Wireless Network Attacks: WEP, WPA, WPA2, WPA3 and Rogue Access Points

802.11 address fields depend on frame subtype and the To DS/From DS bits. Receiver/transmitter and source/destination roles can differ, and not every frame contains four addresses or a BSSID in the same position.

An SSID is not an authenticated brand identity. Legitimate multi-AP networks can share it, while one device can advertise multiple basic service sets. A BSSID is not necessarily a device’s permanent hardware address.

Inspect capture link type and available radio metadata. Channel, width, band, signal and antenna context affect interpretation. Radio range and successful decoding are not guaranteed by a monitor-mode setting.

Permitted bands, channels and power vary by jurisdiction. Do not transfer a 6 GHz channel plan or indoor rule worldwide. Use the actual network settings and compatible radio/driver capabilities.

Channel hopping samples channels and can miss short exchanges. A radio pinned to one channel offers different coverage but misses others. Document dwell, multiple-radio arrangements and capture loss.

WEP combines a secret with a short transmitted IV in an RC4-based design. Its IV/key-scheduling weaknesses and inadequate integrity protection make it unsuitable for protecting a modern network.

FMS, KoreK and PTW describe related historical analysis methods, not one fixed capture-count or recovery-time promise. Success depends on available traffic, packet properties, tool implementation and the actual target configuration.

For a controlled assessment, retain the capture, test scope and tool versions. Active traffic generation or replay changes the environment and can disrupt service; it must be distinguished from passive incident evidence.

A recovered key shows that the tested material supports that result. It does not establish who previously used the network or which historical traffic was read. Verify any claimed decryption against the actual protected frames.

The appropriate remediation is replacement of WEP protection with a supported modern design and suitable credentials, rather than relying on a longer WEP key or hidden network name.

WPA-Personal and WPA2-Personal password modes can permit offline testing of candidate passphrases when suitable verification material is captured. This is not equivalent to breaking AES or recovering every strong random key.

WPA2-Personal uses the applicable authentication/key establishment and data-protection suite. WPA2-Enterprise uses 802.1X/EAP mechanisms with different credential and validation requirements. Inspect the negotiated mode instead of inferring it from a sticker.

PMKID-based testing needs suitable material from a supported configuration; it is not guaranteed against every AP. Capturing a handshake does not necessarily require forcing a disconnect. Deauthentication attempts can be blocked by protected management frames and also alter the incident environment.

Guessing speed is hardware-, mode- and implementation-dependent. As arithmetic only, 62^8 is 218,340,105,584,896 candidates; at an assumed 2.4 million tests/second, exhaustive search takes about 2.9 years, not 21 hours. A measured rate and real password distribution are needed for a meaningful estimate.

Enterprise EAP methods differ in resistance to credential capture and relay. Correct server identity and certificate validation, an appropriate EAP method and secure provisioning matter. A rogue AP does not automatically obtain a usable credential from every enterprise client.

KRACK research demonstrated that particular handshake reinstallation behaviour could reset cryptographic state and enable attacks without learning the shared password. Exact effects differ by implementation and traffic protection; assess the relevant vulnerability and patch.

WPA3-Personal uses SAE for password-authenticated key establishment and still uses a four-way handshake to install traffic keys. SAE is designed to resist passive offline dictionary attacks against a normal captured exchange.

Dragonblood research identified side-channel, downgrade and implementation issues in particular Dragonfly-related designs. A historical disclosure does not mean every current WPA3 deployment is universally broken.

Check current vendor guidance, firmware, client support and negotiated mode. Transition configurations retain legacy compatibility with different exposure from a WPA3-only configuration; stronger labels do not replace implementation verification.

Keep separate findings for weak credentials, missing patches, negotiated protection and an observed exploit. A handshake retransmission alone can be normal and does not prove KRACK exploitation.

A rogue AP is unauthorised under the network operator’s policy. An evil twin imitates a trusted identity. Legitimate neighbouring APs, virtual BSSIDs and approved expansion must be distinguished from malicious infrastructure.

Stronger signal or a matching SSID alone does not guarantee association. Saved security settings, server validation, management protections, user choices and client policy affect the outcome.

A fraudulent captive portal can request credentials or redirect a user, but an observed portal is not proof that a victim submitted data. Preserve page content, actual destinations, account records and appropriate endpoint evidence.

HTTPS and correct certificate validation can protect application traffic even on an untrusted access network. A VPN can protect its tunnelled traffic but does not authenticate every portal or prevent all phishing.

Wireless monitoring can compare observed BSSIDs and security modes with an approved inventory. Signal anomalies are contextual leads, not a universal 6 dB maliciousness threshold.

Record location, collection conditions, configuration and any corroborated access or forwarding changes. Avoid attributing a neighbouring radio to a person solely through its apparent vendor or signal strength.

The historical WPS external-registrar PIN flaw reveals validation of separate portions. Because the final digit is a checksum, the commonly cited upper search count is 10^4 + 10^3 = 11,000 attempts, before implementation and lockout effects—not two independent four-digit searches.

Pixie Dust concerns weak secret/randomness generation in particular implementations and can allow offline analysis of suitable exchanges. It is distinct from generic online PIN guessing and does not affect every WPS device identically.

NFC reading, emulation, relay and cryptographic compromise are different capabilities. Support depends on the tag, keys and protocol; a general-purpose radio tool does not clone every protected card.

QR codes can encode links, payment destinations or other data. Preserve the original code, decoded value, surrounding presentation and actual transaction records. A sticker overlay is a lead; beneficiary checks and independent settlement records help establish its effect.

Cellular impersonation and downgrade feasibility depend on generation, handset policy, coverage and network protections. GSM authenticates the subscriber to the network without equivalent network authentication to the handset; that historical limitation is not a guarantee that every modern phone accepts a rogue base station.

SIM replacement, number porting and radio interception are distinct mechanisms. Continue to Wireless and Mobile Network Attacks. Legal authority and interception requirements vary by jurisdiction.