Lesson 52 · Network security: attacks and defences

Defence: WPA3 and enterprise Wi-Fi (802.1X)

First see three common attacks on WPA2 Wi-Fi from the defending laptop's side: a recorded handshake that lets an attacker test password guesses offline, a forged "disconnect" frame the laptop believes, and an evil twin with the same name. Then watch each one fail. WPA3's SAE login leaves a recording with nothing to test password guesses against. Protected Management Frames make a forged "disconnect" useless. Enterprise Wi-Fi (802.1X) gives every person their own login and per-user keys, and the laptop checks the RADIUS server's certificate, so an evil twin cannot pass.

15 min14 steps5 questionsBeginner

Fig 52 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01An attacker recorded a WPA2-Personal 4-way handshake. Why can't the access point stop the password guessing that follows?

The recording holds everything except the password: the SSID, both MAC addresses, both nonces and the MICs. A guess is right if it rebuilds the same MIC, and that check happens on the attacker's own computer, with no lockout and no log.

02Two networks called "OfficeNet" appear, and one is an evil twin. On WPA2-Personal, why can't the laptop tell them apart?

A network is chosen by its name, and a MAC address proves nothing. The WPA2-Personal handshake shows only that both sides know the shared password, so any staff member or guest who knows it could run a twin that passes.

03An attacker records a WPA3-Personal (SAE) login. What can they do with the recording?

SAE hides the password point behind fresh random secrets, so a recording cannot confirm or rule out a guess. With WPA2-Personal, the recorded 4-way handshake could be checked against guesses offline.

04Why does a forged deauthentication frame fail on a WPA3 network?

With PMF, a real disconnect notice is protected with a key only the access point and laptop share (CCMP for unicast, BIP for broadcast). The attacker cannot make that check, so the laptop discards the frame.

05An evil twin copies the office network's name. Why can't it get a user's password on a correctly set-up 802.1X network?

The laptop checks that the server's certificate was signed by the CA it was set up to trust and that the name matches. Without the real server's private key, the twin fails the check. This only works if certificate checking is turned on.

Key terms

Glossary

4-way handshake: Four EAPOL-Key frames that turn the shared master key (PMK) into fresh session keys. In WPA2-Personal, a recording of it is enough to test password guesses offline.
Evil twin: A rogue access point that copies a real network's name (SSID) to lure devices into joining it.
WPA3: The current Wi-Fi security standard from the Wi-Fi Alliance. WPA3-Personal uses SAE; both Personal and Enterprise require Protected Management Frames.
SAE: Simultaneous Authentication of Equals (Dragonfly): a password login where both sides prove they know the password without giving anything that can be guessed offline.
Forward secrecy: Traffic recorded today stays safe even if the long-term secret (here the password) leaks later, because each session key came from throwaway random secrets.
PMF: Protected Management Frames (from IEEE 802.11w): integrity checks on management frames such as deauthentication, so forged ones are ignored.
802.1X: Port-based network access control: a device gets in only after an authentication server approves its own credentials.
RADIUS: Remote Authentication Dial-In User Service: the server protocol (UDP port 1812) that checks each user's login and hands the access point their key.

Fine print

Notes and sources

WPA3 "transition mode" lets old WPA2 devices join the same network. Those WPA2 links get none of SAE's protection, so turn it off once every device supports WPA3.
The evil-twin defence only works when each device is set to validate the server certificate and its name. A profile that skips the check, or asks users to accept any certificate, reopens the attack.
SAE stops offline guessing, not online guessing: a short or common password can still be tried live, slowly. Use a long passphrase.
PMF protects disconnect frames only after the keys are in place, and it cannot stop radio jamming, which is illegal in most countries.
MAC addresses are documentation values from RFC 7042 (00:00:5e:00:53:xx). The office LAN uses the private range 192.168.10.0/24 (RFC 1918). example.com is reserved for examples (RFC 2606); "OfficeNet" and the CA name are made up.

Quiz Unlocks after the last step.