegal under laws including the CFAA and the Computer Misuse Act. Always practice in your own lab environment or authorized testing platforms.

WiFi security is an arms race between attackers and defenders. Understanding both attack techniques and defensive measures makes you a more effective security professional. Start by securing your own network, then expand your knowledge through structured practice.