PATCH//NOTES Open the interactive version
← All lessons
Foundations · Beginner · 6 min

Wi-Fi & wireless security

Bands, channels and the locks on the air.

What it is

Wi-Fi sends data by radio, so anyone in range can pick it up: encryption is what keeps it private. Networks are named by an SSID, and each access point radio has its own BSSID (a MAC address). Wi-Fi uses three bands. 2.4 GHz reaches furthest but is crowded, with only three channels that don't overlap (1, 6 and 11). 5 GHz has many more channels and more speed over a shorter range, and 6 GHz (Wi-Fi 6E and Wi-Fi 7) adds more room still. Standards have generation names: 802.11n is Wi-Fi 4, 802.11ac is Wi-Fi 5 and 802.11ax is Wi-Fi 6. For security, WEP is broken and must never be used. WPA2-Personal uses one shared password, so a captured handshake can be attacked offline with password guesses. WPA3-Personal uses SAE, which stops that offline guessing. Enterprise mode (802.1X with a RADIUS server) gives every user their own login, which is what businesses should use. An open network, even one with a captive portal sign-in page, doesn't encrypt anything.

Real case · 2017

KRACK

Researcher Mathy Vanhoef showed that WPA2's handshake could be tricked into reusing encryption keys (key reinstallation attacks), letting someone in range decrypt some traffic. It was a flaw in the standard itself, so it affected almost every Wi-Fi device; vendors patched it, and WPA3 was designed partly in response.

Source: Wikipedia: KRACK

How defenders stop it

  • Use WPA3, or WPA2/WPA3 mixed mode for older devices; never WEP
  • Use Enterprise mode (802.1X) for staff, so each person has their own login
  • Keep guests on their own network, separated from staff systems
  • Turn off WPS, and watch for rogue access points copying your network's name

Try it yourself

Read a real Wi-Fi survey in the wireless lab

Check yourself

1. Which 2.4 GHz channels don't overlap with each other?

  1. 1, 2 and 3
  2. 1, 6 and 11
  3. 6, 7 and 8
  4. Every channel overlaps
Show answer

1, 6 and 11. Each 2.4 GHz channel is 20 MHz wide but only 5 MHz apart, so only 1, 6 and 11 avoid each other.

2. Why is WPA3-Personal stronger than WPA2-Personal?

  1. It uses a longer password
  2. Its SAE handshake stops attackers guessing the password offline from a captured handshake
  3. It hides the network name
  4. It only works on 5 GHz
Show answer

Its SAE handshake stops attackers guessing the password offline from a captured handshake. With WPA2-Personal, a captured handshake can be attacked with guesses offline. SAE means each guess needs a live exchange with the network.

3. Why did KRACK affect almost every Wi-Fi device?

  1. It was a flaw in the WPA2 standard itself, not one vendor's code
  2. Everyone used the same password
  3. All routers ran the same software
  4. It only affected open networks
Show answer

It was a flaw in the WPA2 standard itself, not one vendor's code. When the flaw is in the standard, every correct implementation inherits it until patched.

Answer them in the app to earn XP.

Next: Running a network →