Wireless Security

Wi-Fi is the network most people use every day, at home, in hostels, in offices and at railway stations. Radio signals pass through walls, so anyone nearby can receive them. That makes the encryption and authentication on a wireless network far more important than on a cable you can see.

In this lesson you will learn how Wi-Fi security developed from the broken WEP standard to WPA3, why a WPA2 network is only as strong as its passphrase, which attacks target wireless users, and how to harden a home or office router. This lesson is about concepts and defence. Testing wireless networks needs your own access point and adapter, and capturing other people's wireless traffic is illegal.

Wi-Fi basics

A wireless access point (AP), usually inside your router, broadcasts a network name called the SSID. Devices (clients) join it on the 2.4 GHz, 5 GHz or 6 GHz bands. Wi-Fi standards come from the IEEE 802.11 family, and security certifications such as WPA2 and WPA3 come from the Wi-Fi Alliance.

There are two ways to authenticate:

• Personal (PSK or SAE): everyone shares one passphrase. Used at home and in small offices.
• Enterprise (802.1X): each user logs in with their own credentials or certificate, checked by a RADIUS server. Used in companies and universities.

From WEP to WPA3

WEP failed because its 24-bit initialisation vector repeats quickly, and RC4 has weaknesses that let attackers recover the key from enough captured traffic. WPA with TKIP was designed to run on old WEP hardware as a stop-gap. WPA2 brought proper AES encryption. In 2017 the KRACK research showed that WPA2's four-way handshake could be manipulated to reinstall keys on unpatched devices; operating system and router updates fixed it, which is one more reason to keep devices updated.

Why WPA2-Personal depends on the passphrase

In WPA2-Personal, the key that protects the network (the PMK) is derived from the passphrase and the SSID using PBKDF2 with 4,096 rounds of HMAC-SHA1. This runs on your computer (the browser editor does not include pbkdf2_hmac):

import hashlib

pmk = hashlib.pbkdf2_hmac("sha1", b"password", b"IEEE", 4096, 32)
print(pmk.hex())

f42c6fc52df0ebef9ebb4b90b38a5f902e83fe1b135a70e23aed762e9710a12e

This is a published test value from the IEEE 802.11 standard, so you can check your understanding against it. Two things follow:

• The SSID acts as a salt, so precomputed tables only work for very common network names such as a router's default name.
• Someone within radio range who records a device joining the network can later test passphrase guesses offline, with no further contact with the network. A short or common passphrase falls quickly; a long random one does not.

This estimate shows how much the passphrase matters, assuming an attacker can test one million guesses per second (a rough figure for illustration; real speeds vary greatly with hardware):

RATE = 1_000_000   # guesses per second, an illustrative assumption

candidates = {
    "8-digit mobile-style number": 10 ** 8,
    "8 lowercase letters": 26 ** 8,
    "10 random letters and digits": 62 ** 10,
    "4 random words from a 7,776-word list": 7776 ** 4,
    "5 random words from a 7,776-word list": 7776 ** 5,
}

def human(seconds):
    for unit, size in [("years", 31_536_000), ("days", 86_400), ("hours", 3_600), ("minutes", 60)]:
        if seconds >= size:
            return f"{seconds / size:,.1f} {unit}"
    return f"{seconds:,.0f} seconds"

for name, space in candidates.items():
    print(f"{name:<40} worst case {human(space / RATE)}")

8-digit mobile-style number              worst case 1.7 minutes
8 lowercase letters                      worst case 2.4 days
10 random letters and digits             worst case 26,614.0 years
4 random words from a 7,776-word list    worst case 115.9 years
5 random words from a 7,776-word list    worst case 901,518.5 years

Using your own mobile number or a family name as the Wi-Fi password is one of the most common weaknesses in Indian homes and small shops. Use a long random passphrase and share it with a QR code instead.

What WPA3 improves

• SAE (Simultaneous Authentication of Equals) replaces the PSK handshake. Every guess requires a live exchange with the access point, so recording a handshake no longer allows offline guessing.
• Forward secrecy: learning the passphrase later does not decrypt traffic recorded earlier.
• Protected Management Frames (PMF) are mandatory, which blocks forged "deauthentication" frames that attackers use to knock users off a network.
• WPA3-Enterprise 192-bit mode for high-security organisations.
• Wi-Fi Enhanced Open (OWE), a companion certification, encrypts traffic on open networks such as cafés, even without a password.

The 6 GHz band (Wi-Fi 6E and Wi-Fi 7) does not allow WPA2 at all: networks there must use WPA3 or Enhanced Open. Early WPA3 implementations had flaws (published as "Dragonblood" in 2019) that firmware updates fixed. WPA2/WPA3 transition mode helps older devices connect, but it lets a capable attacker push some clients down to WPA2, so switch to WPA3-only once all your devices support it.

Other wireless threats

• WPS: the 8-digit PIN method of Wi-Fi Protected Setup can be brute-forced because the router checks the PIN in two halves. Turn WPS off.
• Evil twin: an attacker sets up an access point with the same name as a real one (for example a café's or a railway station's Wi-Fi) so devices connect to it instead. Use HTTPS, a trusted VPN on public Wi-Fi, and Enterprise networks that verify the server's certificate.
• Rogue access points: an employee plugs an unapproved router into the office network, creating an unprotected entry point. Wireless intrusion detection and regular surveys find them.
• Router weaknesses: default admin passwords, old firmware and remote administration exposed to the internet.

Hardening checklist

This script audits a router's settings against a simple checklist:

router = {
    "security": "WPA2/WPA3",
    "cipher": "AES",
    "passphrase": "9812345678",
    "wps": True,
    "admin_password_changed": False,
    "firmware_age_days": 400,
    "remote_admin": False,
    "guest_network": True,
}

problems = []
if router["security"] in ("WEP", "WPA", "Open"):
    problems.append("use WPA3 (or WPA2-AES if devices cannot do WPA3)")
elif router["security"] == "WPA2/WPA3":
    problems.append("transition mode: move to WPA3-only when all devices support it")
if router["cipher"] != "AES":
    problems.append("TKIP is obsolete, choose AES")
if len(router["passphrase"]) < 15 or router["passphrase"].isdigit():
    problems.append("passphrase too short or only digits")
if router["wps"]:
    problems.append("turn off WPS")
if not router["admin_password_changed"]:
    problems.append("change the default admin password")
if router["firmware_age_days"] > 180:
    problems.append("check for firmware updates")
if router["remote_admin"]:
    problems.append("disable remote administration")

for p in problems:
    print("-", p)
print("Guest network for visitors and IoT:", "yes" if router["guest_network"] else "add one")

- transition mode: move to WPA3-only when all devices support it
- passphrase too short or only digits
- turn off WPS
- change the default admin password
- check for firmware updates
Guest network for visitors and IoT: yes

For organisations, prefer WPA3-Enterprise (or WPA2-Enterprise) with EAP-TLS certificates, configure devices to check the RADIUS server's certificate, and put guests and IoT devices on separate networks.

Common mistakes

• Keeping WEP or TKIP "for one old device". It weakens the whole network. Replace the device or isolate it.
• Using a phone number, birth date or shop name as the passphrase. Offline guessing finds these quickly.
• Leaving WPS on because it is enabled by default.
• Trusting a network because of its name. Anyone can broadcast any SSID.
• Testing a neighbour's or college Wi-Fi. Only test access points you own, inside your lab.

Key points

• WEP and WPA (TKIP) are broken; WPA2 with AES is acceptable only with a strong passphrase; WPA3 is the current standard.
• WPA2-Personal derives its key from the passphrase and SSID, so captured handshakes allow offline guessing.
• WPA3's SAE stops offline guessing, adds forward secrecy and requires Protected Management Frames.
• Disable WPS, change default admin passwords, update firmware and use guest networks.
• Evil twins and rogue access points are defeated by HTTPS, certificate checks and monitoring.

router = {"security": "WPA3", "cipher": "AES", "passphrase": "teal-mango-river-kite",
          "wps": False, "admin_password_changed": True, "firmware_age_days": 30, "remote_admin": False}

problems = []
if router["security"] != "WPA3":
    problems.append("upgrade security")
if router["cipher"] != "AES":
    problems.append("use AES")
if len(router["passphrase"]) < 15 or router["passphrase"].isdigit():
    problems.append("weak passphrase")
if router["wps"]:
    problems.append("WPS on")
if not router["admin_password_changed"]:
    problems.append("default admin password")
if router["firmware_age_days"] > 180:
    problems.append("old firmware")
if router["remote_admin"]:
    problems.append("remote admin on")

score = max(0, 100 - 20 * len(problems))
print("Problems:", problems)
print("Score:", score)