GPEN · Question #132
You work as a Network Administrator in the Secure Inc. Your company is facing various network attacks due to the insecure wireless network. You are assigned a task to secure your wireless network. For
The correct answer is A. You have forgotten to turn off DHCP. C. The SSID is still sent inside both client and AP packets. D. You are using the default SSID.. Disabling SSID broadcast is a weak control because the SSID is still transmitted in 802.11 management frames, DHCP still hands out addresses, and a default SSID is trivially guessable - all allowing unauthorized access.
Question
You work as a Network Administrator in the Secure Inc. Your company is facing various network attacks due to the insecure wireless network. You are assigned a task to secure your wireless network. For this, you have turned off broadcasting of the SSID. However, the unauthorized users are still able to connect to the wireless network. Which of the following statements can be the reason for this issue? Each correct answer represents a complete solution. Choose all that apply.
Options
- AYou have forgotten to turn off DHCP.
- BYou are using WPA2 security scheme.
- CThe SSID is still sent inside both client and AP packets.
- DYou are using the default SSID.
How the community answered
(50 responses)- A82% (41)
- B18% (9)
Why each option
Disabling SSID broadcast is a weak control because the SSID is still transmitted in 802.11 management frames, DHCP still hands out addresses, and a default SSID is trivially guessable - all allowing unauthorized access.
If DHCP remains enabled, an unauthorized client that already knows or guesses the SSID can still automatically receive a valid IP address, subnet mask, and gateway, completing network access without manual configuration.
WPA2 is a strong wireless security protocol that encrypts traffic and requires authentication; it is a protective measure, not a reason why unauthorized users can still connect after disabling SSID broadcast.
Even with SSID broadcast disabled, the SSID is still transmitted in clear text within 802.11 probe request and probe response frames as well as association and re-association frames exchanged between clients and the AP, making it trivially discoverable with a wireless packet analyzer.
Using a default SSID (such as 'linksys', 'netgear', or the ISP-assigned default) allows an attacker to guess the hidden SSID without any packet capture, rendering the broadcast-disabling measure ineffective.
Concept tested: Limitations of SSID broadcast disabling as wireless security
Source: https://learn.microsoft.com/en-us/windows/win32/nativewifi/about-the-native-wifi-api
Topics
Community Discussion
No community discussion yet for this question.