Tutorial 5: Wireless LAN Security and Deployment

The 24‑bit IV is too short, causing IV reuse. Attackers can collect enough packets with the same IV to recover the RC4 key using the Fluhrer‑Mantin‑Shamir attack.

Per‑packet key mixing (prevents IV reuse) and a message integrity check (Michael) to prevent bit‑flipping attacks.

AES‑CCMP (Counter Mode with CBC‑MAC Protocol) using AES in CTR mode and CBC‑MAC for integrity.

It establishes the Pairwise Transient Key (PTK) between the client and AP, and verifies the PMK (pre‑shared or derived from 802.1X).

SAE uses the Dragonfly key exchange, which requires an online interaction for each guess. An attacker cannot verify a password without being online and participating in the handshake, making offline brute‑force impossible.

The RADIUS server authenticates the client (and optionally the AP) using EAP methods, and provides the PMK to the AP for subsequent 4‑way handshake.

WPA2‑Personal uses a Pre‑Shared Key (PSK) for authentication, with the same key shared among all users. WPA2‑Enterprise uses 802.1X with a RADIUS server, providing per‑user credentials and dynamic keys.

A rogue AP is an unauthorised AP connected to the network. It can be detected by WIDS/WIPS systems that monitor for unknown MAC addresses, mismatched SSIDs, or using automated site surveys.

KRACK (Key Reinstallation Attack) targets the 4‑way handshake, tricking the client into reinstalling a previously used key. Mitigation: firmware updates that implement the 802.11 standard’s countermeasures (e.g., not allowing key reinstall).

MFP protects management frames (Deauthentication, Disassociation) from being spoofed, preventing DoS attacks and session hijacking.

OWE provides encryption for open networks without authentication, using Diffie‑Hellman to establish a key, protecting against passive eavesdropping.

An evil twin is a rogue AP that mimics a legitimate SSID. Prevention: use WPA2/3 with strong authentication, verify AP certificates (in 802.1X), and use 802.11w to secure management frames.

TKIP uses RC4 with per‑packet key mixing and Michael MIC; CCMP uses AES‑CTR for encryption and AES‑CBC‑MAC for integrity. CCMP is much stronger.

At least 12 characters (random, including uppercase, lowercase, numbers, and symbols). The Wi‑Fi Alliance recommends 8 characters minimum, but 12+ is safer.

In 802.1X, both the client and server authenticate: the server presents a certificate (or uses TLS) to the client, and the client proves its identity via credentials (certificate, username/password, etc.).

The PMK is the root key from which the Pairwise Transient Key (PTK) is derived via the 4‑way handshake. It is derived from the PSK (personal) or from EAP authentication (enterprise).

CRC32 is a linear function; an attacker can flip bits in the encrypted data and adjust the CRC accordingly without knowing the key, enabling undetected tampering.

EAP‑TLS uses mutual certificate authentication, which is more secure and resistant to credential theft (no password involved). EAP‑PEAP uses server certificate and client password (or MSCHAPv2), which can be subject to brute‑force and credential theft.

Place guest traffic on a separate VLAN with no access to internal resources, use a captive portal for authentication (or open with OWE), and apply bandwidth limits.

WPA3 uses SAE, which employs an ephemeral key exchange (Dragonfly), so even if the password is later compromised, past session keys (and thus past traffic) cannot be decrypted.

The Authenticator (typically the AP) relays EAP messages between the Supplicant (client) and the Authentication Server (RADIUS). It also controls the port access based on the authentication result.

WPS (Wi‑Fi Protected Setup) PIN method is vulnerable to brute‑force attacks because the PIN is only 8 digits (11,000 guesses). Even with lockout, attackers can bypass it. Disabling WPS eliminates this attack vector.

It means using multiple layers of security: encryption (WPA2/3), strong authentication (802.1X), network segmentation (VLANs), monitoring (WIDS), and policy enforcement (firewalls) to mitigate any single point of failure.

The handshake uses nonces (ANonce from AP, SNonce from client) that are randomly generated each session. The PTK is derived from PMK, ANonce, SNonce, and MAC addresses, ensuring unique keys per session.

Cloud management offers scalability, lower capital expenditure, simplified deployment, automatic updates, and centralised visibility across multiple sites. However, it relies on internet connectivity and may have latency for control plane operations.

Use WPA2‑Enterprise or WPA3‑Enterprise with 802.1X for faculty/staff (EAP‑PEAP with Active Directory, or EAP‑TLS for high security). For students, use WPA2‑Enterprise with EAP‑PEAP (or a captive portal for open access). For guests, use a separate VLAN with open network (OWE for encryption) and a captive portal for terms of service. Implement WIDS to detect rogue APs. Use RADIUS server (e.g., FreeRADIUS) integrated with LDAP.

Attacker uses a dictionary attack with a tool like aircrack‑ng on the captured handshake. The handshake contains the PMK derived from the PSK, which can be brute‑forced offline (PBKDF2 is slow but feasible for weak passwords). Mitigation: use a strong passphrase (>12 characters, random), or better, use WPA2‑Enterprise.

WPA3‑SAE is the most secure for home use, as it resists offline brute‑force and provides forward secrecy. WPA2‑PSK is acceptable if a strong password is used, but WPA3 is better. WPA2‑Enterprise is overkill for home and requires a RADIUS server.

An attacker sends forged deauthentication frames to a client or AP, disconnecting the client. This can be used for DoS or to force the client to re‑authenticate, allowing the attacker to capture the handshake for offline cracking. Prevention: enable 802.11w (Management Frame Protection) on both AP and client.

Risks: if the server certificate is not validated by the client, an attacker can set up a rogue RADIUS server and capture credentials (evil twin). Mitigation: ensure clients validate the server certificate (use a trusted CA and check the certificate CN). Also, use strong password policies and consider moving to EAP‑TLS for mutual certificate authentication.

Use a WIDS/WIPS (e.g., with a dedicated sensor or use APs in monitor mode). Look for unknown MAC addresses, mismatched SSIDs, or APs with same SSID but different BSSID. Physically locate using signal strength mapping (using a spectrum analyser or handheld direction‑finding). Then disconnect the rogue AP and investigate the switch port it is connected to.

PMK caching stores the PMK from a previous authentication to avoid full 802.1X re‑authentication, reducing latency. 802.11r (Fast BSS Transition) uses a pre‑authentication mechanism and a key hierarchy to speed up roaming without repeating the full 4‑way handshake, achieving faster handoffs (~20‑50 ms). Both improve latency, but 802.11r is more comprehensive for voice roaming.

Risks: passive eavesdropping (sniffing credentials), session hijacking, MITM. Provider should implement OWE (Enhanced Open) for encryption, even without authentication. They could also use a captive portal, but that doesn't protect the data. They should encourage users to use VPNs.

The GTK is used for multicast and broadcast traffic. It is generated by the AP and distributed to clients via the Group Key Handshake, which occurs after the 4‑way handshake. The GTK is encrypted with the PTK to ensure secure delivery.

AP must support WPA3 and SAE; client must support WPA3 (most modern devices do). Transition mode allows both WPA2 and WPA3 clients to connect, but with reduced security for legacy devices. Compatibility issues: older clients may not support SAE, requiring the AP to offer WPA2 as fallback, which may expose the network to PSK brute‑force.

A user may connect to the stronger signal of the evil twin, especially if they have “auto‑connect” enabled. Prevention: corporate networks should use WPA2/3‑Enterprise with 802.1X, where clients validate the server certificate. Users should also be trained to check certificate warnings.

WPA3‑Personal uses SAE with a password and the Dragonfly exchange, providing resistance to offline attacks, but the password strength still matters. WPA3‑Enterprise with 192‑bit security uses stronger cryptographic algorithms (AES‑256, SHA‑384) and EAP‑TLS with certificates, providing the highest security for sensitive environments.

WEP uses RC4 with a 24‑bit IV. Since the IV is part of the key, when it repeats, the same keystream is used. XORing two ciphertexts encrypted with the same keystream cancels the keystream, leaving the XOR of the plaintexts. With known plaintext (e.g., IP headers), the keystream can be recovered. The FMS attack exploits weak IVs that reveal key information, reducing the brute‑force space.

TKIP uses RC4 and Michael MIC; both are weaker than AES‑CCMP. TKIP has known vulnerabilities (e.g., Beck‑Tews attack on Michael). It is deprecated in 802.11ac and later. Using TKIP exposes networks to attacks that compromise integrity and confidentiality.

Message 1: AP sends ANonce to client. Message 2: Client derives PTK (using PMK, ANonce, SNonce, MACs) and sends SNonce + MIC. Message 3: AP sends GTK + MIC (verifies PTK). Message 4: Client sends ACK (confirms installation). This establishes the PTK and provides key freshness and mutual proof of PMK.

KRACK (Key Reinstallation Attack) exploits the retransmission of the 3rd message of the 4‑way handshake. The attacker forces the client to reinstall an already‑used PTK, resetting the nonce and replay counter, allowing replay attacks. It is a protocol flaw because the standard didn't prevent key reinstallation. Patches involve the client discarding retransmitted messages after key installation.

EAP‑TLS is the most secure (mutual certificates) but requires a PKI. EAP‑PEAP and EAP‑TTLS are widely deployed (username/password with server certificate), with PEAP being more common. EAP‑FAST is Cisco‑proprietary. EAP‑TLS is recommended for high security; PEAP is a good compromise for ease of deployment.

802.11w protects management frames (Deauthentication, Disassociation, and some others) from forgery. It is crucial to prevent DoS attacks. However, it is not always enabled because older clients may not support it, causing compatibility issues. It is optional in WPA2 but mandatory in WPA3.

A WIPS actively prevents attacks, not just detects them. Components: sensors (APs or dedicated) that monitor the air, a central server that analyses data, and an enforcement point that can take actions (e.g., sending deauth to rogue APs, blocking MACs, or dynamically adjusting channels). A WIDS only alerts; a WIPS automatically responds.

WPA2‑PSK uses a shared key, which is difficult to manage for many users and devices. If an employee leaves, the key must be changed on all devices. There is also no per‑user accountability. 802.1X provides individual credentials, dynamic keys, and centralised management, making it far more secure and scalable.

IoT devices often lack keyboards. Secure onboarding can use methods like: provisioning via a smartphone app (using BLE or QR codes), using a bootstrap network (open network for registration), or using Zero‑Touch Provisioning (e.g., with certificates pre‑installed). Once enrolled, the device gets a unique credential.

WPA2‑PSK is vulnerable to offline dictionary attacks because the handshake contains material that can be used to test passwords offline. WPA3‑SAE uses the Dragonfly key exchange, which requires online interaction for each guess, making offline brute‑force infeasible. This is a significant security improvement.

WPA3 provides strong encryption and authentication, but it is not a silver bullet. It does not protect against application‑layer attacks, phishing (evil twin still possible if certificates are not validated), or side‑channel attacks. Also, WPA3 may not be available on all devices. A defence‑in‑depth approach with network segmentation, monitoring, and user education is still necessary.

Audit plan: 1) Survey the air for all SSIDs and BSSIDs (using a tool like Kismet). 2) Test encryption (ensure WPA2/3, no WEP/TKIP). 3) Test authentication: try to connect with invalid credentials, check for 802.1X certificate validation. 4) Deploy a rogue AP to test detection (WIDS). 5) Check AP firmware versions. 6) Review logs and alerts. 7) Develop a response plan for detected incidents.