Examkin

Question

Difficulty: HardNetwork and Wireless Attack Indicators

Match each observed wireless attack indicator on the left with its corresponding attack classification on the right.

  • Captive portal clone broadcasting an identical corporate SSID with a stronger RSSI on an unapproved channel alongside injected frame dropsEvil Twin Attack
  • Unsolicited OBEX push messages containing text or contact cards received on mobile endpoints over short-range 2.4 GHz wireless linksBluejacking
  • A high-frequency burst of 802.11 management frames (subtype 0x000C) forcing wireless clients off the access pointWireless Disassociation Attack
  • Capture logs demonstrating repeated M4 and M6 message failures during automated PIN registration attempts against an APWPS Brute-Force Attack

Answer

1. Captive portal clone broadcasting identical SSID -> Evil Twin Attack; 2. Unsolicited OBEX push messages -> Bluejacking; 3. Burst of 802.11 management subtype 0x000C frames -> Wireless Disassociation Attack; 4. M4/M6 failure messages during PIN registration -> WPS Brute-Force Attack.
Each indicator uniquely aligns with its attack mechanism: Evil Twins impersonate known SSIDs with stronger RSSI; Bluejacking uses OBEX to deliver unsolicited media; Disassociation attacks utilize 802.11 management frames (subtype 0x000C); and WPS brute-forcing triggers M4/M6 handshake errors during PIN validation.

Step-by-Step Solution

1
Analyze the indicator describing an unauthorized access point copying a legitimate network's SSID with higher signal strength.
Identify that spoofing a legitimate SSID to intercept victim traffic defines an Evil Twin attack.
Evil Twins trick client devices into auto-associating due to higher signal strength.
2
Examine the short-range wireless payload involving OBEX push protocol messages.
Match OBEX messaging with Bluejacking.
Bluejacking involves sending unsolicited business cards or text messages via Bluetooth without gaining unauthorized data access.
3
Inspect the 802.11 frame subtype 0x000C metric.
Associate subtype 0x000C (Deauthentication) with a Wireless Disassociation attack.
Spoofed 802.11 deauthentication management frames force targeted endpoints off the wireless network.
4
Identify the protocol failures during M4/M6 handshake messages.
Link WPS PIN handshake message failures to WPS Brute-Force attacks.
WPS exchanges use specific message sequences (M1 through M8); failures at M4/M6 occur when testing invalid 4-digit PIN halves.

Key Concept

Identifying wireless attack signatures and protocols from technical packet indicators and log anomalies.
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic