Wi-Fi attacks explained (WEP/WPA/WPA2): how to secure your wireless network

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

Why Wi-Fi security matters

Wireless networks broadcast your data through the air. Without proper protection, anyone nearby with an antenna can listen in or attempt to join your network. The encryption protocol your router uses — WEP, WPA, WPA2, or WPA3 — determines how hard that is. Understanding each generation helps you make sure your network is on the right one.

The Wi-Fi encryption generations

WEP — broken and abandoned

Wired Equivalent Privacy (WEP) was the first Wi-Fi security protocol, specified in the 802.11b standard. It uses static encryption keys that never change, and cryptanalytic flaws in the protocol let an attacker recover the key simply by observing enough network traffic. WEP should never be used for anything — treat any device still using it as compromised.

WPA — an interim fix

WPA was introduced as a stopgap while the full 802.11i standard was finalized. It added per-packet keys via TKIP, a major improvement over WEP, but it too has known weaknesses. WPA/TKIP is obsolete and should be disabled.

WPA2 — the long-standing baseline

WPA2 implements the full IEEE 802.11i standard using AES-based CCMP encryption. It has been mandatory on new certified devices since 2006 and remains widely deployed. WPA2 with a strong passphrase is still reasonable, but weak pre-shared keys are vulnerable to offline dictionary attacks, and WPA2 alone does not protect management frames from disruption attacks (see below).

WPA3 — the current best practice

WPA3 replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks, and it mandates protected management frames. If your hardware supports it, WPA3 (or WPA3 transition mode) is what you should be using.

How attackers approach wireless networks, conceptually

Attackers passively capture wireless traffic and look for weak protocols (WEP, WPA/TKIP), weak passphrases susceptible to offline guessing, or client devices willing to connect to a lookalike "evil twin" access point. They may also inject management frames — such as deauthentication packets — to disrupt legitimate connections, which can cause denial of service or pressure clients to reconnect to an attacker's access point.

Signs of wireless attacks in your logs

• A surge of deauthentication or disassociation frames in access point logs or a wireless IDS (WIDS).
• An access point advertising your SSID that isn't yours (rogue or evil-twin AP).
• Clients repeatedly dropping and reconnecting, especially clustered in time.
• Unrecognized MAC addresses appearing in association logs.

How to secure your wireless network

• Use WPA3 where possible, otherwise WPA2 with AES (never WEP or WPA/TKIP).
• Use a long, unique passphrase (20+ characters) that can't be guessed; never reuse the ISP-default key.
• Disable WPS on the router — PIN-based WPS has long-standing brute-force weaknesses.
• Enable protected management frames (802.11w) if your equipment supports it, to resist deauthentication-based disruption.
• Segment your network: use a separate guest SSID with client isolation for visitors and IoT devices.
• Keep firmware updated on routers and access points to patch known protocol flaws.
• Monitor your airspace with wireless intrusion detection or at least periodic scans for rogue access points using your SSID.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Attempting to intercept or access someone else's Wi-Fi traffic without permission is illegal in most jurisdictions.