Wireless Security

Weaknesses:
  └─ RC4 cipher with 24-bit IV (too small — collisions guaranteed)
  └─ No key management (all users share the same key)
  └─ CRC32 integrity check (can be forged without key knowledge)
  └─ Passive attack: capture packets → crack key in < 60 seconds

Tools to crack WEP:
  airodump-ng wlan0mon    # Capture packets
  aircrack-ng capture.cap # Recover WEP key (5,000 IVs needed)
  besside-ng wlan0mon     # Automated WEP cracking

Weaknesses:
  └─ Still RC4-based (fundamentally limited)
  └─ TKIP key recovery possible (Beck-Tews attack, 2008)
  └─ MIC failure can be exploited (DoS)
  └─ WPA-TKIP deprecated in 802.11-2016 standard

Known Weaknesses:
  └─ KRACK attack (Key Reinstallation Attack, 2017)
     └─ Mathy Vanhoef discovered attacker can force nonce reuse
     └─ Allows decryption of WPA2 traffic without the password
     └─ Patched in 2017 — but many IoT devices never updated
  └─ PMKID attack (2018)
     └─ Uses RSN IE from EAPOL frame
     └─ No need for handshake capture (faster cracking)
  └─ Dictionary attacks on PSK
     └─ Pre-shared key is brute-forceable if weak password

WPA2 Enterprise:
  └─ Much more secure than WPA2 Personal
  └─ Per-user credentials (not shared password)
  └─ 802.1X authentication with RADIUS

WPA3 Improvements:
  └─ SAE (Simultaneous Authentication of Equals) handshake
     └─ Replaces WPA2's 4-way handshake
     └─ Protected against offline dictionary attacks
     └─ Even weak passwords are hard to brute-force offline
  └─ GCMP-256 encryption (instead of AES-CCMP)
  └─ Opportunistic Wireless Encryption (OWE)
     └─ Encryption even on open networks (no password needed)
  └─ Management Frame Protection (802.11w)
     └─ Prevents deauthentication attacks
  └─ Perfect Forward Secrecy
     └─ Past traffic cannot be decrypted if key is compromised

WPA3 Personal vs Enterprise:
  └─ Personal: SAE with password
  └─ Enterprise: 802.1X with EAP-TLS (certificate-based)

Client (Supplicant)          AP (Authenticator)          RADIUS Server
      │                            │                          │
      │  Association Request       │                          │
      │───────────────────────────>│                          │
      │  Association Response      │                          │
      │<───────────────────────────│                          │
      │                            │                          │
      │  EAPOL-Start               │                          │
      │───────────────────────────>│                          │
      │                            │  RADIUS Access-Request   │
      │                            │──────────────────────────>│
      │  EAP-Request Identity      │                          │
      │<───────────────────────────│                          │
      │  EAP-Response Identity     │                          │
      │───────────────────────────>│                          │
      │                            │  RADIUS Access-Request   │
      │                            │──────────────────────────>│
      │                            │                          │
      │  [EAP-TLS Certificate Exchange]                       │
      │<────────────────────────────────────────────────────>│
      │                            │                          │
      │                            │  RADIUS Access-Accept   │
      │                            │<──────────────────────────│
      │  4-Way Handshake Start     │                          │
      │───────────────────────────>│                          │
      │  4-Way Handshake Complete  │                          │
      │<───────────────────────────│                          │
      │                            │                          │
      │  ✓ Connected + Encrypted   │                          │

Attack Scenario:
  └─ Coffee shop has "Starbucks-WiFi"
  └─ Attacker sets up "Starbucks-WiFi" with better signal
  └─ Client device auto-connects to attacker's AP
  └─ Attacker can MITM all traffic, inject malware, steal credentials

Detection:
  └─ Compare AP BSSID (MAC) with known legitimate APs
  └─ WPA3 OWE prevents passive eavesdropping
  └─ WIPS (Wireless IPS) detects rogue APs by fingerprinting

Impact:
  └─ Affects all WPA2 implementations (Personal and Enterprise)
  └─ Attacker forces nonce reuse in the 4-way handshake
  └─ Allows decryption of subsequent traffic
  └─ Also affects WPA2 Group Key, Fast BSS Transition, and Tunneled Direct-Link Setup

Mitigation:
  └─ Patch all APs and client devices (patches released Dec 2017)
  └─ Use WPA3 (not affected)
  └─ Use TLS/HTTPS for all web traffic (defence in depth)

Rogue AP Detection:
  └─ MAC OUI not matching authorised vendor
  └─ Beacon interval deviation
  └─ Signal strength anomaly (AP appears outside expected area)
  └─ SSID matching authorised network but different BSSID
  └─ Open encryption on what should be WPA3 network

Rogue Client Detection:
  └─ Client trying to connect to multiple SSIDs
  └─ Client MAC OUI from suspicious vendor
  └─ Client doing active probing for corporate SSIDs

SSID Design:
  └─ Corporate SSID: WPA3-Enterprise, 802.1X with EAP-TLS
  └─ Guest SSID: Open (with OWE) or captive portal, isolated from corporate
  └─ IoT SSID: WPA3-Personal, isolated VLAN, no internet access
  └─ Legacy SSID: WPA2-Enterprise (if old devices need it), separate VLAN
  └─ Management SSID: WPA3-Enterprise, administrative access only

Authentication:
  └─ EAP-TLS (certificate-based) preferred over PEAP/MSCHAPv2
  └─ Certificates from internal CA, auto-enrolled via GPO
  └─ RADIUS servers in HA pair
  └─ Monitor failed auth attempts (detect brute force)

Segmentation:
  └─ Dynamic VLAN assignment via RADIUS
  └─ User role → VLAN mapping (employee, guest, contractor, admin)
  └─ Firewall between each VLAN
  └─ Guest traffic: internet only, no internal access

Monitoring:
  └─ WIPS for rogue AP/device detection
  └─ Wireless controller logs to SIEM
  └─ Channel utilisation monitoring
  └─ Client connectivity metrics