Wireless, cellular and satellite networks

Wireless networks remove the cable and, with it, the most basic physical control: anyone within radio range can receive the signal and try to join. Wi-Fi is now the default way most users connect at work, phones depend on cellular networks, billions of IoT devices use short-range radios, and low Earth orbit satellite services have made satellite broadband an everyday option for remote sites. This lesson covers the security of each: Wi-Fi standards and encryption, enterprise authentication, wireless attacks and controls, Bluetooth and other personal area networks, cellular networks through 5G, and satellite links.

Wi-Fi standards

Wi-Fi is the trade name for wireless LAN products certified by the Wi-Fi Alliance against the IEEE 802.11 family of standards. Successive generations have increased speed and efficiency. The Wi-Fi Alliance now uses generation numbers: Wi-Fi 4 is 802.11n, Wi-Fi 5 is 802.11ac, Wi-Fi 6 is 802.11ax, Wi-Fi 6E extends 802.11ax into the 6 GHz band, and Wi-Fi 7 is 802.11be, certified from January 2024. Wi-Fi 6E and Wi-Fi 7 devices operating in 6 GHz must use WPA3, which has helped move the industry away from older security modes. Wireless networks use the 2.4 GHz band, which travels further and penetrates walls better but is crowded, the 5 GHz band, and the 6 GHz band, which offers wide clean channels but shorter range.

Networks are identified by a service set identifier, SSID, broadcast in beacon frames. Hiding the SSID provides no real security, because the name appears in other frames that any sniffer can capture, and it can make clients probe for the network wherever they go. MAC address filtering is similarly weak, because MAC addresses are visible in the air and trivially spoofed. Neither is a substitute for strong authentication and encryption.

Wi-Fi security protocols

Wired Equivalent Privacy, WEP, the original 802.11 security, used the RC4 cipher with short initialization vectors and a flawed design; it can be cracked in minutes and must never be used. Wi-Fi Protected Access, WPA, was an interim fix using TKIP, now deprecated. WPA2, mandatory for certified devices from 2006, uses AES in CCMP mode and remains very common. Its personal mode, WPA2-PSK, derives keys from a shared passphrase; an attacker who captures the four-way handshake, or a single PMKID frame from some access points, can try to guess the passphrase offline, so short or common passphrases fall quickly. The 2017 KRACK research showed key reinstallation flaws in the handshake that vendors patched, a reminder that client devices need updates too.

WPA3, introduced in 2018, replaces the pre-shared key exchange with Simultaneous Authentication of Equals, SAE, a password-authenticated key exchange based on the Dragonfly handshake. SAE resists offline dictionary attacks, because each guess requires an online interaction with the network, and provides forward secrecy, so capturing traffic today and learning the password later does not decrypt it. WPA3-Enterprise offers an optional 192-bit security mode aligned with high-assurance government suites. WPA3 requires protected management frames, which stop attackers forging the deauthentication frames once used to kick users off networks. Early implementations had flaws, published as Dragonblood in 2019, which led to fixes; transition modes that allow both WPA2 and WPA3 clients on one network can let attackers force a downgrade, so they should be retired once clients support WPA3. Wi-Fi Enhanced Open, based on opportunistic wireless encryption, encrypts traffic on open networks such as cafes without a password, protecting against passive eavesdropping, though it does not authenticate the network.

Enterprise Wi-Fi with 802.1X

Organizations should not protect corporate Wi-Fi with a shared passphrase: everyone knows it, it rarely changes, departing staff keep it and a single leak exposes the whole network. Enterprise mode uses 802.1X with the Extensible Authentication Protocol, EAP, and a RADIUS server, giving each user or device its own credentials and session keys. Common EAP methods differ greatly in strength. EAP-TLS uses certificates on both the client and the server, giving mutual authentication without passwords; it is the strongest common method and resists phishing, but needs a public key infrastructure and device management to issue certificates. PEAP and EAP-TTLS build a TLS tunnel authenticated by the server's certificate and then send a password-based inner method, such as MSCHAPv2, inside it. They are easier to deploy but depend on clients properly validating the server certificate; if clients accept any certificate, an attacker running an evil twin access point can capture credentials. EAP-FAST, from Cisco, uses protected access credentials. LEAP, an old Cisco method, is broken and must not be used.

Whatever EAP method is used, configure clients to validate the server certificate and the expected server name, ideally pushed by device management so users cannot click through warnings. RADIUS can also return attributes that place each user or device into the right VLAN or apply access policies, which links wireless access to segmentation. Guest access should use a separate SSID and network that reaches only the internet, with client isolation so that guests cannot attack each other, a captive portal for terms of use, rate limits and short session times.

Wireless attacks and controls

Rogue access points are unauthorized access points connected to the wired network, often installed by employees for convenience; they create an unmanaged entry point. Evil twins are attacker-controlled access points broadcasting a trusted SSID to lure clients and capture traffic or credentials. Deauthentication attacks forge management frames to disconnect clients, either to disrupt service or to capture handshakes as clients reconnect; protected management frames counter them. Jamming floods radio channels with noise and cannot be prevented by cryptography; it can only be detected, located and dealt with physically or through regulators, and deliberate jamming is illegal in Canada and the United States. War driving is searching for wireless networks from a moving vehicle. Wi-Fi Protected Setup, WPS, a push-button or PIN pairing feature, has a PIN design flaw that allows brute force and should be disabled.

Controls include a wireless intrusion prevention system, WIPS, that monitors the airspace with sensors, detects rogue and evil twin access points and unusual frames and can contain them; regular wireless surveys; 802.1X with certificate validation; WPA3 with protected management frames; disabling WPS; careful antenna placement and power settings so that coverage does not extend far beyond the building; and physical security for access points. Site surveys, using predictive modeling during design and measurement after installation, ensure good coverage and reveal where signals leak outdoors.

Bluetooth, NFC and IoT radios

Bluetooth connects personal devices over short distances in the 2.4 GHz band. Classic Bluetooth and Bluetooth Low Energy have different pairing methods; modern secure connections use elliptic curve Diffie-Hellman key exchange, but legacy pairing and the "just works" method offer weaker protection against on-path attacks. Historical attacks include bluejacking, sending unsolicited messages; bluesnarfing, stealing data; and bluebugging, taking control of a device. More recent research, such as BlueBorne in 2017 and the KNOB attack in 2019, found implementation and protocol flaws that allowed remote compromise or forced weak keys. Controls: keep devices updated, turn Bluetooth off or make devices non-discoverable when not needed, prefer secure pairing methods and restrict Bluetooth on sensitive systems by policy.

Near-field communication, NFC, works at a few centimeters and underpins contactless payments, transit cards and access badges. Its short range limits but does not eliminate risks such as relay attacks, where attackers extend the range of a card to make a payment or open a door. Radio frequency identification, RFID, tags in badges and inventory can sometimes be read or cloned from a distance with specialized equipment; older 125 kHz proximity badges are especially easy to clone, so organizations should move to modern encrypted smart card credentials. IoT devices use protocols such as Zigbee, Z-Wave, Thread, LoRaWAN and Bluetooth Low Energy, many with optional or weakly implemented security. The newer Matter standard, which runs over Thread and Wi-Fi, aims to improve interoperability and security for smart home devices. Lesson 8 returns to IoT.

Cellular networks

Cellular networks connect phones, tablets, laptops and an increasing number of IoT devices. Second-generation GSM authenticated only the phone, not the network, and used encryption that has been broken, which made fake base stations, known as IMSI catchers or cell-site simulators, effective at intercepting calls and tracking subscribers. Third- and fourth-generation networks, UMTS and LTE, added mutual authentication and stronger encryption, but devices can still be forced down to 2G where it remains available, and signaling protocols between carriers, SS7 for older networks and Diameter for 4G, have been abused to locate subscribers and intercept text messages. This is one reason security agencies advise against using SMS for multifactor authentication where better options exist.

Fifth-generation, 5G, networks add further protections. The subscription permanent identifier is concealed using public key encryption, so IMSI catchers can no longer capture it in clear text; the core network uses a service-based architecture with stronger authentication between functions; and network slicing lets operators create logically separate networks with different properties for different customers. Private 5G networks, built by enterprises on licensed, shared or, in some countries, dedicated spectrum, are being used in factories, ports and mines. New risks come with new architecture: a much larger software attack surface, dependence on cloud-native functions, and supply chain concerns that have led both Canada and the United States to restrict certain vendors from their 5G networks.

In the United States, the Secure and Trusted Communications Networks Act of 2019 led the Federal Communications Commission to designate certain suppliers, including Huawei and ZTE, as national security threats and to fund the removal of their equipment from US networks. The FCC also regulates radio spectrum and, in recent years, has proposed and adopted rules on cybersecurity labeling for consumer IoT devices through the US Cyber Trust Mark program.

Satellite networks

Satellite links serve remote sites, ships, aircraft and backup connectivity. Geostationary satellites orbit at about 35,786 km, so a signal must travel up and down twice for a round trip, giving roughly 500 to 700 ms of latency, which hurts interactive applications and TCP throughput. Low Earth orbit constellations, such as those operated by SpaceX and others, orbit at roughly 500 to 1,200 km and deliver round-trip times of a few tens of milliseconds, comparable to terrestrial broadband. Security concerns include interception of unencrypted downlinks, which researchers have repeatedly demonstrated on older services; jamming and spoofing; dependence on ground stations and the operator's network; and attacks on user terminals, highlighted when a cyberattack disabled tens of thousands of satellite modems in Europe at the start of the 2022 invasion of Ukraine. Treat satellite links as untrusted transport: encrypt traffic end to end with a VPN, manage terminals like any other network device and plan for jamming in contested areas.

# Round-trip propagation delay for satellite links (signal travels at about 300,000 km/s)
c = 300_000  # km/s
for name, alt_km in [('Geostationary', 35_786), ('Medium Earth orbit', 8_000), ('Low Earth orbit', 550)]:
    # user -> satellite -> ground station, and back again: four passes of the altitude (best case overhead)
    rtt_ms = 4 * alt_km / c * 1000
    print(f"{name:20s} altitude {alt_km:>6,} km  minimum round trip {rtt_ms:6.1f} ms")

Geostationary        altitude 35,786 km  minimum round trip  477.1 ms
Medium Earth orbit   altitude  8,000 km  minimum round trip  106.7 ms
Low Earth orbit      altitude    550 km  minimum round trip    7.3 ms

Thinking like a manager

When a question offers SSID hiding or MAC filtering as the answer to a wireless risk, it is almost certainly a distractor. When it describes credentials stolen by a fake access point, the fix is mutual authentication with certificate validation, ideally EAP-TLS. When it asks how to protect a small office with a shared password, WPA3-Personal with a long random passphrase is the right answer; for an enterprise, it is 802.1X. When it involves cellular or satellite links, treat them as untrusted transport and protect data with encryption at higher layers, and remember supply chain and regulatory considerations for national infrastructure.