Unit 03 of 03
Wireless Security
How many of the claims still hold once the cable ends: the claim encryption generations prove and leave open, along with the devices left out in the transition, the difference between a single shared secret and a per-person identity in terms of trust root and revocation step, the claim a client cannot verify against an evil twin and the path that mutual authentication closes, the frame type that protected management frames close and the one they leave open, the area where the signal spills past the building boundary on a coverage map, and the item unauthorized device scanning finds and the one it does not.
Published Updated
Lessons
- 01 Wireless Encryption Generations Four wireless encryption generations are measured against the same set of ten claims: the old generation built on a stream cipher proves none of the ten claims, the generation using a block cipher in counter mode proves five, and the simultaneous-authentication generation raises that to seven. The cost of the transition is counted in the device inventory: when the top generation is made mandatory, four thousand three hundred twenty-one of four thousand five hundred forty devices are left out. 14 min read
- 02 Authentication Methods Personal and enterprise mode are separated in terms of trust root: a single shared secret in personal mode grants access to all twelve items on a network, and changing it means touching four thousand five hundred forty devices; per-person identity in enterprise mode brings that down to an average of two and a half items, and revocation is a single step. Enterprise mode ties six of seven claims to proof but adds one claim, and does not verify it under the default configuration. 13 min read
- 03 Rogue Access Points Six of the eight signals a client looks at when choosing a network are seen before the connection is made, and none of them carry proof. Across eight registered profiles, four paths to the evil twin are open and three are partially open; trust-root pinning, deleting unused profiles, and turning off automatic connection bring the open path to zero, while the two partial paths close only with a generation mandate that leaves four thousand two hundred ninety-two devices out. 14 min read
- 04 Deauthentication Attacks Of twelve frame types, only one carries integrity proof at baseline; protected management frames bring this count to four and tie three of eight management frames to proof, leaving five unprotected because they are pre-connection. Three of the eight mechanisms that disconnect a connection close; the record the defense sees moves from the disconnect counter to the rejected-frame counter, and the catch rate rises from three sixths to six sixths. 13 min read
- 05 Wireless Network Auditing A fictional branch building's coverage map is calculated on a one-meter grid: the portion of the connectable area that spills outside the building is one thousand eight hundred thirty-eight square meters, the area where frames can only be heard is twenty-nine thousand six hundred twenty-two square meters, twelve times the inside area. Lowering transmit power zeroes the outside connectable area but does not close the audible area; an unauthorized-device scan finds three of six out-of-inventory sources in two hours, one of which is not found even with continuous monitoring. 13 min read