LockInCS

Topic 1.3 · Unit 1: Introduction to Security · 15 minute session

1.3 Best Practices for Public Networks

Adversaries differ in skill, from low-skilled users of purchased tools to high-skilled creators of new tools who find zero days, and in motivation. On wireless networks they use evil twin, jamming and war driving attacks. Individuals protect themselves by checking network names exactly, thinking about data sensitivity on unencrypted Wi-Fi, and considering a virtual private network (VPN).

Big idea Public Wi-Fi is convenient for adversaries too. Know the adversary, know the attack, verify before you connect.

Course and exam description (CED) codes covered: 1.3.A.11.3.A.21.3.B.11.3.B.21.3.B.31.3.C.11.3.C.21.3.C.3

Last reviewed against the CED:

By the end of this session you can

  • 1.3.A Identify the type of adversary conducting a cyberattack.
  • 1.3.B Identify types of wireless cyberattacks.
  • 1.3.C Describe actions individuals can take to increase protection of sensitive data when using the internet and Wi-Fi.

Already know this? Jump to the checkpoint.

New to SSIDs, access points and beacons? The Networking Basics session on wireless covers them in 10 minutes.

1. Who the adversaries are (1.3.A)

Adversaries can be grouped by skill 1.3.A.1:

Low-skilled High-skilled
Tools Use malicious tools made by others, often bought online Create new tools or modify existing ones to beat new defenses
Vulnerabilities Exploit known vulnerabilities Can also discover undocumented vulnerabilities, called zero days

Their motivations vary too: greed, desire for recognition, dedication to a cause, revenge, politics or beliefs 1.3.A.2.

2. Three wireless attacks (1.3.B)

Attack What the adversary does Result
Evil twin 1.3.B.1 Sets up their own wireless access point (WAP) with a service set identifier (SSID) similar or identical to the real network Victims who join it send their traffic through the adversary. Traffic using an encrypted protocol such as Hypertext Transfer Protocol Secure (HTTPS) stays unreadable.
Jamming 1.3.B.2 Floods the area with a strong electromagnetic (EM) signal in the network’s frequency range Legitimate traffic between users and the access point (AP) is blocked: a denial of service (DoS) attack
War driving 1.3.B.3 Drives or walks around a target, detecting the network’s beacons Learns the type of wireless network and where the signal leaks outside the building
Your device sees two similar network names. It means to join the real access point, SunCafe-WiFi, but actually joins the evil twin, SunCafe_WiFi, run by the adversary, so traffic passes through the adversary before the internet. Encrypted traffic such as HTTPS cannot be read; unencrypted traffic such as DNS queries can be exposed.
Evil twin: a look-alike network that captures your traffic.
Real view: two networks share one name, and only one is locked. Ask staff which is real before you join.

3. Protecting yourself on public Wi-Fi (1.3.C)

  • Match the name exactly. Confirm the network you join is exactly the one you meant to join 1.3.C.1.
  • Think about how sensitive your data is. Most internet protocols are encrypted, but some data, such as domain name system (DNS) queries, can still be exposed. Decide whether your data is sensitive enough to avoid joining unencrypted Wi-Fi 1.3.C.2.
  • Consider a virtual private network (VPN). A VPN encrypts all your traffic to the VPN operator’s system, so the network or service provider cannot view it. The trade-off: the VPN provider can 1.3.C.3.

Prevent: a VPN does not remove trust; it moves it. Choose a provider you trust as much as you would trust your internet provider.

Lock it in: memory hooks

One picture per idea. If you remember the hook, you can rebuild the details.

  • Evil twinSame name, different owner: check the network name letter by letter.
  • JammingJamming is shouting over the conversation: nobody can hear, so service is denied.
  • War drivingWar driving is a map-making trip: drive or walk around, log every beacon, find where the signal leaks outside.
  • VPNA VPN moves who can see your traffic. It hides it from the cafe, not from the VPN company.

Common misconceptions

  • "On an evil twin, the adversary can read everything I do."

    Not quite. The adversary captures your traffic, but cannot read traffic sent with an encrypted protocol like HTTPS.

  • "A VPN makes my traffic invisible to everyone."

    Not quite. A VPN encrypts your traffic to the VPN operator, so the Wi-Fi or internet provider cannot view it. The VPN provider can.

  • "Jamming is a way to steal data."

    Not quite. Jamming blocks legitimate traffic so users cannot reach resources. It is a denial of service (DoS) attack, not data theft.

Exam traps

  • Everyone losing Wi-Fi at once points to jamming. A look-alike network name points to an evil twin. Someone mapping your signal from the parking lot is war driving.

By the numbers

Say each list out loud, then tap to check.

2 skill levels, 6 motivations Say them, then tap
  • low-skilled
  • high-skilled
  • greed
  • recognition
  • a cause
  • revenge
  • politics
  • beliefs
3 wireless attacks Say them, then tap
3 Wi-Fi protections Say them, then tap
  • match the network name exactly
  • weigh data sensitivity on unencrypted Wi-Fi
  • consider a VPN

In 30 seconds

  1. Low-skilled adversaries use tools made by others against known vulnerabilities. High-skilled adversaries build or adapt tools and find zero days.
  2. Motivations: greed, recognition, a cause, revenge, politics or beliefs.
  3. Evil twin: a fake access point with a matching SSID captures traffic (but not HTTPS content). Jamming: a strong EM signal blocks the network, a DoS attack. War driving: mapping beacons and signal leaks around a target.
  4. Protect yourself: match network names exactly, weigh data sensitivity on unencrypted Wi-Fi (DNS queries can be exposed), and consider a VPN, remembering the VPN provider can see your traffic.

Cover this list, say the points out loud, then take the checkpoint without scrolling back up.

Checkpoint · 6 questions

Checkpoint: Best Practices for Public Networks

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 An adversary buys a ready-made tool online and uses it against a well-known, unpatched vulnerability. How would you classify them? 1.3.A.1
    Show answer

    Answer: B. Low-skilled adversaries use malicious tools created by others, often purchased online, that exploit known vulnerabilities.

  2. 2 What is a zero day? 1.3.A.1
    Show answer

    Answer: B. Zero days are undocumented vulnerabilities. Discovering them is a capability of high-skilled adversaries.

  3. 3 A student joins a fake "Airport Free WiFi" network run by an adversary and then logs in to a site using HTTPS. What can the adversary do? 1.3.B.1
    Show answer

    Answer: D. In an evil twin attack the adversary captures traffic, but cannot read traffic that uses an encrypted protocol like HTTPS.

  4. 4 An adversary floods a café with a strong signal on the Wi-Fi frequency so nobody can connect. What kind of attack is this? 1.3.B.2
    Show answer

    Answer: B. Jamming floods the area with a strong electromagnetic signal in the network's frequency range, preventing legitimate traffic: a denial of service (DoS) attack.

  5. 5 What does an adversary learn from war driving? 1.3.B.3
    Show answer

    Answer: D. War driving detects beacons while moving around a target, revealing the network type and where the signal leaks outside.

  6. 6 A student uses a VPN on hotel Wi-Fi. Who can still view the student's traffic? 1.3.C.3
    Show answer

    Answer: B. A VPN encrypts all traffic to the VPN operator's system, hiding it from the service provider, but the VPN provider can view it.

Key terms: flip the cards

Read the term, say the definition out loud, then flip to check. Struggling a little to remember is what makes it stick.

  • Zero daytap to flip

    An undocumented vulnerability that defenders do not know about yet, discovered and used by high-skilled adversaries.

    Example and CED codes
  • Evil twintap to flip

    An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake.

    Example and CED codes
  • Jammingtap to flip

    Broadcasting radio noise so wireless devices cannot communicate: an attack on availability.

    Example and CED codes
  • War drivingtap to flip

    Detecting a target's wireless network beacons while driving or walking around it, to learn the network type and where the signal leaks outside.

    Example and CED codes
  • Virtual private network (VPN)tap to flip

    A service that encrypts all your traffic to the VPN operator's system, hiding it from the local network and service provider but not from the VPN provider.

    Example and CED codes
  • Denial of service (DoS)tap to flip

    An attack that makes a system or resource unavailable to authorized users.

    Example and CED codes
  • Service set identifier (SSID)tap to flip

    The name of a wireless network, announced in beacon frames.

    Example and CED codes

Questions students ask

What is an evil twin attack?

An adversary sets up their own wireless access point with a service set identifier (SSID) similar or identical to a real network. Users who join it by mistake send their traffic through the adversary, though encrypted traffic like HTTPS stays unreadable.

Is jamming a denial of service attack?

Yes. Jamming floods the area with a strong electromagnetic signal on the network's frequencies, so legitimate traffic between users and the access point cannot get through.

What is a zero day?

An undocumented vulnerability that defenders do not know about yet. Finding zero days is a sign of a high-skilled adversary.

↑ Top

Enlarged view of the selected figure