[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 1 · 1.3.b
AP Cybersecurity · Introduction to Security
Types of Wireless Cyberattacks
Listen, block, or survey — the goal separates three attacks that all travel over the air.
key ideaAsk what the adversary wants: to listen, to block, or to survey.
The categories
Wireless attacks are easy to confuse because all three happen over the air and none require touching a cable. They separate cleanly once you ask about the goal: intercept traffic, deny access, or gather information for later.
War driving is usually reconnaissance — it precedes the others rather than causing harm directly. Jamming is the only one of the three that is a denial of service.| Attack | What the adversary does | Goal | What the victim notices |
|---|
| evil twin | stands up a rogue WAP with a similar or identical SSID | intercept traffic | nothing — the connection appears normal |
| jamming | floods the band with a strong EM signal | denial of service | the network stops working |
| war driving | drives or walks around detecting beacons | map networks and coverage | nothing — passive listening |
Only jamming is disruptive by design. The other two are silent by design, which is exactly what makes them hard to notice and easy to underestimate.
| Question to ask | Evil twin | Jamming | War driving |
|---|
| Is the network unusable? | no | yes | no |
| Is traffic being captured? | yes | no | no |
| Does it require a rogue access point? | yes | no | no |
| Is it usually preparation for something else? | sometimes | no | yes |
| Does HTTPS blunt it? | yes — encrypted traffic stays unreadable | no | not relevant |
The last row matters: an evil twin captures your traffic, but cannot read anything sent over an encrypted protocol. It still sees which sites you visit, and unencrypted queries such as DNS.
Telling them apart
the deciding question
- Network unusable → jamming. It is a denial-of-service attack.
- Network works but is not yours → evil twin. Check the exact SSID and who operates it.
- No effect at all, adversary outside the building → war driving.
- Evil twin captures traffic but HTTPS content stays encrypted — metadata still leaks.
Worked examples
EX 1
Identify the attack
Conference guests connect to Conference-WiFi and browse normally. Later, credentials entered on an unencrypted internal site turn up in an attacker's possession. Which attack?
1
Check whether service was denied
No — browsing worked, so not jamming.
2
Check whether traffic was captured
Yes — credentials appeared elsewhere.
3
Ask how capture was possible
The victims' traffic passed through equipment the adversary controls.
4
Name it
An evil twin — a rogue WAP broadcasting an SSID matching the real one.
5
Note what limited the damage
Only the unencrypted site leaked. Traffic to HTTPS sites stayed unreadable.
EX 2
The network that stopped
For twenty minutes no device in the warehouse can reach the wireless network. Wired connections are unaffected. Nothing was stolen. Which attack?
1
Note what failed
Only the wireless medium — wired links kept working.
2
Note what did not happen
No data loss, so this is not interception.
3
Name the effect
Users could not reach resources — a denial of service.
4
Name the attack
Jamming: a strong EM signal in the same frequency range drowns legitimate traffic.
5
Note the response
Locating a jammer needs physical direction-finding; software controls cannot stop radio interference.
EX 3
Nothing happened — yet
Security footage shows a car circling the building slowly with a laptop and an external antenna. No alerts fire. What is happening, and does it matter?
1
Identify the activity
War driving — detecting wireless beacons while moving.
2
Say what it collects
Which networks exist, the type of wireless security in use, and where the signal reaches.
3
Explain why nothing alerted
Listening for beacons is entirely passive — there is no traffic to detect.
4
Say why it matters
It is reconnaissance: the map produced feeds a later evil twin or targeted attack.
5
Give the mitigation
Reduce signal spill outside the building, use strong wireless encryption, and avoid SSIDs that advertise the organization.
Watch out
An evil twin does not break encryption
It captures the traffic, but HTTPS content stays unreadable. What still leaks is metadata — which sites, how often, and any unencrypted protocol such as DNS.
Jamming is the denial-of-service one
If the question describes users unable to reach resources, it is jamming. Interception attacks are careful to keep the network working.
War driving causes no damage by itself
It is reconnaissance. Dismissing it misses that the resulting map is what makes the next attack precise.
Matching the SSID is the whole trick
Devices identify networks by name. An identical or near-identical SSID is enough for a phone to connect automatically, with no user decision at all.