Guest Wi-Fi Credential Spraying After Hours
A retail chain runs an Aruba Mobility Conductor with two Mobility Controllers managing 180 APs across 12 stores. Guest SSID uses captive portal with a shared daily code printed at each register. The SOC notices, between 01:00 and 04:00 local time, roughly 40 failed captive-portal authentications per minute from 60 distinct MAC addresses, all associating to APs in one store's parking-lot coverage. No guest passes were issued at that hour. Legitimate guest sessions in that store average 25 per day. The store's POS network is on a separate VLAN terminated at the branch firewall, and the guest VLAN is terminated at the controller with a NAT pool. The branch manager reports no customer complaints, and the APs show normal channel utilization and no rogue AP detections.
1. Classify the activity and decide whether it constitutes a security incident requiring escalation, explaining the evidence for and against.
Read the worked answer
This is best classified as credential/portal abuse reconnaissance rather than a confirmed breach, but it warrants escalation.
Evidence supporting an incident:
- Volume (40/min) far exceeds the store's daily baseline of ~25 guest sessions.
- Timing (01:00–04:00) is outside normal customer traffic.
- 60 distinct MACs suggest either a coordinated device pool or MAC randomization, consistent with automated spraying.
- Concentration in parking-lot coverage suggests an attacker positioned outside the building.
Evidence against a serious incident:
- All attempts failed; no successful portal authentication is reported.
- Guest VLAN is segmented from POS and NATed at the controller, so lateral reach is limited by design.
- No rogue APs and normal RF utilization argue against an on-site intrusion kit.
The judgement call: failed attempts alone are low severity, but the pattern indicates an actor testing the shared-code model. Escalate to incident response at low priority, preserve controller logs (client MAC, AP, timestamp, portal result), and treat the shared daily code as a design weakness to be remediated rather than a one-off event.
2. The CISO asks whether to block the 60 MAC addresses at the controller. Give your recommendation with reasoning.
Read the worked answer
Do not rely on MAC blocking as the primary control.
Reasoning:
- MAC randomization is standard on modern client OSes; an attacker spraying credentials can rotate MACs trivially, so a 60-entry deny list buys little and creates maintenance debt.
- Deny lists at the controller can cause collateral impact if a legitimate device later reuses an address (unlikely but possible with vendor OUIs).
- The real exposure is the shared daily code model, which is guessable and unbound to identity.
Better response, in priority order:
- Rate-limit captive-portal authentication attempts per client and per AP (e.g., a small number per minute) - this directly blunts spraying regardless of MAC.
- Replace the shared code with per-visit sponsor-issued credentials or SMS/email registration so attempts are attributable.
- If immediate containment is needed, apply a temporary deny for the specific OUIs observed, time-boxed and documented, while monitoring for displacement to other stores.
- Keep logging every failed attempt with client MAC and AP so the pattern can be correlated across stores.
Recommendation: decline permanent MAC blocking; approve rate limiting plus portal redesign, with a short-lived deny as an optional stopgap.