Wireless Network Security Flashcards

An attacker sends 802.11 deauthentication frames spoofed as the legitimate access point to disconnect clients. What attack is being performed?

Answer: Deauthentication/Disassociation attack (DoS)

A deauthentication attack exploits the unauthenticated nature of 802.11 management frames, allowing an attacker to forge de-auth frames and disconnect legitimate clients from an AP.

KRACK (Key Reinstallation Attack) targets which phase of the WPA2 protocol?

Answer: The 4-way handshake used to establish session keys

KRACK manipulates retransmissions in the WPA2 4-way handshake to force nonce reuse, allowing decryption and potentially injection of traffic by reinstalling an already-in-use cryptographic key.

An attacker sets up a wireless access point near a coffee shop that mimics the legitimate free Wi-Fi, hoping users will connect to it. This is known as which attack?

Answer: Evil twin attack

An evil twin attack creates a fraudulent AP that mimics a legitimate one, tricking users into connecting so the attacker can intercept traffic, capture credentials, or conduct man-in-the-middle attacks.

The Wi-Fi Protected Setup (WPS) PIN method was found to be vulnerable to brute-force attacks requiring fewer than 11,000 guesses rather than 100 million. What design flaw causes this?

Answer: The 8-digit PIN is validated in two halves independently, reducing the keyspace

WPS validates the first 4 digits of the PIN separately from the last 4 (minus a checksum digit), reducing the brute-force space from 10^8 to roughly 10^4 + 10^3 = ~11,000 guesses.

Wardriving is a reconnaissance technique used to discover wireless networks. Which tool combination is most commonly associated with wardriving on Linux?

Answer: Kismet + GPS receiver

Kismet is a passive wireless network detector and sniffer, and when combined with a GPS receiver it can map discovered networks geographically, which is the core capability used in wardriving.

Which Bluetooth attack allows an attacker to pair with a device without the owner's knowledge and access calendar, contacts, and messages?

Answer: Bluesnarfing

Bluesnarfing exploits vulnerabilities in OBEX Push Profile or OBEX File Transfer Profile to access sensitive data on a Bluetooth device without user authorization or authentication.

A network defender captures 802.11 beacon frames with the SSID field set to null (empty string). What is the attacker or administrator attempting to accomplish?

Answer: Hiding the network name to reduce casual discovery (SSID cloaking)

SSID cloaking (hiding) sets the SSID field to null in beacon frames, making the network invisible to casual scanners; however, passive sniffers can still capture the SSID from probe requests and responses.