Wireless Security: Best Practices and Common Attacks

Wireless networks are the default way most computing devices reach the rest of the world, which also makes them the default first place an attacker looks. This post covers the technical picture a blue team actually needs to hold: how Wi-Fi works, which protocols still hold up and which don’t, what the standard attacks look like, and what to actually do about them.

Audience: security-literate folks who already know their way around a network but want a working reference for wireless specifically.

Wireless networking technology

#

WLANs, WPANs, and WMANs

#

Wireless networks split by range and use case. WLANs (wireless local area networks) cover a home, office, or campus using Wi-Fi and are what almost everyone means when they say “wireless.” WPANs (wireless personal area networks) connect devices at very short range, Bluetooth for headphones and peripherals, NFC for payment terminals and door badges, and matter for security precisely because those devices are usually forgotten in an attack surface inventory. WMANs (wireless metropolitan area networks) run at city scale, historically WiMAX, now LTE and 5G, and are mostly a carrier problem rather than an enterprise one.

Each type has a different threat model, and defenses aimed at one won’t cover the others.

Wi-Fi network topologies

#

Three basic shapes:

• Ad-hoc: devices talk directly to each other with no central access point. Common for peer-to-peer file sharing or temporary setups.
• Infrastructure: devices connect through a central access point that bridges wireless clients to a wired network. This is what almost every deployed Wi-Fi network actually is.
• Mesh: devices route through each other to build a decentralized network. Useful in rural or disaster zones where wired backhaul isn’t practical.

Wi-Fi standards

#

Wi-Fi is defined by IEEE 802.11 and its amendments. The ones that show up in the wild:

• 802.11a: 5 GHz, faster than 802.11b for its era.
• 802.11b: 2.4 GHz, slower but longer range and more interference-tolerant.
• 802.11g: 2.4 GHz, faster than 802.11b.
• 802.11n (Wi-Fi 4): dual-band, MIMO and channel bonding.
• 802.11ac (Wi-Fi 5): 5 GHz, wider channels and higher-order modulation.
• 802.11ax (Wi-Fi 6/6E): dual-band (and 6 GHz for 6E), major throughput and density gains, particularly in high-client environments.

Encryption standards

#

Encryption is where a lot of wireless security lives or dies. Here’s what actually holds up.

WEP (broken, don’t use)

#

Wired Equivalent Privacy uses a 40-bit or 104-bit RC4 encryption key. It’s been effectively broken for two decades, and the break isn’t brute force: the FMS attack (2001), KoreK (2004), and PTW (2007) exploit statistical weaknesses in how RC4 handles WEP’s 24-bit initialization vector, recovering the key in about the same amount of time regardless of whether it’s 40-bit or 104-bit. In practice, PTW recovers a 104-bit key with 95% probability from around 85,000 captured frames, usually under a minute of active traffic on a busy network.

WEP’s integrity check is CRC-32, which isn’t a cryptographic MAC at all; it’s a linear checksum, which lets an attacker flip bits in a captured packet and recalculate a valid ICV without ever knowing the key.

Any device still speaking WEP is a legacy liability, not a security feature.

WPA (deprecated)

#

Wi-Fi Protected Access improved on WEP with TKIP (Temporal Key Integrity Protocol) and a per-packet key mixing function, plus the Michael MIC for integrity. It’s better than WEP but not by enough: TKIP is vulnerable to chop-chop-style attacks that recover keystream bytes, and WPA-PSK is crackable via offline dictionary attack against a captured 4-way handshake. Treat WPA the same way you treat WEP: legacy, don’t deploy new.

WPA2 (baseline)

#

WPA2 mandates AES-CCMP as its core cipher, which is where the actual security lives. CCMP provides both confidentiality (via AES in counter mode) and integrity (via CBC-MAC), and it doesn’t share TKIP’s weaknesses. WPA2 retains TKIP only as a backward-compatibility mode for WPA-era hardware; anything using WPA2-TKIP is effectively as weak as WPA and should be forced onto CCMP or replaced.

WPA2 has known weaknesses that matter in practice:

• KRACK (2017): Vanhoef and Piessens’s key reinstallation attack targets the 4-way handshake, forcing nonce reuse that enables packet decryption, replay, and (in some configurations) forgery. It doesn’t recover the password and doesn’t break AES itself. Major client OSes patched within weeks to months and the issue is largely resolved on updated systems.
• PMKID capture (2018): Jens Steube’s technique captures a single EAPOL frame containing the PMKID directly from the AP, no connecting client required, and cracks the PSK offline with hashcat. This is now the standard way to attack WPA2-PSK; the older “capture the full 4-way handshake” approach has become the fallback.
• WPA2-PSK dictionary attacks: still trivially effective against weak passphrases regardless of KRACK or PMKID specifics.

WPA3 (current standard)

#

WPA3 was finalized by the Wi-Fi Alliance in 2018 and has been mandatory on all newly certified Wi-Fi devices since July 2020. By 2023 it’s the current default, not an emerging alternative. It replaces the WPA2-PSK handshake with SAE (Simultaneous Authentication of Equals, sometimes called Dragonfly), which resists offline dictionary attack: an attacker who captures the handshake still has to interact with the AP for every guess, which makes weak passphrases materially harder to crack. WPA3 also adds forward secrecy (compromising a key later doesn’t decrypt earlier sessions) and 192-bit suite B for enterprise deployments.

WPA3 isn’t perfect, the Dragonblood side-channel attacks against SAE (2019) surfaced real weaknesses in early implementations, most of which have been patched, but it’s a substantial improvement over WPA2 and should be the default for any new deployment.

Related: OWE (Opportunistic Wireless Encryption) is an IETF standard (RFC 8110, 2017) that encrypts traffic on open networks without requiring a passphrase, so guest and public Wi-Fi at least isn’t cleartext by default. The Wi-Fi Alliance’s certification brand for OWE is “Wi-Fi Certified Enhanced Open.” OWE and Enhanced Open are the same thing described at two levels; they aren’t specifically Wi-Fi 6 features, though they often show up together in modern deployments.

Securing wireless networks

#

Small networks with pre-shared keys

#

For home or small office networks running WPA2 or WPA3 PSK, the basics matter more than the exotic tuning:

• Strong passphrase: long is what actually helps. A 20+ character passphrase with mixed case, numbers, and symbols is well past what a dictionary or brute-force attack will crack in reasonable time. Short passphrases fall to PMKID capture in hours regardless of the encryption standard.
• Change the default SSID: not because a custom SSID is inherently more secure, but because leaving the vendor default advertises the router make and model, which narrows an attacker’s exploit surface for them.
• SSID broadcast: hiding the SSID doesn’t meaningfully hide the network (any client connecting to it broadcasts the name), and it breaks reasonable client behavior. Not worth doing.
• Prefer WPA3, at minimum WPA2 with AES-CCMP: never TKIP-only or WEP.
• Change the default admin credentials on the router: default vendor passwords are one of the most reliable ways into a home network.
• Disable WPS: covered in its own section below.

NIST SP 800-46r2 covers the same ground for remote-access and BYOD contexts and is worth reading if you’re formalizing this into policy.

Enterprise networks with centralized authentication

#

Enterprise Wi-Fi should be 802.1X-authenticated (WPA2-Enterprise or WPA3-Enterprise) rather than PSK, so credentials are per-user and revocable:

• EAP-TLS with client certificates is the strongest common option: no shared secret, no password to phish, mutual authentication via certificate. It requires PKI infrastructure, which is the tradeoff.
• PEAP or EAP-TTLS are the common fallback if you can’t get to certificate-based auth for every client, but they inherit the credential-theft risk of the password backing them.
• RADIUS is what actually enforces the authentication decision. Configure it carefully; a misconfigured RADIUS server is a common way corporate Wi-Fi ends up trivially bypassable.
• Separate guest networks should exist and should be isolated from the corporate network at the routing layer, not just the SSID layer. Guest traffic reaches the internet and nothing else.
• Segmentation is what limits blast radius when (not if) a wireless client gets compromised. Firewall and ACL between wireless VLANs and sensitive internal resources.
• WIDS (see below) monitors for rogue APs and other wireless attacks that segmentation alone won’t catch.

NIST SP 800-153 (Guidelines for Securing WLANs) and the CIS wireless benchmarks are the standard policy references here.

WPS: turn it off

#

Wi-Fi Protected Setup was designed to make Wi-Fi easy to configure and ended up making it easy to compromise instead. Two attacks matter:

• PIN brute force (Reaver, 2011): WPS’s 8-digit PIN is validated in two 4-digit halves, cutting the search space from 10^8 to 10^4 + 10^3 (the last digit is a checksum). That’s crackable in hours against most APs.
• Pixie Dust (2014): exploits weak randomness in some vendors’ WPS PIN generation to recover the PIN offline in seconds.

The practical fix is to disable WPS in the router’s settings. Every other mitigation (strong PIN, firmware updates, rate limiting) is second-best. If a router doesn’t expose a way to disable WPS, that’s a real problem with the router.

Monitoring: Wireshark, Kismet, and Aircrack-ng

#

The standard toolkit for wireless network monitoring:

• Wireshark: the general-purpose packet analyzer. Handles wireless capture given the right adapter and monitor mode. Actively maintained.
• Kismet: purpose-built wireless network detector, sniffer, and lightweight IDS. Actively maintained, and one of the few tools that reliably works with a wide range of adapters and drivers.
• Aircrack-ng: the suite that does most of the heavy lifting for wireless auditing, capture, injection, and offline WPA/WEP cracking. Actively maintained.
• inSSIDer: still maintained (now commercial, under MetaGeek) for visualizing wireless environments and channel usage.

Two names worth flagging as dead so you don’t waste time on them: NetStumbler hasn’t been updated since 2004, and Cain and Abel’s last build was 2014.

WIDS and rogue AP detection

#

A wireless intrusion detection system watches for unauthorized access points, rogue clients, deauthentication floods, and other wireless attacks that regular network monitoring won’t see, since the traffic never touches the wired network. WIDS deployments typically use dedicated sensors placed to cover the physical footprint, a central server for analysis, and a management console.

Commercial options include Cisco DNA Spaces (which absorbed the older Wireless Control System line) and Aruba’s AirWave. Open source options are thin on the ground; OpenWIPS-ng exists but hasn’t been actively developed in years, which is worth knowing before you build a strategy around it.

Other wireless technologies (Bluetooth, Zigbee, NFC)

#

Wi-Fi isn’t the only wireless surface in an enterprise. Bluetooth pairing, Zigbee mesh sensors, NFC access badges, and various proprietary industrial radios all carry their own risks and are frequently invisible to whatever network security team owns “wireless.”

The reasonable approach is the same one you’d apply to any asset: inventory what’s actually deployed, assess each technology’s risk model (Bluetooth pairing has a very different threat surface than Zigbee sensor mesh), apply appropriate controls (encryption where the protocol supports it, network isolation for anything that reaches back to a hub, physical access controls for readers), and monitor for anomalies.

Relevant references: NIST SP 800-121 (Bluetooth), the Bluetooth SIG’s security documentation, and the NFC Forum’s security work.

Common attacks on wireless networks

#

Rogue AP attacks, evil twin attacks, MITM, and DoS all overlap heavily on wireless, since the underlying primitive is usually “the attacker controls a radio you talk to.” Here’s what they look like in practice.

Rogue access points and evil twin

#

A rogue access point is any AP on the network that shouldn’t be there. That includes both attacker-planted APs and well-meaning-employee “I brought my own router” APs. Either way, if it’s plugged into the network side and speaking Wi-Fi, it’s a bypass of whatever controls the sanctioned APs enforce.

An evil twin is a specific rogue AP: one that impersonates a legitimate SSID, usually with a stronger signal, to induce clients to connect to it instead of the real one. Once a client associates, the attacker sits in the middle of everything the client does. Tools like Karma, Mana, and the WiFi Pineapple automate the impersonation; Airgeddon, Fluxion, and WiFiphisher automate the follow-on phishing (typically a fake captive portal that harvests the real network’s credentials).

The defense is a combination of WIDS (which flags unauthorized APs on the RF side) and 802.1X mutual authentication with EAP-TLS (which makes the evil twin fail the certificate check before the client ever sends credentials).

Deauthentication and DoS

#

802.11 management frames are unauthenticated in WPA2 by default, which means anyone in range can send a deauthentication frame that boots a client off its AP. Aireplay-ng and mdk4 (the actively maintained successor to mdk3) can do this at scale; the result is either a targeted denial of service or, more usefully to an attacker, forcing a client to reconnect so its handshake can be captured for offline cracking.

The mitigation is 802.11w (Management Frame Protection), which cryptographically protects management frames. It’s mandatory in WPA3 and available as an option in WPA2. Turn it on where it’s available.

MITM

#

Once an attacker is on the same wireless segment as a target (via an evil twin, an open guest network, or a compromised PSK), classic MITM techniques apply: ARP spoofing, DNS spoofing, and traffic redirection. Ettercap is the traditional tool; Bettercap is its actively maintained successor and is what most operators use now. MITMf was popular but was archived by its author in 2018; the author explicitly points people to Bettercap instead.

SSLStrip was the standard follow-on for downgrading HTTPS to HTTP, but HSTS preloading has largely killed it for major sites; it still works against sites that don’t set HSTS or aren’t on the preload list, but that’s a much smaller target set than it was.

Eavesdropping

#

On an unencrypted network, anyone in range with a wireless adapter in monitor mode captures traffic directly. On a WPA2-PSK network, anyone with the passphrase can decrypt everyone else’s traffic after capturing their 4-way handshake, which is worth remembering the next time you consider handing out the office Wi-Fi password to a visitor.

WPA3’s forward secrecy specifically addresses this: even with the passphrase, an attacker can’t decrypt previously captured sessions.

Password cracking

#

Weak Wi-Fi passphrases fall to offline dictionary and rule-based attacks with Hashcat (still the standard) or John the Ripper. The typical modern workflow is: capture the PMKID or a handshake with Aircrack-ng or hcxdumptool, convert to Hashcat’s format, run against a strong wordlist plus rule set. Passphrases from rockyou.txt fall in seconds; long, random passphrases don’t fall in useful time even at cracking-rig speeds.

Social engineering and wireless network security

#

Wireless attacks don’t have to be radio attacks. Getting someone to hand over the credential or connect their laptop to the wrong network is often easier than breaking the crypto.

• Pretexting: an attacker calls, poses as IT, and asks for the Wi-Fi password or asks the target to “help troubleshoot” by connecting to a specific SSID.
• Phishing: fake IT emails asking users to reauthenticate against a page that harvests corporate credentials, which the attacker then uses against 802.1X.
• Baiting: dropped USB drives near the target site, sometimes with a captive-portal-style landing page that phishes for network credentials after autorun.
• Tailgating: physical access into a controlled space, at which point the attacker is in range of internal Wi-Fi and any of the RF attacks above become options.

The technical mitigations for these don’t sit on the wireless network at all: they’re user awareness training, phishing-resistant MFA, EAP-TLS instead of password-backed auth, and physical access controls.

Wireless network penetration testing

#

Everything in the attacks section above is what a wireless pentest does under an authorized scope. A few specific areas worth calling out:

• WEP networks: still worth checking for in legacy environments; Aircrack-ng plus enough IVs cracks the key in minutes.
• WPS-enabled networks: Reaver’s original repo has been dormant for years; the actively maintained forks (kimocoder’s Bully fork, in Kali) still work against unpatched APs. Pixie Dust attacks work in seconds against vulnerable chipsets.
• WPA2/WPA3 PSK: PMKID capture with hcxdumptool + offline cracking with Hashcat is the standard modern approach.
• Enterprise (WPA2/WPA3-Enterprise): eaphammer or hostapd-wpe with an evil twin captures NetNTLMv1/v2 handshakes for offline cracking, if the client doesn’t validate the server certificate correctly, which many still don’t.
• Bluetooth and BLE: Ubertooth One for capture and analysis; Bettercap has BLE modules for scanning and pairing attacks.
• RFID and NFC: Proxmark3 is the standard hardware, with the RfidResearchGroup (“Iceman”) firmware fork rather than the original repo. Flipper Zero has become a common lighter-weight alternative for card cloning and access badge work.

Regulatory compliance and wireless security

#

Most regulatory frameworks touching wireless security don’t dictate specific protocols; they require encryption, access controls, and monitoring at a level that WPA3 (or WPA2-Enterprise with AES-CCMP) meets by default. What varies is the audit trail and the incident-response process each framework requires.

• HIPAA: protection of electronic personal health information. Requires encryption in transit and adequate access controls for any wireless network carrying ePHI, plus monitoring and audit logging.
• PCI DSS: protection of cardholder data. Explicitly requires WPA2 or better on wireless networks handling card data, along with monitoring for rogue APs.
• SOX: financial information protection, more focused on access controls and audit trails than specific protocol requirements.
• FIPS 140-2/3: for federal government systems, mandates use of NIST-approved cryptographic modules; AES-128 or higher is the baseline for wireless.
• GDPR: personal data of EU citizens. Requires encryption and access controls proportionate to the risk, along with breach notification.
• NIS2 (EU Directive 2022/2555): entered into force January 2023, replaces the original NIS Directive with broader scope and stronger enforcement. Applies to essential-service operators and digital service providers, and mandates incident response and reporting for wireless as part of general network and information system security.
• ENISA guidance: EU-level best-practice recommendations for Wi-Fi, Bluetooth, and NFC.

Future of wireless security

#

Three trends worth tracking:

• WPA3 becoming universal: WPA3 has been mandatory for new Wi-Fi certified devices since 2020. The overlap period where mixed WPA2/WPA3 networks are the norm should end by around the middle of this decade as legacy WPA2-only clients age out. Once WPA3-only becomes practical to enforce, the offline PSK cracking problem effectively goes away for correctly implemented networks.
• 5G and IoT-scale networks: 5G introduces network slicing (isolated virtual networks per use case) and stronger built-in encryption, but massively expands the attack surface via IoT device density. The security story hasn’t fully caught up with the deployment story yet, and it’s a real gap.
• Post-quantum cryptography: NIST finalized initial post-quantum standards in August 2024 (ML-KEM/CRYSTALS-Kyber for key encapsulation, ML-DSA/CRYSTALS-Dilithium for signatures). Wi-Fi and Bluetooth standards will eventually need to fold these in to protect long-lived traffic against future quantum decryption. The migration will take years, but the timeline for starting to plan it is now, not later.

Conclusion

#

Most wireless security fundamentals come down to a few concrete decisions: use WPA3 (or at minimum WPA2 with AES-CCMP, never TKIP or WEP), disable WPS, use 802.1X with certificate-based auth in enterprise environments, monitor for rogue APs with a real WIDS, and enable 802.11w to close off the deauthentication attack. Beyond that, most of what breaks a wireless network isn’t a novel attack, it’s a stale one that landed because a control that would have blocked it wasn’t turned on.

The trends worth watching are WPA3 finally becoming universal, 5G’s IoT explosion, and the eventual post-quantum crypto migration. None of those change the immediate defensive priorities, but they’ll shape what the next generation of wireless security work actually looks like.