Mobile, Wireless, Firewall Evasion, and Social Engineering

Week 6 · Week 6: Mobile, Wireless, Firewall Evasion, and Social Engineering · Download .docx

Objectives

Compare WEP, WPA2, and WPA3 and explain why WEP is completely broken
Describe the evil twin attack and explain why encryption does not fully prevent it
Distinguish IDS from IPS and explain what each does when malicious traffic is detected
Identify the four primary social engineering vectors and their specific countermeasures
Explain how IP fragmentation is used as a firewall evasion technique

Key terms

WEP: Wired Equivalent Privacy — original Wi-Fi security using RC4 with flawed IV reuse; completely broken and deprecated.
WPA2: Wi-Fi Protected Access 2 — uses AES-CCMP encryption; the current enterprise wireless security standard.
WPA3: Wi-Fi Protected Access 3 — replaces PSK with SAE key exchange; resists offline dictionary attacks against the captured handshake.
SAE: Simultaneous Authentication of Equals — WPA3 key exchange that prevents offline brute-force of the pre-shared key even from a captured handshake.
Evil twin: A rogue access point broadcasting the same SSID as a legitimate network to intercept connecting clients.
IDS: Intrusion Detection System — monitors traffic or host activity for anomalous patterns and generates alerts.
IPS: Intrusion Prevention System — an inline IDS that also actively blocks detected threats in real time.
Phishing: Email-based social engineering designed to steal credentials, deliver malware, or extract sensitive information.
Vishing: Voice phishing — using phone calls to manipulate targets into revealing sensitive information.
Pretexting: Creating a fabricated scenario or false identity to gain a target's trust before extracting information.
Tailgating: Following an authorized person through a secured door without using one's own credentials.
MDM: Mobile Device Management — enterprise software enforcing security policies, app restrictions, and remote wipe on mobile devices.

The concept

Wireless security has evolved through three major generations, each designed to close the exploitable weaknesses of its predecessor. WEP (Wired Equivalent Privacy) used RC4 stream cipher encryption with a 24-bit Initialization Vector (IV). The short IV meant IVs repeated frequently on busy networks, and statistical analysis of the IV repetition allowed recovery of the WEP key from captured traffic within minutes — regardless of key length. WEP is completely and permanently broken; no organization should use it.

WPA2 (Wi-Fi Protected Access 2) replaced WEP's broken RC4 with AES-CCMP encryption. WPA2-Personal uses a pre-shared key (passphrase), which means a captured four-way handshake can be subjected to offline dictionary attacks — the attacker tests passphrases against the captured handshake offline without any interaction with the network. WPA2-Enterprise uses 802.1X/RADIUS with per-user certificates or credentials, eliminating the shared-passphrase problem.

WPA3 addresses WPA2-Personal's offline dictionary attack vulnerability with SAE (Simultaneous Authentication of Equals), which replaces PSK exchange with a protocol that requires live interaction for each guess — offline dictionary attacks against the captured handshake no longer work.

The evil twin attack exploits a fundamental behavior of Wi-Fi clients: they automatically reconnect to known SSIDs based on signal strength. An attacker creates a rogue AP with the same SSID as a known network — clients connect to the strongest signal automatically, sending their traffic through the attacker's device. Encryption mismatch will generate warnings in WPA2-Enterprise (which requires certificate validation), but WPA2-Personal clients often connect without warning.

IDS versus IPS: an Intrusion Detection System monitors traffic or host activity passively, generating alerts when anomalous or signature-matched patterns are detected. An IPS (Intrusion Prevention System) is deployed inline on the network path — it detects the same patterns but actively drops packets, resets connections, or blocks source IPs in real time. A HIDS monitors host-level events (logs, file changes, process behavior); a NIDS monitors network traffic.

Social engineering exploits human psychology rather than technical vulnerabilities. Phishing uses email; vishing uses phone calls; smishing uses SMS. Pretexting constructs a detailed cover story — impersonating IT support, a vendor, or a compliance auditor — to establish trust before the request. Tailgating exploits human courtesy at physical access points, bypassing badge systems. Dumpster diving recovers sensitive information from discarded documents. The defensive layer for social engineering is security awareness training, combined with technical controls: email filtering, DMARC enforcement, caller verification procedures, and physical security policies.

Standards: Maryland Blueprint Pillar 3 · EC-Council CEH v12 Domain 13 (Wireless) + Domain 14 (IDS, Firewalls, Honeypots) + Domain 15 (Social Engineering) · PGCC INT-2681 Outcomes 2, 4, 5.

Worked examples

Example 1: [object Object]

Example 2: [object Object]

Common mistakes

Believing WPA2 is completely secure. WPA2-Personal is subject to offline dictionary attacks against captured handshakes — passphrase strength matters significantly.
Assuming an IPS eliminates all threats. An IPS blocks known signature-matched traffic — novel attacks, encrypted C2 channels, and insider threats bypass signature-based detection.
Treating social engineering as a non-technical problem. Technical controls (email filtering, DMARC, DKIM, SPF, caller-ID verification procedures) substantially reduce social engineering attack surface alongside training.
Confusing bluejacking and bluesnarfing. Bluejacking sends unsolicited messages — annoying but does not access device data. Bluesnarfing exploits Bluetooth vulnerabilities to read stored device data — a different and more serious attack.

Self-check

Try each one before you look. A miss here costs nothing and tells you exactly what to reread.

1. WEP is completely broken because:

2. An IPS differs from an IDS because an IPS:

3. Phishing and vishing are both social engineering attacks that differ in:

Canvas is the official record. This companion enhances the PGCC curriculum; it does not replace it. Last name and class year only. Students with a 504 plan or IEP: your accommodations apply.

↑ Back to top