Wi Fi Threat Modeling and Monitoring

In this talk at the DEF CON 27 Packet Hacking Village, Besim Altinok presents practical strategies for wireless threat modeling, continuous RF monitoring, and detecting rogue access points across enterprise wireless infrastructures. He begins at 07:00 by discussing the inherent limitations and high false-positive rates of commercial Wireless Intrusion Detection Systems (WIDS), which often flood analysts with benign alerts when encountering transient neighboring signals.

Besim advocates for an attacker-centric defense mindset at 14:00, breaking down how malicious rogue access points and evil twin attacks manipulate 802.11 management frames to lure client devices. At 21:00, he demonstrates writing custom Wireshark capture filters designed to isolate anomalous beacon frames, probe responses, and deauthentication packets in real time. At 28:00, he explains passive fingerprinting techniques to detect popular attack platforms like the WiFi Pineapple based on default MAC address ranges and frame formatting.

To proactively detect wireless rogue devices, Besim introduces an open-source tool called "P-Trap" at 35:00, which emits synthetic probe requests for non-existent SSIDs to catch predatory KARMA-style rogue access points that automatically answer every broadcast request. He concludes at 42:00 by illustrating methods to monitor client probes and defend against attacks aimed at discovering hidden network SSIDs. (AI summary — Gemini Flash)