CWSR flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

WEP IV weakness

WEP uses a 24-bit initialization vector with RC4, so keystreams repeat after roughly 16 million frames and much sooner statistically; FMS and PTW attacks recover the key from captured traffic.

Hidden SSID limitation

Suppressing the SSID in beacons does not hide the network. Probe requests and responses still carry the SSID in cleartext, and any monitor-mode client can discover it.

MAC filtering weakness

MAC addresses appear in cleartext in every 802.11 frame header. An attacker observing traffic can spoof an allowed address, so filtering provides inventory control rather than real access control.

802.11w Protected Management Frames

PMF adds integrity protection to robust management frames such as deauth, disassoc, and action frames using the IGTK. Beacons, probes, and association requests remain unprotected.

Four-way handshake purpose

The 4-Way Handshake confirms both parties hold the PMK and derives fresh PTKs from ANonce, SNonce, and MAC addresses. It also delivers the GTK encrypted to each client.

KRACK attack target

Key Reinstallation Attacks manipulate the 4-Way and Group Key handshakes to force nonce reuse, allowing decryption of frames. Patching supplicants and APs mitigates it.

CCMP replay counter

CCMP uses AES-128 in CCM mode with a 48-bit packet number as the replay counter. Receivers drop frames whose packet number is not greater than the last accepted value.

WPA2 PSK derivation

The PMK equals PBKDF2-HMAC-SHA1 of the passphrase with the SSID as salt, using 4096 iterations and 256 bits of output. This makes captured handshakes open to offline guessing.

SAE Dragonfly handshake

WPA3-Personal uses Simultaneous Authentication of Equals, a password-authenticated key exchange giving forward secrecy. Captured exchanges cannot be attacked offline as cheaply as WPA2 handshakes.

WPA3 transition mode risk

Mixed WPA3/WPA2 transition mode still accepts WPA2 handshakes, so an attacker can force a client onto WPA2 and capture a crackable exchange. Full WPA3-only mode removes this downgrade path.

WPA3-Enterprise 192-bit mode

This mode requires GCMP-256, HMAC-SHA-384 key derivation, and 384-bit elliptic curve certificates. It aligns with CNSA suite requirements for high-assurance networks.

802.1X controlled port

The authenticator keeps the controlled port blocked until EAP authentication succeeds. Only EAPOL traffic passes while unauthorized; after success, normal data frames are forwarded.

EAP-TLS strengths

EAP-TLS performs mutual certificate authentication inside a TLS tunnel. It resists password capture and rogue servers provided the supplicant validates the server certificate chain.

PEAPv0 MSCHAPv2 risk

PEAP protects inner MSCHAPv2 credentials with TLS, but only if the client validates the server certificate. Without validation, an evil-twin RADIUS server can harvest the inner password.

EAP-FAST PAC

EAP-FAST uses a Protected Access Credential for fast reconnection. PAC provisioning must occur inside a trusted tunnel, because unauthenticated provisioning is vulnerable to man-in-the-middle attacks.

Deprecated EAP methods

LEAP is crackable with ASLEAP, and EAP-MD5 provides no server authentication and no usable key material. Both should be disabled in favor of TLS-based methods.

RADIUS Tunnel-Private-Group-ID

Attribute 81 carries the VLAN assignment from the RADIUS server to the authenticator. It is paired with Tunnel-Type 13 and Tunnel-Medium-Type 6 to place the client dynamically.

RADIUS Message-Authenticator

Attribute 80 signs EAP-Message attributes and prevents injection attacks. Its absence enables Blast-RADIUS-style forgery, so it should be required on all EAP exchanges.

RadSec transport

RadSec carries RADIUS over TLS on TCP port 2083, protecting the authenticator-to-server path across untrusted networks. Standard RADIUS uses UDP ports 1812 and 1813.

RADIUS server certificate validation

Clients must verify the RADIUS server certificate chain, check that the subject or SAN matches the configured name, and confirm the serverAuth extended key usage.

WIPS containment authorization

Wireless intrusion prevention can deauthenticate or block suspected rogues. Because containment disrupts RF and may breach regulations, written authorization and scoped rules are required first.

Rogue AP wired correlation

Comparing a suspected rogue's BSSID to switch MAC address tables confirms whether it sits on the corporate wire. On-network rogues warrant immediate port shutdown.

Monitor radio dwell time

A single scanning radio observing N channels spends roughly one Nth of its time per channel. Full coverage therefore needs dedicated sensors or multiple monitoring radios.

PMKID capture attack

Some APs expose the PMKID in the first handshake message, letting an attacker capture it without a full handshake and attempt offline passphrase guessing against WPA2-PSK networks.

Guest client isolation

AP isolation blocks station-to-station traffic on the same SSID. Combined with a separate VLAN, it prevents guests from attacking each other or reaching corporate subnets.

Captive portal assurance levels

Click-through portals give minimal assurance, self-registration with email or SMS verification adds identity evidence, and sponsored access provides the strongest accountability for guests.

BYOD certificate enrollment

SCEP or EST can issue per-device client certificates during onboarding, enabling EAP-TLS. This avoids shared PSKs and lets access be revoked per device.

NAC posture check

Before granting the corporate VLAN, posture checks verify OS patch level, antivirus presence, and disk encryption. Noncompliant devices are placed in a remediation VLAN with limited access.

WPS PIN weakness

The WPS PIN is validated in two halves, reducing the search space to about 11,000 guesses. Pixie Dust and brute-force attacks recover the PIN, so WPS should be disabled.

PCI DSS wireless scope

Wireless networks in or connected to the cardholder data environment require strong encryption, unique keys, rogue AP detection, and quarterly ASV scans after significant changes.

NIST SP 800-153

This guideline covers WLAN security configuration standards, monitoring, and lifecycle management. It complements SP 800-97, which addresses 802.11i enterprise deployment architecture.

WPA2-PSK passphrase length

Because PBKDF2 makes offline guessing cheap, WPA2-PSK passphrases should be at least 20 characters of high entropy. Shorter passphrases fall quickly to GPU-based cracking.