Lesson 10 — Intermediate

Wireless Security (Wi-Fi)

Wi-Fi mein koi taar nahi — isliye signal bhi sab sun sakte hain. Is lesson mein hum Wi-Fi ke security standards ka evolution (WEP se WPA3 tak), common wireless attacks aur router hardening ka checklist samjhenge — ghar aur office dono ke liye.

⏱ 13 min• Intermediate• Authentication

Wireless security kya hai

WHAT

Wireless security = Wi-Fi jaise bina taar wale network ko unauthorized access aur eavesdropping se bachana. Iska core tool Wi-Fi encryption standard hai — aaj sabse behtar WPA3.

WHEN

Ghar, office, cafe, airport, hostel — har Wi-Fi pe applicable. Router setup ke waqt configure hota hai, phir hamesha chalta hai.

WHERE

Wi-Fi router, access points, aur connected devices (laptop, phone) — wireless ka poora chain isi par depend karta hai.

Wireless ka fundamental risk: signal public jaata hai. Ghar ke bahar bhi koi packet receive kar sakta hai — isliye encryption hi asli darwaza hai, naam (SSID) nahi.

Wi-Fi security standards ka evolution

WEP  (1997) : pehla standard — flaw itna ki MINUTES mein tod jaata hai
                 USE BAND (exam mein yahi answer hai)
WPA  (2003) : temporary fix (TKIP) — ab legacy
WPA2 (2004) : CCMP/AES encryption — lamba chala, aaj bhi widely used
WPA3 (2018) : SAE handshake — offline dictionary attack se bachta hai
               -> Aaj recommended WPA3 (WPA2 bhi acceptable, WEP kabhi nahi)

Modes:
  Personal (PSK)     : ghar ke liye — ek shared password (pre-shared key)
  Enterprise (802.1X): office — har user ka apna login (RADIUS server)

Exam line : WEP -> WPA -> WPA2 -> WPA3 (order rat lo)

Yaad rakho: WPA2 vs WPA3 ka farak: WPA3 mein offline brute-force ruk jaata hai (SAE). WEP sabse weak hai — aaj bhi kahin mil jaaye toh wahi network chhod dena.

Wireless attacks aur unka defense

Attacks (concept — samajhne ke liye):
  Evil twin  : nakli hotspot (same naam) — victim wahan connect,
               traffic attacker ke paas
  Deauth     : disconnect flood -> reconnection mein weakness
  KRACK      : WPA2 handshake ka flaw (patch se handle hota hai)
  Wardriving : ghoom ke open/weak Wi-Fi dhhoondna
  WPS PIN    : WPS ka weak PIN brute-force (isi liye WPS band)

Defense:
  WPA3 (ya WPA2) + strong passphrase (14+ chars, random words)
  Router ka DEFAULT admin password badlo
  WPS disable, remote administration band
  Firmware update rakho (router bhi patch hota hai)
  Guest network alag — visitors ko main network na do

Evil twin se bachne ka simple nuskha: public Wi-Fi pe sensitive kaam mat karo — bank/UPI login mobile data pe karo. Cafe ka "Free_WiFi" naam asli hai ya nahi, verify karna mushkil hai.

Router hardening checklist

Encryption: WPA3/WPA2-AES select karo — WEP/WPA kabhi nahi.
Strong passphrase: 14+ character, guessable naam-dob se door.
Admin password: router ka default admin password zaroor badlo.
WPS off: convenient lagta hai par attack surface hai.
Firmware: saal mein 1-2 baar update check karo.
SSID/visibility: naam chhupana madad karta hai par security NAHI banata.
Guest network: visitors, smart TV, IoT alag rakho.

Myth bust: Hidden SSID = security? Nahi. Naam broadcast band karne se packet capture wali ko signal mil hi jaata hai. Asli protection sirf encryption (WPA3) + strong password hai.

Exercise

Question: Aaj recommended Wi-Fi standard kaunsa hai — WEP ya WPA3? (wep/wpa3)

Question: Wi-Fi ka shared password technically kya kehlata hai? (ssid/psk)

Question: Router ka default admin password badalna chahiye ya nahi? (badlo/chalne do)

Common mistakes

Hidden SSID ko security samajhna: Naam chhupane se koi protected nahi hota — encryption (WPA2/WPA3) hi asli protection hai.
WPS convenient hai isliye on rakha: WPS ka PIN brute-force ho sakta hai. Convenience ke liye attack surface mat do — WPS band karo.
Free Wi-Fi pe banking kar lena: Public Wi-Fi = MITM/evil twin zone. Sensitive login hamesha trusted network (mobile data/VPN) pe karo.

Desi example: Cafe mein free Wi-Fi

Cafe mein "Free_WiFi_Guest" mila, connect kiya, aur browser pe ek login page aaya jaisa asli tha. Evil twin ka classic pattern — verify kiye bina connect karna hi attack ka first step hai:

Attack : nakli hotspot + fake login page
Victim : bina check kiye password bhar diya
Defense: cafe se official password le (board/wifi password),
         login mobile data pe, WPA3 apne ghar pe
Golden : public Wi-Fi = browsing only, no banking

Exam mapping (TCS / CEH / Practical)

TCS NQT: "Which Wi-Fi standard is insecure?" — WEP.
CEH/Security+: WPA2 vs WPA3 difference.
Practical: router settings check karne ko poochha jaata hai.
Trap: "Hiding SSID makes Wi-Fi secure" — galat, encryption hi security hai.

Lesson complete?

Module 2 complete! Ab Module 3 — Practice & Governance. Agla lesson — Social Engineering — jahan attack insaan pe hota hai, machine pe nahi.