Wi-Fi Network Attacks and Protocol Weaknesses

Fri Sep 18 2026

Wi-Fi Network Attacks and Protocol Weaknesses

Wi-Fi security is a layered story: each protocol upgrade (WEP → WPA → WPA2 → WPA3) patches the previous version’s fatal flaws, but new attack surfaces emerge alongside old ones. Understanding how these attacks work at the protocol level — not just as black-box tool names — lets you actually defend against them instead of just running scanners.

This post walks through four areas: what information beacon frames leak during reconnaissance, why WEP is mathematically breakable, how WPS PIN validation enables brute-force recovery, and what hardening configuration changes actually move the needle.

Wireless Reconnaissance: Beacon Frames Are an Open Book

Every Wi-Fi access point broadcasts beacon frames every ~100 milliseconds. These frames are unencrypted management traffic — any station on the same channel can parse them without credentials. The SSID, supported data rates, security capabilities, and HT/VHT/HE capabilities all flow openly.

The beacon analysis script in this demo parses a synthetic beacon’s information elements to show what each field reveals. In this run:

Beacon interval was set to 100 TU (= 102400 µs), which tells an attacker how long between scan windows they need to wait for new beacons.
Nine supported rates were listed, with the first four marked mandatory (high bit set in the rate code). The mandatory flag matters because it means legacy clients must be able to communicate at these rates even when connected on a faster link.
RSN/WPA2 information element revealed CCMP and TKIP as pairwise ciphers alongside 802.1X/WPA2-Enterprise and PSK auth methods. The script flagged TKIP as a warning: its presence means the AP falls back to TKIP for clients that don’t support AES, and that downgrade path is where most attacks land.
HT capabilities showed channels [1, 6, 11] with a max MPDU of 7935 bytes — an attacker uses this to determine what rate to probe the AP at and how large captured packets can be.

The key insight from beacon analysis is that both administrators and attackers parse the same frames. The difference is intent: an admin checks “is WPA2/AES enabled?” while an attacker asks “can I downgrade to TKIP? Is WPS enabled?”

Disassociation at the Frame Level

Management frames in open Wi-Fi are unencrypted — there’s no authentication of who sends a deauthentication frame. The IEEE 802.11 deauthentication frame structure is:

┌──────────────────┬───────────┬───────────────────────┐
│ Field            │ Size      │ Notes                 │
├──────────────────┼───────────┼───────────────────────┤
│ Frame Control    │ 2 bytes   │ type=0x00, subtype=0xC│
│ Duration         │ 2 bytes   │ Often zero for mgmt   │
│ Address 1 (DA)   │ 6 bytes   │ MAC of target station │
│ Address 2 (SA)   │ 6 bytes   │ Forged as AP/client   │
│ Reason Code      │ 2 bytes   │ Standard reason code  │
└──────────────────┴───────────┴───────────────────────┘

Any station on the same channel can forge these frames. The deauth frame targets a specific MAC address (usually the client), with the source address forged to look like it came from the AP. Since the management frame has no integrity check, the target’s association is torn down without verification.

The fix came with 802.11w (Protected Management Frames, PMF), which cryptographically authenticates management frames. WPA3 mandates PMF; WPA2 supports it optionally.

WEP Breakdown: Why RC4 Misuse Is Fatal

WEP’s cryptography failures are among the best-documented in security history. Three structural flaws compound to make the protocol breakable in minutes:

A single shared key for all clients (same 40/104-bit key everywhere)
A 24-bit IV space (~16.7 million values) that inevitably repeats under load
CRC-32 as integrity check, which is linear and thus forgeable without the key

The IV collision demonstration in this run proves the core attack mathematically using synthetic toy data:

Two plaintexts were XORed with the same keystream (identical WEP key + IV pair) to produce ciphertexts C1 and C2.

When an attacker XORs C1 with C2, the keystream cancels out: C1 XOR C2 = P1 XOR P2. This run confirmed the match:

C1 XOR C2 (keystream cancels): 162c7e660c4e13130a03...
P1 XOR P2 (what we want):      162c7e660c4e13130a03...
Match: True

With known plaintext at the start of any frame, an attacker recovers the keystream bytes and applies them to other frames sharing the same IV. This run showed the attacker knowing "AES encryption key" (first 18 bytes of P1), recovering those exact keystream bytes from C1, then decrypting the same-position bytes from C2:
```
Attacker knows first 18 bytes of P1: 'AES encryption key'
Recovers same-position bytes from C2:
  'Wi-Fi passphrase i' (expected: 'Wi-Fi passphrase i')
Match: True
```

The CRC-32 bypass section showed another angle: WEP appends CRC-32 of the plaintext, then encrypts everything with RC4. Because CRC is linear, flipping a bit in the ciphertext at any position is equivalent to flipping the same bit in the plaintext, and the attacker can compute the new valid CRC from the modified (known) plaintext — no decryption needed.

WEP’s 24-bit IV space meant that on any busy network, IV collisions occur constantly. The FMS (Fleron-Morgenstern-Simon) attack exploits “weak” IV patterns (where IV[0] = k+3, IV[0] = 255) to recover WEP key bytes one at a time from the RC4 Key Scheduling Algorithm’s early permutation state. With ~4,000–5,000 weak IVs collected over minutes on a busy network, statistical analysis narrows down to the correct key.

WPS PIN Weakness: Convenience That Broke Authentication

WPS was designed for consumer convenience: an 8-digit PIN replaces a passphrase. But the design has two fatal flaws that make brute-force recovery trivial:

Checksum digit: The last digit (position 7) is computed from positions 0–6 via a weighted sum mod 10. Only 7 digits carry entropy, not 8.
Two-stage validation: The AP checks the first 4 digits separately from the last 3+1 digits. An attacker brute-forces each half independently.

The PIN structure demonstration calculated the check digit for the example PIN 48327196:

Weighted sum of positions 0–6: 4×3 + 8×7 + 3×3 + 2×7 + 7×3 + 1×7 + 9×3 = 146
Check digit: 146 mod 10 = 6 — confirmed correct

The split brute-force attack reduces complexity from 10,000,000 (7 random digits) to roughly 20,000:

Half 1 (first 4 digits): up to 10,000 attempts. The demo found the target [4, 8, 3, 2] after exactly 4,833 iterations (since itertools.product generates tuples in lexicographic order: index of (4,8,3,2) = 4×10³ + 8×10² + 3×10¹ + 2×10⁰ = 4832, so the 4,833rd iteration matches).
Half 2 (last 3 random digits + checksum): only up to 10 attempts per prefix, because for any 3-digit prefix, exactly one of ten possible checksum values produces a valid WPS PIN.

This 500x reduction is why tools like Reaver could recover WPA-PSSK keys via WPS in minutes — not hours or days as brute-forcing the actual passphrase would require.

Evil Twin Detection

An evil twin mimics the SSID of a legitimate AP. Detection requires monitoring multiple parameters simultaneously:

BSSID (MAC): The most reliable indicator. Two radios claiming the same SSID with different MAC addresses — one is fake.
WPS enabled: Legitimate corporate/home networks rarely have WPS on; an evil twin enables it to harvest PINs.
Signal strength: An evil twin placed nearby will show stronger RSSI than the legitimate AP.

Mitigations: use 802.1X (EAP-TLS) with certificate validation, monitor for BSSID changes, and configure clients to require WPA3-SAE — an evil twin cannot replicate SAE authentication.

Essential Hardening Practices

Every vulnerability discussed above maps to a configuration choice. The hardening auditor in this demo checks configurations against security best practices:

The insecure configuration audit found multiple critical findings:

WPA2 instead of WPA3-SAE (CRITICAL)
TKIP fallback enabled (HIGH) — allows downgrade attacks
WPS PIN mode enabled (HIGH) — enables brute-force recovery
PMF set to optional rather than required (MEDIUM)
Admin password “admin123” (too short, no complexity)
Guest network not isolated from LAN

The hardened configuration applies:

WPA3-SAE for authentication (no passphrase brute-forcing; SAE’s simultaneous authentication of equals prevents offline dictionary attacks)
TKIP disabled entirely — no fallback to legacy cipher
WPS disabled — removes the PIN attack surface entirely
PMF set to “required” — authenticates management frames per 802.11w
Non-default SSID — avoids default vendor SSIDs that hint at default admin credentials
Strong admin password (35 characters, mixed case, symbols) for the AP web interface
Guest network with isolation — prevents lateral movement from compromised client devices

Takeaway

Wi-Fi security failures almost always trace to a design decision made during standardization: WEP’s small IV space, WPS’s two-stage PIN validation, and management frames’ lack of authentication were all convenience-over-security choices. The defense is equally configuration-driven — WPA3-SAE + PMF required + WPS disabled + TKIP off — but requires knowing what to look for beyond the SSID and “WPA2” badge on the device label.