WiFi Attack Mitigation & Defense Guide

3.1 Classic Deauthentication Attack

3.2 CSA (Channel Switch Announcement) Injection

Client-side mitigation on Windows:

Client-side mitigation on Linux (Kali monitoring station):

# Option 1: Ignore CSA via iw (per-interface, not persistent)
$ sudo iw dev wlan0 set csa_count 0

# Option 2: In wpa_supplicant.conf (if supported by driver)
$ echo "disable_csa=1" | sudo tee -a /etc/wpa_supplicant/wpa_supplicant.conf

AP-side mitigation:

• Some enterprise APs can validate CSA origin (Peplink B-ONE likely cannot)
• Best current defense: avoid the attack channel (already on 149) + find and remove the device
• If Peplink supports it, deploy WIDS (Wireless Intrusion Detection System) -- check firmware release notes

3.3 Evil Twin / Rogue AP

# Detection: look for multiple BSSIDs on same SSID
$ sudo airodump-ng wlan0mon --essid CTS-A
# If you see more than one BSSID row, there's a rogue AP

3.4 Authentication Flood

3.5 Beacon Flood

3.6 RF Jamming

Everything configurable on the AP itself. Walk through each item in the Peplink admin panel.

• Lock channel -- disable auto-select, pin to 149 (or another clean channel). Remove 157 from allowed list.
• PMF Required -- Network > SSID > Security > PMF: Required (not "Optional")
• WPA3-only or Transition -- evaluate (see section 2.3). WPA3-only is strongest but may break IoT devices.
• Disable WPS -- if enabled, it's a common attack vector. WPS PIN brute force takes minutes.
• Client isolation -- prevents client-to-client communication on the SSID. Useful if attacker gets a device on the network.
• Management VLAN -- if available, isolate AP management traffic from client traffic.
• Firmware update -- check for latest Peplink firmware. Security patches may address known vulnerabilities.
• Change admin password -- if still default or weak. Use a strong, unique password.
• Disable remote management -- if not needed. Reduces attack surface.

Apply to each critical Windows desktop: Jonathan's (CTRS-JONATHAN-DESK), Heather P's (CTS-DESK-HEATHER), Heather T's (DISPATCH-DESK-2), Dustin's (CTRS-Dustin-Belshe), Ashley's (CTS-ASHLEY).

5.1 Remove Unnecessary WiFi Profiles ~2 min

See section 2.5 above. Remove all saved profiles except CTS-A.

# List all profiles
PS> netsh wlan show profiles

# Delete specific profile
PS> netsh wlan delete profile name="SomeOldNetwork"

5.2 BSSID Pinning (Detailed) ~3 min

Full walkthrough in section 2.4 above. The key is adding <BSSIDList> to the exported XML profile.

Complete profile XML structure with BSSID pinning highlighted:

<?xml version="1.0"?>
<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
  <name>CTS-A</name>
  <SSIDConfig>
    <SSID>
      <name>CTS-A</name>
    </SSID>
  </SSIDConfig>
  <connectionType>ESS</connectionType>
  <connectionMode>auto</connectionMode>
  <MSM>
    <security>
      <authEncryption>
        <authentication>WPA3SAE</authentication>
        <encryption>AES</encryption>
        <useOneX>false</useOneX>
      </authEncryption>
    </security>
    <!-- ADD THIS BLOCK FOR BSSID PINNING -->
    <connectivity>
      <BSSIDList>
        <BSSID>[AP_BSSID_HERE]</BSSID>
      </BSSIDList>
    </connectivity>
  </MSM>
</WLANProfile>

5.3 Disable WiFi Sense / Auto-Connect to Open Networks ~1 min

Windows can auto-connect to suggested open hotspots and share WiFi passwords with contacts. Disable this.

# Disable auto-connect to suggested hotspots (Registry)
PS> Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\WcmSvc\wifinetworkmanager\config" -Name "AutoConnectAllowedOEM" -Value 0 -Type DWord

# Also check: Settings > Network & Internet > Wi-Fi
# Turn OFF "Connect to suggested open hotspots"
# Turn OFF "Connect to networks shared by contacts"

5.4 Disable 802.11r Fast Roaming ~2 min

802.11r (Fast BSS Transition) is designed for multi-AP roaming. In a single-AP environment it's unnecessary and can be exploited.

# Check if fast roaming is enabled on the WiFi adapter
PS> Get-NetAdapterAdvancedProperty -Name "Wi-Fi" | Where-Object {$_.DisplayName -match "roam|802\.11r|bss"}

# Disable if present (property name varies by driver)
PS> Set-NetAdapterAdvancedProperty -Name "Wi-Fi" -DisplayName "802.11r" -DisplayValue "Disabled"

# Alternative: open Device Manager > Network Adapters >
# [WiFi adapter] > Properties > Advanced tab
# Look for "Roaming Aggressiveness" -- set to Lowest

5.5 Update WiFi Drivers ~5 min per machine

Intel AX201, AX211, and BE201 are common WiFi adapters in modern desktops/laptops. Updated drivers may include security fixes and better WPA3 support.

# Check current WiFi driver version
PS> Get-NetAdapter -Name "Wi-Fi" | Select-Object Name, DriverVersion, DriverDate

# Check for Intel driver updates
# Download Intel Driver & Support Assistant from:
# https://www.intel.com/content/www/us/en/support/detect.html
# Or update via Device Manager > Network Adapters > Update Driver

5.6 Enable Windows Firewall Rules for WiFi ~3 min

Ensure the Windows Firewall classifies the WiFi network as "Private" (not Public) and that inbound rules are appropriate.

# Check current network profile
PS> Get-NetConnectionProfile

# Set to Private if it shows "Public"
PS> Set-NetConnectionProfile -InterfaceAlias "Wi-Fi" -NetworkCategory Private

# Verify firewall is enabled for all profiles
PS> Get-NetFirewallProfile | Select-Object Name, Enabled

# Block all inbound by default (allow exceptions)
PS> Set-NetFirewallProfile -Profile Private -DefaultInboundAction Block -DefaultOutboundAction Allow

5.7 Group Policy: Restrict New WiFi Connections ~5 min

Prevent users from connecting to new WiFi networks without admin approval. Requires Windows Pro/Enterprise.

# Open Local Group Policy Editor
PS> gpedit.msc

# Navigate to:
# Computer Configuration > Administrative Templates >
# Network > Windows Connection Manager
#
# Enable: "Prohibit connection to non-domain networks
#          when connected to domain authenticated network"
#
# Also check:
# Computer Configuration > Administrative Templates >
# Network > Network Connections
# Enable: "Prohibit access to properties of a LAN connection"
#   (prevents users from changing network settings)

Hardware Setup

Remote Access -- ZoHo Assist

# Download ZoHo Assist unattended agent for Linux
$ wget https://assist.zoho.com/install/zohoassist-unattended-agent.deb

# Install
$ sudo dpkg -i zohoassist-unattended-agent.deb

# Configure unattended access with Robert's ZoHo account
# Follow the on-screen prompts to link to your account

# Enable auto-start on boot
$ sudo systemctl enable zohoassist
$ sudo systemctl start zohoassist

VPN -- ProtonVPN

# Install ProtonVPN CLI
$ sudo apt install -y protonvpn-cli

# Login and connect
$ protonvpn-cli login
$ protonvpn-cli connect --fastest

# Auto-connect on boot
$ protonvpn-cli config --autoconnect enable

Physical Security

• Screen lock: Configure auto-lock after 1 minute of inactivity
• Strong password on the Kali user account
• BIOS password to prevent USB boot tampering
• Disable boot from other USB in BIOS (only allow the SSK SSD)

# Set screen lock timeout (XFCE)
$ xfconf-query -c xfce4-screensaver -p /lock/enabled -s true
$ xfconf-query -c xfce4-screensaver -p /lock/saver-activation/delay -s 1

# Set strong user password
$ passwd

Auto-Start Monitoring Service

Create a systemd service that starts monitor mode and airodump capture on boot.

# Create the monitoring script
$ sudo tee /opt/wifi-monitor.sh <<'SCRIPT'
#!/bin/bash
# WiFi monitoring auto-start script
IFACE="wlan1"
CHANNEL="157"
CAPTURE_DIR="/opt/captures"
DATE=$(date +%Y-%m-%d_%H%M)

mkdir -p "$CAPTURE_DIR"

# Enable monitor mode
airmon-ng start "$IFACE"
MON_IFACE="${IFACE}mon"

# Start capture (rotates every hour, 100MB max per file)
airodump-ng "$MON_IFACE" \
  --channel "$CHANNEL" \
  --write "$CAPTURE_DIR/capture_${DATE}" \
  --write-interval 30 \
  --output-format pcap,csv
SCRIPT

$ sudo chmod +x /opt/wifi-monitor.sh

# Create systemd service
$ sudo tee /etc/systemd/system/wifi-monitor.service <<'SERVICE'
[Unit]
Description=WiFi Channel Monitor
After=network.target

[Service]
Type=simple
ExecStart=/opt/wifi-monitor.sh
Restart=on-failure
RestartSec=10

[Install]
WantedBy=multi-user.target
SERVICE

# Enable and start
$ sudo systemctl daemon-reload
$ sudo systemctl enable wifi-monitor.service

Capture Rotation (Prevent Disk Fill)

# Add cron job to clean captures older than 7 days
$ echo "0 3 * * * find /opt/captures -name '*.pcap' -mtime +7 -delete" | sudo crontab -

# Check disk usage periodically
$ df -h /opt/captures

Recommendation: Separate IoT SSID

If the Peplink B-ONE supports multiple SSIDs (check admin panel), create a dedicated IoT network:

• SSID: CTS-IOT (or similar)
• Security: WPA2-Personal (for devices that can't do WPA3)
• Channel: Different from CTS-A if possible
• VLAN: Isolated from the main network -- IoT devices can reach the internet but not internal resources
• Client isolation: Enabled (IoT devices don't need to talk to each other)

This lets you run CTS-A as WPA3-only while IoT devices stay connected on the separate network.

Step-by-step if the attack resumes, changes channels, or a new attack vector appears.

1. Check current channel -- Peplink admin panel > Status > Wireless
2. If attack is on current channel -- change channel immediately to any clean channel (not 157)
3. Start airodump-ng on the attack channel to capture evidence
4. Note timestamp, channel, affected devices -- write it down or screenshot
5. Screenshot everything -- AP admin panel, airodump output, client error messages
6. Check for rogue APs -- airodump-ng: multiple BSSIDs for CTS-A = evil twin
7. If you find the physical device:
   • Photograph it in place before touching it
   • Note the exact location, any connections (power, ethernet, antenna)
   • Note make/model/serial if visible
   • THEN retrieve it
8. Preserve all .pcap files -- these are forensic evidence
9. Document chain of custody -- who found it, when, who has it now
10. Do NOT reconnect the device to power or network -- preserve its state