Wireless Security Research
802.11 protocol security reference covering WPA3, enterprise WLAN attack vectors, rogue AP detection, 802.1X authentication analysis and wireless hardening best practices.
Wi-Fi Security Protocol Comparison
| Protocol | Year | Auth | Encryption | Security Status | Recommendation |
|---|---|---|---|---|---|
| WEP | 1997 | Open/Shared Key | RC4 (40/104-bit) | Yes — <60 seconds with aircrack-ng | Retired. Never deploy. |
| WPA-TKIP | 2003 | PSK / 802.1X | RC4 + TKIP | Yes — TKIP attacks, handshake capture + dictionary | Retired. Disable on all APs. |
| WPA2-CCMP | 2004 | PSK / 802.1X | AES-CCMP (128-bit) | Partially — PMKID attack, handshake offline brute, KRACK (patched) | Acceptable with strong PSK (>20 chars). Enterprise: 802.1X required. |
| WPA3-Personal (SAE) | 2018 | SAE (Dragonfly) | AES-CCMP (128-bit) | DragonBlood side-channel (patched). Not brutable offline. | Required for new deployments. Backward compatible via Transition Mode. |
| WPA3-Enterprise | 2018 | 802.1X | GCMP-256 (192-bit mode) | No known cryptographic break. EAP method choice matters. | Recommended for enterprise. 192-bit mode for government/regulated. |
Attack Vectors
CriticalEvil Twin / Rogue AP
▾
Attacker deploys AP with identical SSID and stronger signal, forcing clients to connect to adversary-controlled infrastructure.
Tools
Conditions
Open networks, WPA2-PSK, WPA3 Transition Mode. Ineffective against WPA3-only Personal or well-configured 802.1X.
Detection
WIPS ARP monitoring, BSSID/channel comparison, rogue AP detection in enterprise WLAN controllers
Mitigations
- ·802.1X authentication (client validates server cert)
- ·HSTS and certificate pinning on web properties
- ·WIPS with rogue AP detection enabled
- ·Disable open/guest networks where possible
HighPMKID Attack (WPA2-PSK)
▾
Extract PMKID from EAPOL frame without capturing 4-way handshake. Enables offline dictionary/brute attack against PSK.
Tools
Conditions
WPA2-PSK only. Requires only one captured frame from the target AP (no client needed).
Detection
Unusual probe requests, beacon flooding. Difficult to distinguish from legitimate clients.
Mitigations
- ·Strong PSK (>20 random chars — passphrase entropy >80 bits)
- ·Migrate to WPA3-SAE (no offline attack possible)
- ·Enterprise: 802.1X with EAP-TLS
High802.1X EAP Downgrade / Credential Harvest
▾
Rogue AP offers weak EAP method (LEAP, EAP-MD5) or EAP-PEAP without certificate validation, harvesting credentials.
Tools
Conditions
Client not validating RADIUS server certificate. EAP methods without server auth (LEAP, EAP-MD5).
Detection
802.1X audit logging: monitor for failed EAP negotiations, RADIUS server alerts
Mitigations
- ·Enforce RADIUS server certificate validation on all clients (supplicant policy)
- ·Use EAP-TLS (mutual certificate authentication — no password involved)
- ·Disable LEAP and EAP-MD5 on RADIUS server
- ·Enable Protected Management Frames (PMF/802.11w)
MediumDeauthentication / Disassociation Attack
▾
Forge management frames (deauth/disassoc) to disconnect clients from legitimate AP. Used to capture 4-way handshake on reconnect.
Tools
Conditions
WPA2 without PMF/802.11w enabled. Management frames unauthenticated in WPA2.
Detection
WIPS: deauth flood detection, management frame anomaly alerts
Mitigations
- ·Enable Protected Management Frames (PMF) — mandatory in WPA3, optional in WPA2
- ·Enterprise WIPS with flood detection
- ·WPA3 makes deauth attacks significantly less effective
HighKarma / Auto-Connect Attack
▾
Attacker responds to any probe request with matching SSID, exploiting client auto-connect to previously joined networks.
Tools
Conditions
Client sends directed probe requests for known SSIDs (common on Windows, iOS, Android by default).
Detection
Client-side: unusual association events. Network: WIPS probe flood detection.
Mitigations
- ·Disable 'auto-join' on non-trusted SSIDs in device/MDM policy
- ·Clear saved network list regularly
- ·Use VPN on untrusted wireless networks
- ·iOS/Android: randomise MAC and suppress directed probes