7.3 Wireless Threats and Attack Concepts

How Wireless Attacks Are Categorized

For the CEH exam, group wireless threats by the security property they break. This framing beats memorizing tool names alone. The content below is conceptual and defensive — it explains what each attack does, the tool that performs it, and how a defender detects it, on networks you are authorized to test.

Rogue Access Point

A rogue AP is any wireless access point connected to the network without authorization — for example, an employee plugging in a personal AP for convenience. It creates an uncontrolled entry point that bypasses perimeter controls. Detection: a wireless intrusion prevention system (WIPS) compares observed BSSIDs against an authorized inventory; wired-side switch-port and MAC monitoring locates the device.

Evil Twin

An evil twin is a specialized rogue AP that copies a trusted SSID (and often a similar BSSID and stronger signal) so clients or auto-connect profiles join it instead of the real network. It enables on-path interception and credential capture via fake captive portals or a spoofed RADIUS endpoint. Detection: WIPS flags a duplicate SSID with an unexpected BSSID, a signal-strength anomaly, or an AP appearing where none is authorized.

Deauthentication and Disassociation

In networks without Protected Management Frames (802.11w), management frames are unauthenticated. Forged deauthentication/disassociation frames knock clients off the AP, causing denial of service and forcing reconnections — which an attacker uses to capture a fresh 4-way handshake. Detection: an abnormal burst of deauth frames or repeated client disconnects in WIPS logs.

RF Jamming

Jamming floods a frequency band with RF energy or noise so legitimate frames cannot be decoded. It is a pure availability attack at the physical layer. Detection: a spectrum analyzer or WIPS shows a sustained noise-floor rise and elevated retransmissions — packet capture alone reveals nothing because no valid frames exist.

The WPA2 Handshake Capture Workflow (Aircrack-ng)

The canonical WPA2-PSK attack chains the Aircrack-ng suite. CEH expects you to map each tool to its role:

Other wireless tools CEH references:

• Wifite — an automation wrapper that orchestrates the whole Aircrack-ng/WPS/PMKID flow against multiple targets with one command; useful for fast, repeatable authorized audits.
• Kismet — a passive 802.11 (and Bluetooth/RF) detector, sniffer, and wireless IDS. It never injects; it identifies networks, can decloak hidden SSIDs in use, logs to PCAP, and supports GPS mapping (wardriving). Because it is passive, it is also a defensive monitoring tool.
• Hashcat / John the Ripper — general password crackers that can accelerate WPA2 handshake/PMKID cracking with GPUs.

Cryptographic and Protocol Attacks

KRACK (Key Reinstallation Attack)

KRACK (2017) is a protocol-level weakness in the WPA2 4-way handshake. By replaying handshake message 3, an attacker forces the client to reinstall an already-in-use key, resetting nonces and packet counters and enabling decryption or replay of frames. KRACK is a flaw in the handshake state machine, not in AES. Mitigation: vendor patches on clients and APs; WPA3's SAE handshake removes this class of issue.

WPS PIN Attack (Reaver / Pixie-Dust)

Wi-Fi Protected Setup (WPS) lets users join with an 8-digit PIN. The protocol validates the PIN in two halves — the first 4 digits, then the next 3 — and the 8th digit is a checksum. That design collapses the brute-force space from 10^8 to 10^4 + 10^3 = at most ~11,000 attempts. Reaver performs the online brute force; the Pixie-Dust attack (reaver -K) exploits weak nonce generation in some chipsets to recover the PIN offline in seconds. Once the PIN is known, the WPA passphrase is revealed regardless of its strength. Mitigation: disable WPS entirely.

Bluetooth, RFID, and NFC Threats

Wireless is broader than Wi-Fi. CEH tests short-range radio threats and their named attacks.

Bluejacking vs bluesnarfing is a classic exam trap: bluejacking is harmless unsolicited messaging (annoyance, no data access), whereas bluesnarfing is the theft of data (contacts, calendars, messages) from a vulnerable device. Bluebugging goes further, hijacking call/messaging functions. Tools like Bluetooth scanners (e.g., btscanner) and Kismet discover nearby Bluetooth devices.