Detecting and Mitigating Wi-Fi Network Access (MITRE ATT&CK T1669)

Wi-Fi Networks (T1669) is an Initial Access technique. Adversaries connect to a wireless network to reach target systems. MITRE lists Linux, Network Devices, Windows and macOS as platforms.

How attackers use it

MITRE describes two situations. In the first, adversaries exploit open Wi-Fi networks that target devices use. In the second, they get onto a secured network belonging to the target organization, which requires Valid Accounts (T1078).

Wi-Fi needs proximity, both to find the network and to keep a stable connection. MITRE lists two ways around that:

• Physically positioning themselves near the network for close access operations.
• Remotely compromising nearby third-party systems that have both wired and wireless connections (dual-homed systems), then using them as a bridge to the target's Wi-Fi.

Once on the network, an adversary may do follow-on work such as Network Sniffing (T1040) or Adversary-in-the-Middle (T1557) for credential access or discovery. MITRE's examples include a group that exploited open access points to reach target devices, and a campaign in which wireless connections to a target organization's enterprise Wi-Fi gave initial access.

How to detect it

MITRE's detection strategy splits by platform:

• Windows. Unexpected SSID associations, repeated authentication failures, and connections outside known geofenced networks. Monitor wireless connection logs and the events for network discovery, authentication and association.
• Linux. Watch wpa_supplicant logs, NetworkManager events, and calls related to interface state changes. Signs include repeated association failures, new SSIDs outside the baseline, and rogue access point connections.
• macOS. Rapid SSID switching, connections to unapproved SSIDs, and repeated authentication failures in unified logs.
• Network devices. Firewall, wireless intrusion detection or prevention, and controller logs. Look at firewall rule changes, rogue access point detection, and unfamiliar MAC addresses connecting to access points.

How to reduce the risk

1. Multi-factor Authentication. Harden Wi-Fi access with two or more pieces of evidence, such as a password plus a token from a smart card or token generator.
2. Network Segmentation. Keep Wi-Fi and wired Ethernet in separate network environments, particularly where wired networks reach sensitive resources.
3. Encrypt Sensitive Information. Encrypt wired and wireless traffic, use sound authentication protocols such as Kerberos, and protect credential-bearing web traffic with SSL/TLS.

Check your own environment

• Is your corporate SSID using enterprise authentication tied to individual accounts?
• Can a device on guest or corporate Wi-Fi reach the same servers as a wired desktop?
• Do your wireless controller logs go to a central place?
• Do you have an inventory of authorized access points, so a rogue one stands out?
• Do laptops auto-join open networks?

Quick check

Sources

• MITRE ATT&CK, Wi-Fi Networks (T1669): https://attack.mitre.org/techniques/T1669