CyberCode Academy

Course 13 - Network Forensics | Episode 6: Wireless Network Analysis, Standards, and Security Forensics

Listen Later
In this lesson, you’ll learn about:
  • Wireless networking fundamentals, standards, and modulation techniques
  • Key 802.11 amendments and operating modes
  • The evolution of Wi-Fi security from WEP to WPA2 Enterprise
  • Common wireless threats and attack techniques
  • Forensic considerations when investigating compromised wireless devices
1. Wireless Fundamentals and Standards Wireless LANs rely on several core components:
  • Access Points (APs)
  • Wireless NICs
  • Antennas, such as Yagi, parabolic, and omnidirectional models
Wi-Fi operates mainly in unlicensed frequency bands, typically 2.4 GHz and 5.8 GHz. Spread Spectrum Techniques These methods reduce interference and support reliable wireless communication:
  • Frequency Hopping Spread Spectrum (FHSS)
    • Used in early 802.11
    • Continuously hops frequencies to resist narrowband interference from devices like Bluetooth or microwaves
  • Direct Sequence Spread Spectrum (DSSS)
    • Used in 802.11b/g
    • Works best on the non-overlapping channels (1, 6, 11) in 2.4 GHz
    • Limited channel spacing drove the move to 5.8 GHz (802.11a/ac), enabling more adjacent APs with less interference
Key 802.11 Amendments
  • 802.11c – Enabled MAC bridging to connect facilities
  • 802.11e – Introduced QoS for reliable audio/video transmission
  • 802.11f – Developed roaming capabilities between APs
  • 802.11i – Major security upgrade and foundation of WPA2 Enterprise
    • Enabled port-level authentication with RADIUS and smart cards
Operational Modes
  • Infrastructure Mode (BSS) – Uses an AP
  • Ad Hoc Mode (IBSS) – Peer-to-peer without an AP
Wireless Application Protocol (WAP)
  • Used older mobile devices
  • Pages structured using WML, based on XML, divided into decks and cards
2. Evolution of Wireless Security Protocols WEP (Wired Equivalent Privacy)
  • Early Wi-Fi security but fundamentally flawed
  • Claimed “64-bit encryption,” but truly offered 40-bit key strength
  • Used a 24-bit IV, transmitted in clear text
    • IV space exhausted quickly → collisions → RC4 encryption breaks
  • Relied on static keys and manual distribution
WPA (Wi-Fi Protected Access) Created as a temporary fix to WEP’s failures:
  • Increased IV space from 24 to 48 bits
  • Used 128-bit keys
  • Introduced TKIP for dynamic key generation
  • Initially used RC4, later transitioned to AES + TKIP
WPA2 Enterprise Introduced via 802.11i:
  • Uses AES encryption (later with ECC)
  • Implements port-level authentication through RADIUS
  • Supports enterprise credentials and smart cards
  • Considered the standard for strong Wi-Fi security
3. Wireless Threats and Attack Techniques Misconceptions and Weak Protections
  • SSID Hiding
    • Ineffective—SSID appears in clear text in management frames
  • MAC Filtering
    • Easily bypassed via MAC spoofing
Common Wireless Attacks
  • Eavesdropping (passive sniffing)
  • War Driving (locating WLANs while moving)
  • DoS Attacks
    • Flooding deauthentication frames
    • Spoofing AP messages
  • DNS Poisoning
  • Rogue Access Points
    • Attackers create a fake AP with the same SSID
    • Tools like the WiFi Pineapple attract clients using a stronger signal
Bluetooth Threats
  • Bluejacking – Sending unsolicited messages
  • Bluesnarfing – Stealing data via unauthorized Bluetooth access
Link Encryption Concerns
  • Wi-Fi uses link-layer encryption, meaning:
    • Data is decrypted and re-encrypted at every hop
    • Each hop creates an additional point of vulnerability
4. Wireless Forensics and Investigation To investigate compromised wireless devices, analysts must understand:
  • How authentication and association occur
  • That Wi-Fi uses symmetric, shared-key encryption
    • The same key encrypts data on the client and decrypts it on the AP
  • How to detect abnormal wireless activity
Key Forensic Techniques
  • Conduct wireless site surveys
  • Use tools such as:
    • NetStumbler (network discovery)
    • Wireshark (packet capture and analysis)
  • Examine management frames, signal strength patterns, and authentication logs


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy