Week 15: Wi-Fi — How It Works and How Hackers Break It

If you're reading this at a café, airport, or your home — you're on Wi-Fi right now. It feels invisible and magical. But under the hood, Wi-Fi is just radio signals flying through the air, and anything flying through the air can be intercepted, jammed, or faked.

This week we're breaking down exactly how Wi-Fi works, what attackers do to exploit it, and how you can protect yourself — all without needing a computer science degree.

Let's get into it.

1. First — How Does Wi-Fi Actually Work?

Your router is basically a mini radio station. It broadcasts a signal on a specific frequency, your phone or laptop tunes into that frequency, and data travels back and forth as radio waves.

Two main frequencies exist:

• 2.4 GHz — travels farther, goes through walls better, but slower and more congested (your microwave, Bluetooth, and neighbours' routers all compete here)
• 5 GHz — faster, less congested, but shorter range

Your router has a name — called an SSID (Service Set Identifier) — that's just the Wi-Fi name you see when you search for networks. Every router also has a unique hardware address called a BSSID (its MAC address).

When you connect, your device and the router go through a small conversation — a handshake — to verify each other and set up an encrypted channel. That handshake is one of the most important things in Wi-Fi security, and also one of the most targeted.

2.Wi-Fi Security Standards — A Quick History

Not all Wi-Fi is equally protected:

Most home and office networks still run WPA2. It's good — but as you'll see below, it's not bulletproof.

3.Wi-Fi Attacks — How Hackers Actually Do It

i). Evil Twin Attack (The Most Dangerous One)

Imagine walking into a Starbucks and seeing two Wi-Fi networks: "Starbucks_Wi-Fi" and "Starbucks_Wi-Fi" — identical names. You connect to one. But one of them is a fake access point set up by an attacker on a laptop nearby.

This is the Evil Twin attack.

The attacker creates a rogue hotspot mimicking a legitimate network. Your device connects automatically (because it looks familiar), and now all your traffic flows through the attacker's machine before reaching the internet. They can see everything — login pages, cookies, browsing history.

Why it works: Devices automatically reconnect to known network names. The attacker just needs a stronger signal than the real router.

ii). PMKID / Handshake Capture Attack

Remember the handshake we mentioned? When your device connects to a WPA2 router, they exchange a cryptographic handshake to authenticate. Attackers can capture this handshake passively just by listening to nearby WiFi traffic with the right tools.

Once captured, the handshake is taken offline and fed into a password cracking tool (like Hashcat) alongside a wordlist of common passwords. If your WiFi password is password123 or John1990, it gets cracked in seconds.

Why it works: The handshake is broadcast over the air and WPA2 is only as strong as your password. Weak passwords = instant crack.

Fix:_ Use a long, random WiFi password (20+ characters). Seriously — nobody needs to memorise it, it's just saved on devices._

iii). Deauthentication (Deauth) Attack

Wi-Fi has a management frame called a deauthentication frame — it's meant to politely disconnect devices from a network. The problem? In WPA2, these frames are not authenticated. Anyone can send a fake deauth frame pretending to be your router.

An attacker sends a flood of these fake deauth frames → your device gets kicked off the network repeatedly → you can't stay connected.

This is used in two ways:

• As a pure denial of service — just knocking devices offline
• As a setup for Evil Twin — kick you off the real network, force you onto the fake one

WPA3 fixes this with Protected Management Frames (PMF), which is one of the biggest reasons to upgrade.

iv). WPS PIN Attack

WPS (Wi-Fi Protected Setup) was designed to make connecting devices easier — you press a button or enter an 8-digit PIN instead of typing a long password. Sounds convenient. It's a disaster.

The 8-digit PIN is validated in two halves (4 digits + 4 digits) separately, which reduces the combinations from 100,000,000 to just 11,000 guesses. Tools like Reaver can brute-force this in hours.

Fix: Disable WPS entirely in your router settings. Nobody needs it.

v). Rogue DHCP / DNS Spoofing on Open Networks

When you connect to an open Wi-Fi (no password — airports, hotels, cafés), your device asks the network: "What IP should I use? What DNS server should I talk to?" This is handled by DHCP.

An attacker on the same open network can run a rogue DHCP server that responds faster than the real one, giving your device a fake DNS server address. Now when you type gmail.com, the attacker's DNS resolves it to a fake phishing page instead. You never notice — the URL looks fine.

Fix: Use a trusted VPN on all open/public Wi-Fi. Always.

vi). Krack Attack (Key Reinstallation Attack)

Discovered in 2017, KRACK is a vulnerability in the WPA2 handshake process itself. By manipulating and replaying handshake messages, an attacker can trick a device into reinstalling an already-used encryption key — effectively resetting it to a known state and breaking the encryption.

This allows decryption of packets in real time — not just passive capture for offline cracking.

Good news: It was widely patched in 2017–2018. If your devices are updated, you're safe. If you're running ancient unpatched firmware on routers or IoT devices — you're not.

4.How to Actually Protect Yourself

Here's the no-nonsense list:

• Use WPA3 if your router supports it — it fixes deauth attacks and improves handshake security
• Strong, random WiFi password — 20+ characters, not a word, not a date
• Disable WPS — go into router settings right now and turn it off
• Never trust open WiFi without a VPN — treat all public WiFi as hostile
• Keep router firmware updated — manufacturers patch vulnerabilities; apply updates
• Use HTTPS everywhere — even if someone intercepts your traffic, encrypted HTTPS makes it useless to read
• Forget networks you don't use — stops auto-reconnect to Evil Twin networks

Quick Recap:

Final Thought:

Wi-Fi feels safe because it's invisible. But invisible doesn't mean secure — it just means you can't see the attack happening. The good news is that all of the attacks above have straightforward defences, and most of them cost you nothing to implement.

Next time you're at a café and you see two networks with the same name — you'll know exactly what's going on.

Week 15 of my security series. If you missed Week 14, check it out . Next week: VPNs — how they actually work, when they protect you, and when they don't.

If you found this article helpful and would like to support my cybersecurity learning journey, you can do so here:

https://buymeacoffee.com/nis.sec

You can connect with me on social media platforms.

Linkedin: https://www.linkedin.com/in/nishant-kumar-3a07952b6/

Twitter:https://x.com/BugBugproofmind