ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

Wireless and Mobile Device Attacks

Wireless Networks
Wireless networks are networks that enable devices to connect and communicate without the use
of physical wires or cables. This is achieved by transmitting and receiving data via radio frequencies
(RF). Common wireless networks include Wi-Fi, mobile data networks, and Bluetooth connections.
They are widely used to provide convenience and mobility in various sectors, including public
spaces, businesses, and personal devices.

Wireless networks have made life easier, especially during the COVID-19 pandemic, when schools
closed and learning and teaching from home became the new norm. However, they are susceptible
to attacks that can cause great harm to a device and the user.

Wireless Attacks
Wireless network attacks are deliberate and malicious actions aimed at exploiting vulnerabilities in
wireless communication systems to gain unauthorised access, intercept sensitive data, disrupt
network operations, or compromise the security of devices and users connected to the network. An
example is a rogue access point.

Common Wireless Vulnerabilities

A vulnerability is a system, application, or network weakness that allows threats to gain
unauthorised access or cause harm.

Below is a list of common weaknesses a threat actor can take advantage of:

1. Default SSIDs and Passwords

SSID (Service Set IDentifier) is the name used to identify a wireless network before connecting. It
can also be referred to as a Wi-Fi name. The image below shows Wi-Fi networks available under
different SSIDs or Wi-Fi names.

1
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

source: SSID

Wi-Fi devices such as access points and home routers come with default credentials. Depending on
the brand, default credentials are the same across these devices. This makes it easy for an attacker
to compromise a wireless network by logging in and taking over the router, loading malicious
scripts, or redirecting network traffic to their server. An attacker can steal user information, such as
bank details or the identity of a user, and use it for fraudulent activities or sell it on the dark web.
Default usernames and passwords must be changed immediately to prevent a hacker from accessing
the wireless network.

2
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
2. Access Point Location
An access point should not be in a place where it is easily accessible. An attacker, in a matter of
seconds, can revert the access point to default settings and set the configurations to redirect traffic
to them.

3. Wired Equivalent Privacy (WEP) Protocol

WEP is a wireless traffic encryption protocol that has been deprecated; hence, it is no longer secure.
An attacker can easily crack the password, reverse the encryption process, and view data on the
wireless network using tools. Users should instead use more secure encryption protocols, such as
Wi-Fi Protected Access 2 (WPA2) or Wi-Fi Protected Access 3 (WPA3).

Types of Wireless Attacks

1. War-driving
It is also referred to as access point mapping. This is the act of looking for wireless networks by
moving around a town or city using a GPS device while recording the location of wireless networks.
The information is then uploaded to a website to digitally map the networks in that area.

Source: Sophos Home

3
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
An example of War-driving mapping

Source: secjuice.com

2. Jamming
This is also known as network interference. It is a method of attack that involves intentionally
disrupting wireless communication systems such as Wi-Fi, Bluetooth, GPS systems, and cellular
phones. Its primary goal is to disrupt the network. The interference can be either intentional or
unintentional, and it can target specific frequencies, channels, or devices. An attacker can combine
jamming techniques using a variety of methods, including emitting noise, spoofing signals, and
exploiting protocol vulnerabilities. To confirm whether you are experiencing wireless jamming, scan
the wireless environment with various tools such as spectrum analyzers, network monitors, or
jamming detectors to identify the source and type of interference. To prevent this attack, make sure
to use strong encryption protocols like WPA2 or WPA3. Additionally, users can also set up the router
to use different frequencies, 2.5 GHz and 5 GHz.

4
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
3. Rogue Access Points
A rogue access point is an unauthorised access point that an individual has set up without informing
the network administrator. A wireless access point is easy to install. Using a Windows machine, a
user can create a wireless network. However, these access points are not protected, so they can
easily be hacked, or an attacker can create one to entice valid users away from their corporate
network and capture the traffic.

source: Rogue Access Point

Two high school students in New Jersey, hacked into the school Wi-Fi and brought down all the
network services. The attack paralysed all online activities at the school. The staff could not
access the school systems, and the students could not access their work and classes. The two
students conducted the hack simply because they did not want to sit for an exam.
Videos demonstrating the dangers of connecting to an insecure Wi-Fi network:
● Hacker Demonstrates Security Risks Of Free Public Wi-Fi
● What happens when you connect to an unsecured public Wi-Fi network?

5
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
4. Evil Twin Access Points
An evil twin attack occurs when an attacker creates a fake Wi-Fi access point in the hopes that users
will connect to it rather than a legitimate one. When users connect to this access point, all
information they share with the network is routed through a server controlled by the attacker.

Video demonstration of an evil twin access point.

source: darkreadings.com

5. Packet capturing and sniffing

An attacker captures incoming and outgoing packets in the network traffic and reads information
sent between the sender and the receiver. Most information sent is in plaintext, and no form of
encryption is in use. Through packet capture analysis, a threat actor can acquire sensitive
information such as passwords, usernames, and credit card information. There are tools used for
this, including Wireshark, Ettercap, BetterCAP, TCPdump, and WinDump.

6
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

Source: gourav-dhar.com

6. War shipping

This comes from the term ‘package shipping’ which is common in online shopping websites such as
eBay, Amazon or Jumia. An attacker sends a package with malicious hardware to the physical
address of a target, for example, school premises or home, using shipping services. The attacker
gains remote access to the hardware and uses it to carry out an attack.

source: forbes.com

7
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
Wireless Attacks Scenarios
1. A 12-year-old student at Baker County Middle School hacked the school’s Wi-Fi because he
did not want to go to school. The student shut down the school’s phone lines and internet.
● Baker Co. student could face felony for reportedly hacking school's WiFi to avoid
doing school work
2. Amazon CEO Jeff Bezos' phone was allegedly hacked by a Saudi Crown Prince in 2018.
● The Jeff Bezos phone hack
3. Colleges are turning students’ phones into surveillance machines, tracking the locations of
hundreds of thousands.
● Colleges are turning students’ phones into surveillance machines, tracking the
locations of hundreds of thousands
4. Russian agents camped outside hotels to try to hack victims remotely
● How Russian Spies Infiltrated Hotel Wi-Fi to Hack Victims Up Close

Wireless Attacks Countermeasure

1. Users should avoid using untrusted networks, especially public Wi-Fi

2. Ensure your devices have the latest software update
3. Enable a firewall or VPN to protect your information
4. Use strong and unique passwords for your network
5. Turn off the wireless home network when you are not at home
6. Disable Remote Access

Windows Wi-Fi Security

When connecting to a Wi-Fi network, be cautious of the following:
1. Device discovery on the network. If on a discoverable, public network, kindly do not allow
your device to be discoverable, as someone can have access to your device.

8
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

2. Outdated security standard. The recommended standard is WPA3, which is more secure.

3. Check the security standards used

a. Click Settings. Navigate to Status.
b. Click on Properties

9
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

c. Check on the security type

10
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
Mobile Device Attacks

What do your mobile devices know about you?

Mobile devices have become an important part of our lives because they make work easier. We use
mobile devices to conduct financial transactions, teach or learn online, access websites and
government platforms, browse social media platforms, download private files, and so on. This
means that our devices know almost everything about us. For instance, if you lose your smartphone
and a malicious person gets hold of it, they can access your passwords, social security information,
files, passwords, messages, emails, addresses, location information, web history, and banking
information. The person can further impersonate you by stealing your identity and committing a
crime.

What are mobile device attacks?

A mobile device attack is an exploit targeting handheld or portable communication devices such as
a cell phone, smartwatches, Bluetooth headsets, laptops, and tablets. Most educators and learners
use smartphones and laptops during online classes, and these devices are connected to the internet,
making them susceptible to various cyber-attacks.

Types of mobile threats

1. App-based
Applications available on platforms such as the Play Store and App Store have made the smartphone
experience better. However, it is difficult to detect a malicious app because it may look genuine on a
download site. A legitimate application can also be exploited for fraudulent intentions.

2. Web-based
Mobile devices can connect to the internet and access web services such as banking services, school
websites, staff portals, and learning management systems. When a user visits a malicious site,
malware can be automatically downloaded to the device without the user’s knowledge.

3. Network-based
Mobile devices support Wi-Fi and Bluetooth technologies. An attacker can take advantage of this
when a user leaves Bluetooth enabled or connects to an unsecured Wi-Fi network and installs

11
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
malware. An attacker makes use of any weakness present in an application or operating system
(Windows, Android, or iOS) to install harmful code.

4. Physical
This involves the loss of a mobile device to an attacker. Sensitive information on the phone is
vulnerable, as the attacker has full access to the physical device. A threat actor can also get into your
institution’s network using your identity and cause havoc.

Types of mobile device attacks

1. Malware
malicious software that targets computers, tablets, and smartphones in an attempt to obtain private
information or take over the device. It can take many forms, for example:

● Adware

An attacker attempts to flood malicious and unwanted advertisements onto a user’s computer or
smartphone. Adware can be used to collect data, redirect to malicious sites, or change your
browser’s settings. The danger of adware is that data collected can be sold in the dark market and
used for identity theft

source: Adware
12
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
● Browser exploit
Mobile browsers are not completely safe. Therefore, an attacker can take advantage of its weakness
and change browser settings without your knowledge. An example of an application that works in a
browser and abuses this is PDF Reader.

source: Browser exploit

● Banking Trojan

This is a specific type of trojan horse designed to gain access to sensitive data stored or processed
by online banking systems. They appear as backdoor trojans, which exploit backdoors in your
system to bypass security measures and gain access to your computer, as well as spoofers, who
obtain user credentials by impersonating a financial institution's login page.

The attackers' primary goal is to steal banking credentials, conduct unauthorised transactions, and
syphon funds into the attacker's account.

13
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

source: Online banking Trojans

● Spyware
Hackers use spyware to track the online activities of users without their knowledge or consent. It
can spread easily by exploiting a weakness in a software application. It can acquire information
through activity monitoring, collecting keystrokes (keyboard inputs), and harvesting account
information such as logins and financial data.

Source: Spyware
14
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
2. Phishing
A cyberattack occurs when an attacker tries to get information from a user by disguising themselves
as a trusted entity and tricks the user into giving sensitive information such as a username and
password. This can be done through an email, instant message, phone call or text message.

● Clone phishing
This is a sophisticated email-based threat in which attackers create a nearly identical copy of a
legitimate email, text, social media account, or website from a reputable organisation. They then use
email spoofing techniques to make the message appear to be from a reputable organisation. These
"clone" emails have attachments that look similar to the originals; however, they contain malware
capable of stealing sensitive user information such as financial information, usernames, and
passwords.

Image: webroot.com

15
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
● Spear phishing
This is an attack that targets a specific organisation or individual. The reason it is successful is the
attacker's extensive reconnaissance of their intended target. The information gathered can then be
used to create a tailored attack.

● SMiShing
This attack uses Short Message Services (SMS) to send malicious or fraudulent texts or links. The
attacker tries to acquire information when the user clicks on the malicious link. A user can also
receive a text message that looks like it is from a trusted source. The attacker, however, through the
convincing text message, is trying to trick you into providing confidential information.

source:devfuzion

● Vishing

Also known as voice phishing. An attacker attempts to trick a person into giving up sensitive
information by providing a convincing fictional story. This is conducted through phone calls using
mobile phones or VoIP devices.

16
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)

Source: infosysblogs.com

Effects of a Mobile Device Attack

An attacker can:
● Listen to actual phone calls as they happen
● Secretly read SMS texts, capture call logs and send emails
● Listen to the phone's surroundings
● View the device’s GPS location
● Forward all email correspondence to another inbox
● Remotely control all phone functions via SMS
● Have total control of the mobile device

3. Bluetooth Technology

This technology is used for short-range wireless communication that came into existence
before Wi-Fi. Devices connected to Bluetooth include speakers, headphones, microphones,
digital cameras, and computers. It operates within a range of 10 metres.

17
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
Bluetooth Exploits

source: Bluetooth exploits

1. Bluejacking
This is when an attacker sends unsolicited messages via Bluetooth to Bluetooth-enabled devices
such as mobile phones and laptops. For the attack to occur, the target must be within the Bluetooth
range. Despite this attack being annoying, the attackers cannot access, change, or delete data from a
target device. Bluejacking can be harmful when a user responds to a bluejacking message sent with
malicious intent.

18
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
2. Bluesnarfing
This attack is where an attacker gains unauthorised access through a Bluetooth connection to a
Bluetooth-enabled device without the owner's knowledge by exploiting a firmware flaw in older
devices. It happens when the device's Bluetooth is set to discoverable mode, making it vulnerable.
This attack coerces a Bluetooth device to connect, allowing access to its data and IMEI
(international mobile equipment identity). The IMEI, a unique identification number assigned to
each device, could be used to route all incoming calls from the user's device to the attacker's device.
Additionally, the attacker may illegally download data from the device, such as emails, phone
numbers, and photos.

3. Bluebugging
This attack is similar to bluesnarfing but is more damaging. In this attack, the attacker gains access
to the device, takes over, and gains full control of the device. This means they can access the
phonebook, make phone calls, send messages and emails, and even set up call forwarding to receive
the victim's phone calls without the victim's knowledge.

4. Blue Borne

Attackers use Bluetooth to gain complete control of a device, be it Android, iOS, Windows, or Linux.
It does not require an internet connection or human interaction. It affects computers, mobile
phones, and IoT devices (smart cars and wearables). The attack does not require that the targeted
device be paired with the attacker's device or set to discoverable mode. As long as your Bluetooth is
on and you are in the vicinity of an already infected device, the virus can easily be transferred to
your device without asking for permission.

How to keep your mobile device secure.

1. Keep your phone locked when not in use

2. Use a secure application that encrypts communications, such as Signal, WhatsApp, or
ChatSecure.
3. Set secure protection measures for your device, such as complex patterns or passwords,
fingerprints, or face recognition
4. Keep your device's OS up-to-date with the latest Android or iOS
5. Do not leave your Bluetooth on discoverable mode ensure it is off if you are not using it.

19
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
6. Do not accept pairing requests on Bluetooth from strangers
7. Connect to secure Wi-Fi networks only and avoid using public Wi-Fi
8. Beware of malicious downloads or links
9. Encrypt your data using encryption tools such as ZealCrypt and Crypto
10. Install anti-virus software for your device
11. Install an ad-blocking application such as Adblock Plus, Ad-Blocker or AdGuard

WhatsApp is currently the most used application for communication. Teachers around the globe use
it to conduct online classes and pass information to students and their parents or guardians. You
can secure your WhatsApp account through the following tips:

Never share your registration code or two-step verification PIN with others

● Enable two-step verification and provide an email address in case you forget your PIN
● Set a device code
● Be aware of who has physical access to your phone (If someone has physical access to your
phone, they can use your WhatsApp account without your permission.)

How to enable two-step verification in your WhatsApp account

Source: WhatsApp two-step verification

20
ADVANCED CYBERSECURITY TRAINING FOR TEACHERS (ACTT)
Additional Reading Material on WhatsApp Security

1. How to Secure Your WhatsApp Account

2. WhatsApp security features: Five tips to keep your WhatsApp chats safe and secure
3. Top 5 WhatsApp security features you must enable right now

21