Wireless Access Points

WiFi Infrastructure and Security

Understanding Wireless Network Architecture and Threats

Wireless Access Point Definition

Wireless Access Point (WAP) is a networking hardware device that allows wireless devices to connect to a wired network, serving as a bridge between wireless clients and the wired network infrastructure.

Key Functions:

Wireless-to-Wired Bridge: Connect WiFi devices to Ethernet networks
Signal Broadcasting: Transmit radio signals for wireless connectivity
Client Management: Handle device connections and authentication
Traffic Routing: Forward data between wireless and wired networks
Security Enforcement: Implement wireless security protocols
Network Services: DHCP, DNS, and other network services

Common Deployment: Home routers, enterprise access points, public hotspots, mesh networks

WAP vs Router vs Modem

Modem:

Function: Internet connection
Purpose: Modulate/demodulate signals
Connectivity: ISP to home/office
Ports: Usually single Ethernet
Layer: Physical layer (Layer 1)
Example: Cable, DSL, fiber modem

Router:

Function: Network routing
Purpose: Route traffic between networks
Connectivity: Multiple network segments
Ports: Multiple Ethernet ports
Layer: Network layer (Layer 3)
Example: Home gateway router

Wireless Access Point:

Function: Wireless connectivity
Purpose: WiFi signal broadcasting
Connectivity: Wireless devices to network
Ports: Ethernet uplink
Layer: Data link layer (Layer 2)
Example: Enterprise AP, mesh node

All-in-One Devices: Most home "routers" actually combine modem, router, switch, and wireless access point functions

WiFi Standards Evolution

Standard	Marketing Name	Year	Frequency	Max Speed	Range	Status
802.11	-	1997	2.4 GHz	2 Mbps	20m	Legacy
802.11b	WiFi 1	1999	2.4 GHz	11 Mbps	35m	Legacy
802.11a	WiFi 2	1999	5 GHz	54 Mbps	15m	Legacy
802.11g	WiFi 3	2003	2.4 GHz	54 Mbps	35m	Legacy
802.11n	WiFi 4	2009	2.4/5 GHz	600 Mbps	50m	Common
802.11ac	WiFi 5	2013	5 GHz	3.5 Gbps	35m	Current
802.11ax	WiFi 6/6E	2019	2.4/5/6 GHz	9.6 Gbps	40m	Latest
802.11be	WiFi 7	2024	2.4/5/6 GHz	46 Gbps	45m	Emerging

WiFi Security Standards Evolution

Legacy Security (Deprecated):

Open (No Security): No encryption
WEP (Wired Equivalent Privacy): RC4 encryption, 40/104-bit keys
WPS (WiFi Protected Setup): PIN-based setup
Status: All easily broken, should not be used

Modern Security (Current):

WPA (WiFi Protected Access): TKIP encryption
WPA2: AES-CCMP encryption
WPA3: Enhanced security, SAE authentication
Status: WPA2 minimum, WPA3 preferred

WPA3 Improvements:

SAE (Simultaneous Authentication of Equals): Replaces PSK with stronger authentication
Forward Secrecy: Past sessions remain secure if password compromised
Protected Management Frames: Prevent management frame attacks
Enhanced Open: Encryption even on open networks
192-bit Security: Stronger encryption for enterprise

WiFi Frequency Bands

2.4 GHz Band:

Channels: 14 channels (1-11 US, 1-13 Europe)
Bandwidth: 20 MHz channels
Range: Longer range, better wall penetration
Speed: Lower maximum speeds
Interference: Crowded, many devices
Use Case: IoT devices, long range

5 GHz Band:

Channels: 25+ non-overlapping channels
Bandwidth: 20, 40, 80, 160 MHz channels
Range: Shorter range, less penetration
Speed: Higher maximum speeds
Interference: Less congested
Use Case: High-bandwidth applications

6 GHz Band (WiFi 6E/7):

Channels: 59 new channels (1200 MHz)
Bandwidth: Up to 320 MHz channels
Range: Similar to 5 GHz
Speed: Highest speeds available
Interference: Cleanest spectrum
Use Case: Future high-performance applications

Common WiFi Attack Vectors

Passive Attacks:

Eavesdropping: Monitoring network traffic
Packet Sniffing: Capturing data packets
Traffic Analysis: Analyzing communication patterns
War Driving: Mapping wireless networks
SSID Discovery: Finding hidden networks

Active Attacks:

Evil Twin: Fake access points
Rogue AP: Unauthorized access points
Deauthentication: Forcing client disconnections
WPS Attacks: PIN brute forcing
Man-in-the-Middle: Intercepting communications

Password/Key Attacks:

WEP Cracking: Statistical attacks on RC4
WPA/WPA2 Cracking: Dictionary attacks on PSK
PMKID Attacks: Offline WPA2 cracking
Handshake Capture: 4-way handshake attacks
Brute Force: Password guessing attacks

Evil Twin Attack

Evil Twin: Malicious wireless access point that impersonates a legitimate access point to intercept user communications and steal credentials.

Evil Twin Attack Process:

1. Reconnaissance:
• Attacker identifies target WiFi network (SSID, security)
• Studies network characteristics and user behavior

2. Setup Fake Access Point:
• Creates AP with identical SSID name
• Uses stronger signal to attract users
• May deauthenticate users from legitimate AP

3. User Connection:
• Users connect to fake AP believing it's legitimate
• Attacker captures login credentials
• May present fake captive portal for credential harvesting

4. Traffic Interception:
• All user traffic passes through attacker's system
• Can intercept passwords, personal data, financial info
• May proxy traffic to maintain internet connectivity

Common Targets: Coffee shops, airports, hotels, corporate networks

WEP Security Vulnerabilities

WEP (Wired Equivalent Privacy) was the first WiFi security standard but has fundamental cryptographic flaws that make it completely insecure.

WEP Vulnerabilities:

Weak Keys: 40-bit and 104-bit keys easily cracked
IV Reuse: 24-bit initialization vectors repeat quickly
RC4 Weaknesses: Statistical biases in keystream
Key Recovery: Passive attacks recover keys in minutes
Authentication Flaws: Shared key authentication vulnerable

WEP Cracking Tools:

Aircrack-ng: Popular WEP cracking suite
Kismet: Wireless network detector
Wireshark: Packet analysis tool
Wifite: Automated wireless security testing
Fern WiFi Cracker: GUI-based cracking tool

WEP Cracking Process:
1. Monitor network traffic to collect initialization vectors
2. Inject packets to accelerate IV collection
3. Analyze statistical patterns in captured packets
4. Recover WEP key using mathematical attacks
5. Time required: 1-10 minutes with sufficient traffic

WPA/WPA2 Security Mechanisms

WPA (WiFi Protected Access) was designed to address WEP's security flaws and provide enterprise-grade wireless security.

WPA Improvements:

TKIP (Temporal Key Integrity Protocol): Dynamic key generation
MIC (Message Integrity Check): Detect packet modification
Key Hierarchy: Multiple derived keys for different purposes
Replay Protection: Packet sequence numbers
802.1X Authentication: Enterprise authentication framework

WPA2 Enhancements:

AES-CCMP: Advanced Encryption Standard
Stronger Encryption: 128-bit AES vs RC4
Mandatory 802.11i: Full security standard implementation
Hardware Acceleration: Better performance with AES
Certification Required: WiFi Alliance certification

WPA2 Authentication Modes:

WPA2-Personal (PSK): Pre-shared key for home/small office
WPA2-Enterprise (802.1X): RADIUS authentication for enterprises

WPA2 4-Way Handshake

4-Way Handshake: Authentication process that establishes encryption keys between access point and client without transmitting the actual password.

4-Way Handshake Process:

Prerequisites:
• Client knows WiFi password (PSK)
• AP knows the same PSK
• Both derive PMK (Pairwise Master Key) from PSK

Message 1 (AP → Client):
• AP sends ANonce (AP nonce/random number)

Message 2 (Client → AP):
• Client sends SNonce (Station nonce)
• Client sends MIC (Message Integrity Check)
• Both derive PTK (Pairwise Transient Key)

Message 3 (AP → Client):
• AP sends GTK (Group Temporal Key)
• AP sends MIC to verify PTK

Message 4 (Client → AP):
• Client acknowledges GTK receipt
• Encrypted communication begins

Key Derivation: PTK = PRF(PMK, ANonce, SNonce, AP MAC, Client MAC)

WPA2 Attack Methods

WPA2 Vulnerabilities: While much stronger than WEP, WPA2 can still be attacked through various methods.

Handshake Capture Attacks:

Passive Capture: Monitor 4-way handshake
Deauthentication: Force client reconnection
Dictionary Attack: Offline password cracking
Hashcat/Aircrack: GPU-accelerated cracking
Weakness: Vulnerable to weak passwords

PMKID Attack:

Single Packet: No handshake required
PMKID Extraction: From first EAPOL frame
Offline Cracking: Dictionary/brute force
Stealth: No deauthentication needed
Tool: hcxdumptool, hashcat

WPA2 Cracking Timeline:
• Simple passwords (8 chars, dictionary): Minutes to hours
• Complex passwords (12+ chars, mixed): Years to centuries
• Enterprise WPA2 with 802.1X: Much more secure
• Key factor: Password strength and uniqueness

WPA3 Security Enhancements

WPA3: Latest WiFi security standard addressing WPA2's vulnerabilities and providing enhanced security for modern wireless networks.

WPA3-Personal Features:

SAE (Dragonfly): Simultaneous Authentication of Equals
Forward Secrecy: Past sessions remain secure
Password Security: Resistant to offline attacks
Natural Password Selection: No complex requirements
Brute Force Protection: Built-in attack resistance

WPA3-Enterprise Features:

192-bit Security: Stronger encryption suite
GCMP-256: Galois/Counter Mode Protocol
SHA-384: Stronger hash algorithm
ECDH-384: Elliptic curve key exchange
Suite-B: NSA's cryptographic algorithms

WPA3 Additional Features:

Enhanced Open: Encryption on open networks (OWE)
Easy Connect: QR code device onboarding
Protected Management Frames: Mandatory PMF
Transition Mode: Backward compatibility with WPA2

WAP Security Best Practices

Use WPA3 or WPA2: Never use WEP or open networks
Strong Passwords: Long, complex passphrase for PSK
Change Default Settings: Admin passwords, SSID names
Disable WPS: WiFi Protected Setup has vulnerabilities
Enable MAC Filtering: Allow only authorized devices
Disable SSID Broadcast: Hide network name (security through obscurity)
Enable Firewall: Block unnecessary ports and services
Regular Updates: Keep firmware current
Guest Networks: Isolate visitor traffic
Monitor Logs: Review access and security events

Enterprise Additions: 802.1X authentication, RADIUS servers, certificate-based authentication, network segmentation

Enterprise WiFi Security

802.1X/EAP Authentication:

RADIUS Server: Centralized authentication
Digital Certificates: Strong device authentication
User Credentials: Individual account authentication
Dynamic Keys: Per-session encryption keys
Accounting: User activity logging

EAP Methods:

EAP-TLS: Certificate-based (most secure)
PEAP: Protected EAP with TLS tunnel
EAP-TTLS: Tunneled TLS
EAP-MSCHAPv2: Microsoft challenge/response
EAP-SIM/AKA: Mobile network authentication

Enterprise WiFi Architecture:

Wireless Controller: Centralized AP management
CAPWAP/LWAPP: Control and provisioning protocols
VLAN Segmentation: Network isolation
Policy Enforcement: Role-based access control
Monitoring: Wireless intrusion detection systems

WiFi Security Testing Tools

Discovery Tools:

Kismet: Wireless network detector
airodump-ng: Packet capture tool
Vistumbler: Windows WiFi scanner
WiFi Analyzer: Mobile spectrum analyzer
InSSIDer: Professional WiFi scanner

Attack Tools:

Aircrack-ng: WEP/WPA cracking suite
Hashcat: GPU password recovery
Reaver: WPS PIN attack tool
Fluxion: Social engineering toolkit
Wifite: Automated wireless attack tool

Analysis Tools:

Wireshark: Network protocol analyzer
tcpdump: Command-line packet analyzer
Ettercap: Network security tool
Nmap: Network discovery and scanning
Metasploit: Penetration testing framework

Hardware: USB WiFi adapters with monitor mode support (e.g., Alfa AWUS036ACS, Panda PAU09), WiFi Pineapple for penetration testing

Rogue Access Point Detection

Rogue Access Point: Unauthorized wireless access point connected to a corporate network, potentially providing backdoor access to attackers.

Detection Methods:

Network Scanning: Regular SSID surveys
MAC Address Monitoring: Track authorized devices
WIPS (Wireless IPS): Automated detection systems
RF Spectrum Analysis: Radio frequency monitoring
Network Topology Mapping: Identify unexpected devices

Prevention Strategies:

Physical Security: Secure network ports
Port Security: MAC address binding
Network Monitoring: Continuous surveillance
Employee Education: Security awareness training
Policy Enforcement: Acceptable use policies

Rogue AP Indicators:
• Unknown SSID names appearing in scans
• Duplicate network names with different characteristics
• High signal strength from unexpected locations
• Unusual network traffic patterns
• Devices connecting to unauthorized networks

WiFi 6/6E and Future Developments

WiFi 6 (802.11ax): Latest generation providing improved performance, efficiency, and capacity for high-density environments.

WiFi 6 Key Features:

OFDMA: Orthogonal Frequency Division Multiple Access
MU-MIMO: Multi-user MIMO (8x8 uplink/downlink)
BSS Coloring: Reduce interference in dense environments
Target Wake Time: Improved battery life for IoT devices
1024-QAM: Higher modulation for increased throughput

WiFi 6E/7 Enhancements:

6 GHz Spectrum: Additional clean spectrum
320 MHz Channels: Ultra-wide channels (WiFi 7)
Multi-Link Operation: Simultaneous band usage
4096-QAM: Even higher modulation (WiFi 7)
WPA3 Mandatory: Enhanced security requirements

Future Trends:

WiFi 7 (BE): Up to 46 Gbps theoretical speeds
AI/ML Integration: Intelligent network optimization
IoT Optimization: Better support for massive device connections
Security Evolution: Post-quantum cryptography preparation

WiFi Security Monitoring

Monitoring Objectives:

Threat Detection: Identify suspicious activities
Compliance Monitoring: Ensure policy adherence
Performance Analysis: Optimize network performance
Incident Response: Rapid threat response
Forensic Analysis: Post-incident investigation

Monitoring Metrics:

Connection Attempts: Authentication success/failure rates
Signal Analysis: Unusual signal patterns
Traffic Patterns: Data flow analysis
Device Behavior: Anomaly detection
Geographic Analysis: Location-based monitoring

Enterprise Monitoring Solutions:

Wireless IDS/IPS: AirMagnet, Cisco MSE, Aruba AirWave
RF Spectrum Analyzers: Ekahau, MetaGeek Chanalyzer
SIEM Integration: Centralized security monitoring
Mobile Device Management: Corporate device oversight

Key Takeaways

Wireless access points bridge WiFi devices to wired networks
WiFi security has evolved from broken WEP to robust WPA3
Evil twin and rogue AP attacks remain significant threats
WPA2 requires strong passwords to resist offline attacks
WPA3 provides enhanced security against modern threats
Enterprise WiFi requires 802.1X authentication and proper architecture
Regular monitoring and security testing are essential
WiFi 6/6E/7 bring performance improvements and security enhancements

Remember: Wireless security requires both technical controls (strong encryption, authentication) and operational practices (monitoring, policy enforcement, user education)

Thank You

Questions & Discussion

Unit 3 Complete - Next: Unit 4 Hacking and Penetration Testing