Upon completion of this extended tutorial, students will be able to:
Wireless and mobile networks are inherently more vulnerable to security attacks than wired networks due to the broadcast nature of radio transmissions, the mobility of devices, and the resource constraints of many endpoints. This tutorial provides a comprehensive examination of the security challenges and countermeasures across the entire mobile ecosystem. We begin with an overview of attack vectors, including eavesdropping, MITM, jamming, and rogue devices. We then delve into the security protocols for Wi‑Fi (from WEP to WPA3), cellular networks (GSM, UMTS, LTE, 5G), and IoT/sensor networks. We cover mobile device security (OS security, app vulnerabilities, data protection), authentication and key management, and privacy concerns. Finally, we discuss monitoring and incident response strategies. Through detailed explanations, real‑world examples, and extensive assessment materials, this tutorial equips students with the knowledge to design, deploy, and maintain secure wireless systems.
Wireless communication introduces unique security challenges:
The security objectives (CIA triad) apply: Confidentiality (prevent eavesdropping), Integrity (prevent tampering), Availability (prevent jamming/DoS). Additionally, Authentication (verify identity) and Non-repudiation are critical.
| Attack | Description | Target |
|---|---|---|
| Eavesdropping | Passive capture of unencrypted or weakly encrypted traffic | Confidentiality |
| Man‑in‑the‑Middle (MITM) | Interception and modification of communication | Integrity, confidentiality |
| Jamming | Transmitting interference to disrupt communication | Availability |
| Rogue AP / Evil Twin | Fake AP that lures clients to connect | Confidentiality, MITM |
| Deauthentication / Disassociation | Flooding management frames to disconnect clients | Availability |
| Replay Attack | Retransmitting captured packets to gain access | Authentication |
| Brute Force / Dictionary | Guessing passwords or keys | Authentication |
| Side‑Channel | Exploiting physical characteristics (power, timing, EM) | Confidentiality |
| Zero‑day Exploits | Unpatched vulnerabilities in software | All |
Enterprise mode (802.1X) uses RADIUS and EAP for strong authentication. PSK mode is suitable for home but vulnerable to dictionary attacks.
IoT devices are often resource‑constrained, making security challenging. Common issues:
Countermeasures:
Mobile devices (smartphones, tablets) are targets for malware, spyware, and data theft. Key areas:
Critical for wireless security. Methods:
Mobile networks pose privacy risks: tracking of IMSI, location, usage patterns. Mechanisms:
Wireless networks require continuous monitoring. Tools:
KRACK (Key Reinstallation Attack) exploited the 4‑way handshake in WPA2, forcing the reinstallation of a previously used key. It allowed decryption and injection of packets. Mitigation: patching clients and APs to reject retransmissions.
Mirai infected IoT devices (cameras, DVRs) with default credentials, using them to launch massive DDoS attacks (e.g., Dyn DNS outage). Mitigation: enforcing strong passwords, firmware updates, and network segmentation.
Law enforcement and attackers use fake base stations to capture IMSI and sometimes intercept calls. Mitigation: using 5G's SUCI to protect IMSI and encrypting voice (VoLTE, VoNR).
Test your understanding of wireless and mobile security.
Q1. What are the three main security objectives (CIA triad) in wireless security?
Confidentiality, Integrity, Availability.
Q2. What is the main vulnerability of WEP?
Short 24‑bit Initialization Vector (IV) leads to IV reuse, enabling key recovery attacks (FMS attack). Also weak RC4 key scheduling and no strong integrity.
Q3. What is the encryption algorithm used in WPA2 for data confidentiality?
AES in Counter Mode with CBC‑MAC Protocol (CCMP).
Q4. How does WPA3 improve upon WPA2 in terms of password‑based authentication?
WPA3 uses SAE (Simultaneous Authentication of Equals) based on Dragonfly, which makes offline dictionary attacks infeasible by requiring an online interaction for each guess.
Q5. What is the KRACK attack and how is it mitigated?
KRACK (Key Reinstallation Attack) forces the reinstallation of a previously used key in the WPA2 4‑way handshake. Mitigation: client and AP firmware updates that reject retransmissions.
Q6. What is the main security issue with GSM (2G) authentication?
GSM uses one‑way authentication (network authenticates user, but user cannot authenticate the network), allowing false base station attacks (IMSI catchers).
Q7. What is the encryption algorithm used in 5G for user data?
5G uses AES‑128 (and optionally 128‑EEA3, 128‑EIA3) for encryption and integrity, with stronger key derivation and separation.
Q8. What is the purpose of SUCI in 5G?
SUCI (Subscription Concealed Identifier) protects the IMSI by encrypting it with a public key provided by the network, preventing eavesdroppers from tracking users.
Q9. Name three common wireless attack vectors.
Eavesdropping, Man‑in‑the‑Middle (MITM), and Jamming (DoS). Also: rogue AP, evil twin, deauthentication, replay, etc.
Q10. What is the difference between a rogue AP and an evil twin?
A rogue AP is an unauthorised AP connected to the network, often used to capture traffic. An evil twin is a fake AP with the same SSID as a legitimate one, used to lure clients to connect for MITM attacks.
Q11. How does Management Frame Protection (MFP) improve Wi‑Fi security?
MFP protects management frames (deauthentication, disassociation) from spoofing, preventing DoS attacks and session hijacking.
Q12. What is the role of the HSS in LTE security?
The Home Subscriber Server (HSS) stores subscriber credentials and generates authentication vectors for the AKA procedure.
Q13. What is the purpose of EAP in 802.1X authentication?
EAP (Extensible Authentication Protocol) allows flexible authentication methods (e.g., TLS, PEAP, TTLS) between the client and RADIUS server.
Q14. What is a major security concern with IoT devices?
Many IoT devices have weak default passwords, lack of secure firmware updates, and vulnerable protocols, making them easy targets for botnets and unauthorised access.
Q15. What is the principle of defence in depth in wireless security?
Defence in depth uses multiple layers of security (encryption, authentication, monitoring, segmentation) to provide redundancy; if one layer fails, others still protect the system.
Q16. What is a side‑channel attack and give an example in wireless context.
A side‑channel attack exploits physical characteristics (power consumption, timing, electromagnetic emissions) to extract secrets. Example: power analysis on a Bluetooth device to recover encryption keys.
Q17. How does 5G provide forward secrecy?
5G uses ephemeral key exchanges for key derivation (e.g., in 5G‑AKA and EAP‑AKA), ensuring that past session keys cannot be derived from the long‑term key, providing forward secrecy.
Q18. What is the purpose of a WIDS (Wireless Intrusion Detection System)?
WIDS monitors wireless traffic for suspicious activity, such as rogue APs, deauthentication floods, and MAC spoofing, and alerts administrators.
Q19. What is the difference between TKIP and CCMP?
TKIP uses RC4 with per‑packet key mixing and Michael MIC, while CCMP uses AES‑CTR and AES‑CBC‑MAC. CCMP is significantly stronger and is used in WPA2.
Q20. What is a false base station attack (IMSI catcher) and how is it mitigated in 5G?
A false base station impersonates a legitimate base station to force devices to connect, capturing IMSI and possibly intercepting traffic. 5G mitigates by using SUCI (encrypted IMSI) and mutual authentication with strong crypto.
Q21. What is the role of the Mobility Management Entity (MME) in LTE security?
The MME handles authentication, key distribution, and security mode control for the UE, interfacing with HSS for AKA.
Q22. What is the concept of "zero‑trust" architecture in mobile security?
Zero‑trust assumes no device or user is trusted by default, requiring continuous verification of identity, device posture, and context before granting access.
Q23. How does end‑to‑end encryption (e.g., in WhatsApp) protect against eavesdropping?
End‑to‑end encryption ensures that only the communicating users can decrypt messages; even the service provider cannot access the content, preventing eavesdropping at any intermediary.
Q24. What is the significance of the KASME key in LTE security?
KASME is the master key derived from the permanent key K after AKA. It is used to derive further keys (KeNB, CK, IK) for encryption and integrity.
Q25. Why are mobile devices particularly vulnerable to social engineering attacks?
Mobile devices are always with the user, used for multiple purposes, and often have limited attention spans. They are susceptible to phishing via SMS (smishing), rogue apps, and fake notifications.
Apply your security knowledge to these scenarios.
Exercise 1: A small business uses WPA2‑PSK for Wi‑Fi. An attacker captures the 4‑way handshake and cracks the password offline. Propose a solution to prevent this. What if the business cannot upgrade to WPA3?
Use a strong, random passphrase (>15 characters). Alternatively, deploy WPA2‑Enterprise with 802.1X (RADIUS) to use per‑user credentials and dynamic keys, preventing offline brute‑force attacks.
Exercise 2: A user receives an SMS with a link to "update their bank details". What type of attack is this, and how can the user protect themselves?
This is a smishing (SMS phishing) attack. Protection: do not click links in unsolicited messages; verify the source; use the bank's official app or website; enable two‑factor authentication.
Exercise 3: A corporate campus deploys a Wi‑Fi network with 802.1X (EAP‑PEAP). An employee's laptop is stolen. What are the security implications, and what actions should be taken?
The stolen laptop may contain credentials or certificates. The corporate should revoke the user's certificates (if EAP‑TLS) or disable the account and force password change. Also, remote wipe the laptop (if possible) and disable any active sessions.
Exercise 4: A smart home uses ZigBee for lights and locks. What security vulnerabilities exist, and how can they be mitigated?
ZigBee uses AES‑128, but the network key may be insecure if poorly managed. Vulnerabilities: key sniffing, replay attacks. Mitigation: use secure key management (trust centre), disable unused endpoints, keep firmware updated, and isolate the ZigBee network from critical systems.
Exercise 5: A mobile user connects to a public Wi‑Fi hotspot that is an evil twin. What data is at risk, and how can the user detect or prevent it?
The attacker can perform MITM to steal credentials, cookies, and personal data. Prevention: use VPN, force HTTPS (HSTS), verify the network's SSID and certificate, and avoid sensitive transactions on public Wi‑Fi.
Exercise 6: Explain the difference between authentication and encryption. Which is more important in wireless security?
Authentication verifies identity; encryption protects data confidentiality. Both are critical. Without authentication, an attacker could impersonate a legitimate device; without encryption, data is exposed. They complement each other.
Exercise 7: An LTE network experiences a paging channel attack where an attacker sends fake paging messages to drain the battery of many devices. How does this attack work, and what can the network operator do?
Attackers can send paging requests to UEs, forcing them to wake up and consume battery. The network can implement paging throttling, use authentication for paging (not specified in LTE, but in 5G), and monitor for abnormal paging traffic.
Exercise 8: A company deploys IoT sensors with MQTT over TLS. What are the potential security weaknesses, and how can they be addressed?
Weaknesses: weak TLS versions, poor certificate validation, lack of client authentication. Mitigation: use TLS 1.2/1.3, enforce server certificate validation, use client certificates or strong username/password, and implement access control on topics.
Exercise 9: A security audit reveals that a WLAN uses WEP. What risks exist, and what is the recommended upgrade path?
WEP is completely broken; an attacker can recover the key in minutes. Upgrade to WPA2‑AES (or WPA3) and ensure all clients support it. Also, replace any legacy hardware.
Exercise 10: Explain how 5G's SUCI protects subscriber privacy. What happens if the network cannot decrypt SUCI?
SUCI is encrypted using the home network's public key. The network decrypts it with its private key to retrieve the IMSI. If decryption fails (e.g., key mismatch), the network can reject the connection or ask the UE to re‑attempt with a different identity.
Exercise 11: An attacker uses a deauthentication flood to disconnect users from a Wi‑Fi AP. How does this attack work, and how can it be mitigated?
The attacker sends forged deauthentication frames to the AP or clients, forcing them to disconnect. Mitigation: enable Management Frame Protection (802.11w), use WPA3 (which mandates MFP), and implement rate‑limiting for deauth frames.
Exercise 12: A mobile device running Android is infected with malware that requests excessive permissions (e.g., access to SMS, contacts, location). What should the user do, and how can such malware be prevented in the future?
The user should revoke permissions, uninstall the app, and scan the device with a security app. Prevention: install apps only from the Google Play Store (with Play Protect), review permissions, and keep the OS updated.
Independent research and advanced analysis.
HW1. Write a detailed analysis of the security of the 4‑way handshake in WPA2, including the KRACK vulnerability. Explain the mathematical basis and the necessary patches.
The 4‑way handshake derives the PTK using PMK, ANonce, SNonce, and MAC addresses. KRACK forces the client to reinstall a previously used PTK, resetting the nonce and replay counter. Patches involve the client discarding retransmitted message 3 after key installation.
HW2. Compare the security architectures of GSM, UMTS, and LTE. How did each generation improve authentication, encryption, and privacy?
GSM: one‑way authentication, A5/1 weak. UMTS: mutual authentication (AKA), stronger KASUMI/AES, integrity. LTE: stronger AKA, AES‑128, improved key hierarchy, but still IMSI unprotected. Each generation added stronger crypto and mutual authentication.
HW3. Research the security of LoRaWAN. What are the key management and encryption mechanisms? Identify potential vulnerabilities.
LoRaWAN uses AES‑128 encryption with two session keys: AppSKey (for application data) and NwkSKey (for network). Keys are derived from a per‑device AppKey. Vulnerabilities: over‑the‑air activation (OTAA) can be attacked if the join procedure is weak; also replay attacks and lack of end‑to‑end encryption.
HW4. Analyse the privacy implications of mobile device tracking using Wi‑Fi probe requests. How can users and networks mitigate this?
Devices broadcast probe requests with MAC addresses, which can be used to track users. Mitigations: randomise MAC addresses (now common in iOS/Android), use passive scanning, or disable Wi‑Fi when not in use. Networks should not store probe data for long.
HW5. Write a critical evaluation of the security of Bluetooth Low Energy (BLE) for medical devices. What are the risks and existing mitigations?
BLE uses AES‑CCM encryption with pairing (Just Works, Passkey Entry, or OOB). Risks: eavesdropping, MITM if pairing is not secure, and proximity attacks. Mitigations: use secure pairing (OOB or Passkey), implement strong authentication, and use secure connections (LE Secure Connections).
HW6. Discuss the role of PKI in enterprise wireless security. How are certificates used for authentication in 802.1X (EAP‑TLS)?
PKI issues certificates to clients and servers. In EAP‑TLS, the client and RADIUS server both present certificates for mutual authentication. This provides strong security, but requires a robust PKI infrastructure for certificate lifecycle management.
HW7. Investigate the security of 5G network slicing. How can isolation between slices be ensured, and what are the threats?
Network slicing provides logical isolation using resource allocation and separate NFs. Threats include side‑channel attacks, resource exhaustion, and unauthorised access across slices. Mitigations: strict resource isolation, security policies per slice, and monitoring.
HW8. Research the Mirai botnet attack in detail. What vulnerabilities did it exploit, and what lessons have been learned for IoT security?
Mirai exploited default credentials (weak passwords) on millions of IoT devices. It used them to launch DDoS attacks. Lessons: enforce strong passwords, disable unnecessary services, secure remote access, and implement firmware update mechanisms.
HW9. Explain the concept of "zero‑trust" security for mobile devices. How does it apply to BYOD environments?
Zero‑trust requires continuous verification of device health, user identity, and context before granting access. In BYOD, this means using MDM to enforce compliance, continuous authentication, and least‑privilege access.
HW10. Analyse the security of the 5G AKA procedure. How does it differ from LTE AKA, and what are the security benefits?
5G‑AKA uses an additional key (KSEAF) and supports EAP‑AKA. It provides improved key separation, protection against downgrade attacks, and support for non‑3GPP access. It also includes SUCI to protect IMSI.
HW11. Write a report on the security challenges of using public Wi‑Fi hotspots. What are the risks, and what are the best practices for users and network providers?
Risks: eavesdropping, MITM, rogue APs, session hijacking. User best practices: use VPN, enforce HTTPS, avoid sensitive transactions, disable auto‑connect. Provider best practices: use OWE for encryption, implement captive portals with HTTPS, and monitor for rogue APs.
HW12. Design a comprehensive security policy for a mobile workforce that includes: device encryption, authentication, app management, remote wipe, and incident response.
Policy includes: 1) Enforce full disk encryption on all mobile devices. 2) Use strong authentication (PIN/password + biometrics). 3) Implement MDM for app whitelisting/blacklisting and compliance checks. 4) Enable remote wipe and locate. 5) Require VPN for sensitive data. 6) Incident response plan: detection, containment, forensic analysis, and remediation.
This extended tutorial provided a comprehensive examination of mobile and wireless security, covering:
Security is a critical aspect of any wireless system, and understanding the threats and countermeasures is essential for network professionals. The next tutorial will cover emerging wireless technologies beyond 5G and Wi‑Fi 6.
© COMP347 – Unit 7: Wireless and Mobile Networks (Extended Tutorial 12)