CCT: Wireless Attacks

A guide to wireless security attacks covering rogue access points, evil twins, Bluetooth attacks (Bluesmacking, Bluejacking, Bluesnarfing, Bluebugging), and RFID attacks.

Wireless Attack Surface

Wireless networks introduce a fundamentally different attack surface compared to wired infrastructure. Because signals travel through the air, any device within range can potentially intercept or interact with wireless communications — without needing physical access to a cable, switch, or port.

The key threat categories in wireless security are:

  • Rogue and evil twin access points
  • Bluetooth-based attacks
  • RFID attacks

Rogue Access Point and Evil Twin

A Rogue Access Point (Rogue AP) is a wireless access point set up to look like a legitimate network. Its purpose is to collect user information when victims mistakenly connect to it instead of the real network.

An Evil Twin (also called a honey spot or honeypot AP) is a more targeted variant — a rogue AP that exactly mimics the SSID and appearance of a legitimate AP to lure specific users.

md 
Legitimate Network:
User --> [Corporate-WiFi AP] --> Internet

Evil Twin Attack:
User --> [Corporate-WiFi AP (FAKE)] --> Attacker --> Internet
         (identical SSID and signal strength)
         (attacker captures all traffic in cleartext)

When a victim connects to the evil twin, the attacker can:

  • Capture all unencrypted traffic
  • Intercept credentials on HTTP sites
  • Perform MITM attacks on HTTPS via SSL stripping
  • Serve malicious content

AP MAC Spoofing

AP MAC spoofing is used to gain unauthorized access to a network when MAC address filtering is enabled. The attacker changes the MAC address of their wireless adapter to match a known, authorized device and bypass the filter.

Bluetooth Attacks

Bluetooth attacks target devices within short range (typically up to 10 meters, or 100 meters for Class 1 devices). Because Bluetooth is always-on in many devices, it presents a persistent attack surface.

Bluesmacking

Bluesmacking is a Denial-of-Service attack that overflows Bluetooth-enabled devices with random packets, causing the device to crash or become unresponsive.

Bluejacking

Bluejacking is the art of sending unsolicited messages over Bluetooth to nearby Bluetooth-enabled devices such as mobile phones and laptops. While bluejacking is often considered a prank, it can also be used to deliver malicious links or files.

Bluesnarfing

Bluesnarfing is the theft of information from a wireless device through a Bluetooth connection. A successful bluesnarfing attack can expose:

  • Contacts and calendar data
  • Text messages and emails
  • Media files
  • Device identifiers

Bluesnarfing typically exploits vulnerabilities in the OBEX protocol used by older Bluetooth implementations.

BlueSniff

BlueSniff is proof-of-concept code for a Bluetooth wardriving utility — designed to discover, track, and map Bluetooth devices in a given area. While intended as a research tool, it demonstrates how easily Bluetooth devices can be enumerated from a distance.

Bluebugging

Bluebugging is the most serious Bluetooth attack — it allows an attacker to remotely access a Bluetooth-enabled device and use all of its features without the owner's knowledge.

Capabilities gained through bluebugging:

  • Make and intercept phone calls
  • Send and read SMS messages
  • Access the internet using the device's connection
  • Listen through the device's microphone
  • Control the device remotely

md 
Bluetooth Attack Severity:
Low     ----> High
Bluejacking  Bluesmacking  Bluesnarfing  Bluebugging
(annoyance)  (denial)      (data theft)  (full control)

RFID Attacks

Radio Frequency Identification (RFID) is used in access cards, payment cards, passports, and inventory tracking. RFID systems communicate wirelessly between a tag and a reader, which creates attack opportunities.

Reverse Engineering

Attackers gain physical access to an RFID chip and read its memory contents to retrieve sensitive data such as:

  • PINs
  • Biometric data
  • Personal identification information
  • Access credentials

Power Analysis Attack

A side-channel attack that enables attackers to crack passwords or cryptographic keys by analyzing the power-consumption patterns of a network device or RFID reader during cryptographic operations. Different operations consume measurably different amounts of power, which leaks information about the keys being used.

RFID Eavesdropping

Attackers intercept the legitimate RF transmissions between an RFID tag and its reader to capture credentials or access tokens without being detected.

md 
Normal RFID:
[RFID Tag] <---RF signal---> [RFID Reader] --> Access Granted

RFID Eavesdropping:
[RFID Tag] <---RF signal---> [RFID Reader]
                   ^
               [Attacker's antenna listening]
               captures the exchange silently

Defending Against Wireless Attacks

Key countermeasures for wireless threats:

  • Disable SSID broadcasting (reduces discoverability but not a full defense)
  • Use WPA3 for wireless encryption — WEP and WPA1 are completely broken
  • Enable MAC address filtering as an additional layer (not a standalone control)
  • Deploy wireless intrusion detection systems (WIDS) to detect rogue APs
  • Train users to verify network legitimacy before connecting in public places
  • Disable Bluetooth when not in use and set devices to non-discoverable mode
  • Use RFID shielding wallets and sleeves for access cards and passports
  • Implement mutual authentication in RFID systems to prevent cloning