SC-032: Wireless Network Attack — Operation Air Bridge¶

Threat Actor Profile¶

RADIO FALCON represents a skilled insider threat — a contracted biomedical equipment technician with physical access to MedCore Regional Hospital's facilities. The technician, frustrated over a contract dispute and facing financial pressures, decides to exploit wireless network vulnerabilities to access and exfiltrate patient health information (PHI) for sale on dark web marketplaces. Their physical access to clinical areas, mechanical rooms, and network closets provides ideal positioning for wireless attacks.

The insider has intermediate wireless security knowledge gained from publicly available penetration testing courses and tools. They understand WPA2-Enterprise authentication, RADIUS protocols, and common wireless attack frameworks (hostapd-wpe, Eaphammer). Their physical presence in the hospital provides a critical advantage: they can deploy rogue access points in locations with strong signal coverage to clinical areas, and their presence does not raise suspicion because they are authorized to be in technical spaces.

Motivation: Financial — PHI records sell for $250–$1,000 per record on dark web markets (significantly more than credit card data). Secondary motivation: retaliation against the hospital for the contract dispute. Estimated target: 5,000+ patient records with a potential black market value of $1.25M–$5M.

Scenario Narrative¶

Phase 1 — Wireless Reconnaissance (~30 min)¶

RADIO FALCON begins passive wireless reconnaissance during normal working hours, using a laptop with an external wireless adapter (Alfa AWUS036ACH) concealed in a backpack. As a biomedical technician, carrying a laptop and equipment through clinical areas is unremarkable. The reconnaissance is entirely passive — no packets are transmitted — making it undetectable by the hospital's network monitoring.

The technician maps the wireless environment over 3 days, cataloging access points, SSIDs, authentication methods, client devices, and signal coverage patterns. Key findings:

• Corporate SSID: MedCore-Staff — WPA2-Enterprise, PEAP-MSCHAPv2 — 47 APs
• Medical Device SSID: MedCore-IoT — WPA2-PSK — Pre-shared key (unchanged for 2+ years)
• Guest SSID: MedCore-Guest — Open (captive portal) — Internet-only, VLAN-isolated
• Legacy SSID: MedCore-Legacy — WPA2-PSK — Used by older medical devices that do not support Enterprise auth

The technician also identifies that the corporate RADIUS server certificate is self-signed (CN=MedCore-RADIUS, O=MedCore Hospital) and that several client devices are configured to not validate the server certificate — a common misconfiguration when IT deploys PEAP-MSCHAPv2 without certificate pinning.

Evidence Artifacts:

Phase 2 — Evil Twin Deployment & Credential Capture (~45 min)¶

RADIO FALCON deploys an evil twin access point using a Raspberry Pi 4 with a high-gain antenna, concealed inside a medical equipment case in a mechanical room on the 3rd floor. The mechanical room is accessible with the technician's badge, is rarely visited by other staff, and has an electrical outlet. The device is configured using hostapd-wpe (hostapd with WPE patches for credential harvesting).

The evil twin broadcasts SSID MedCore-Staff on channel 6 (same as the nearest legitimate AP) with higher power output, causing nearby client devices to preferentially associate with the rogue AP. When clients connect and attempt PEAP-MSCHAPv2 authentication, the evil twin presents its own RADIUS certificate. Clients configured to not validate the server certificate complete the authentication handshake, transmitting MSCHAPv2 challenge-response hashes that can be cracked offline.

Over 8 hours (overnight shift, fewer staff to notice connectivity issues), the evil twin captures MSCHAPv2 hashes from 34 unique devices/users. The technician retrieves the Raspberry Pi the following morning during a routine maintenance visit.

Evidence Artifacts:

Phase 3 — Network Access & Lateral Movement (~40 min)¶

Using the cracked credentials for t.nakamura (IT Admin), RADIO FALCON connects to MedCore-Staff from a personal laptop. The IT admin account has elevated privileges: local admin on workstations, VPN access, and read access to several file shares including the IT department share (\\fs-01.medcore.example.local\IT$). The technician connects from the hospital cafeteria during lunch — an area with legitimate wireless coverage.

From the wireless network, the attacker discovers that network segmentation between the MedCore-Staff VLAN (10.10.10.0/24) and the MedCore-IoT VLAN (172.16.50.0/24) is enforced by a firewall — but the IT admin VLAN (10.10.1.0/24) has a management ACL permitting access to all VLANs for device management purposes. Using t.nakamura's credentials, the attacker pivots through the IT admin VLAN to reach the medical device network.

The attacker enumerates the medical device network and identifies:

• EHR Application Server: 10.10.5.20 (Epic Hyperspace) — contains patient records
• PACS Server: 10.10.5.30 (medical imaging) — contains radiology images and reports
• SQL Database Server: 10.10.5.40 — backend database for the EHR system
• 147 medical devices on 172.16.50.0/24 — infusion pumps, patient monitors, ventilators

Evidence Artifacts:

Phase 4 — EHR Access & PHI Exfiltration (~40 min)¶

Using t.nakamura's IT admin credentials, the attacker accesses the EHR SQL database server (10.10.5.40) via SQL Server Management Studio (installed on an IT workstation accessed via RDP). The IT admin account does not have direct access to the EHR application, but it has db_datareader permissions on the SQL backend — a legacy configuration from a database migration project 18 months ago that was never cleaned up.

The attacker executes SQL queries to extract patient demographics, diagnoses, medications, Social Security numbers, and insurance information. Over 2 hours, 5,247 patient records are exported to CSV files on the IT workstation, then exfiltrated via HTTPS to a cloud storage endpoint (storage.cloud-upload.example.com) using the hospital's guest WiFi network (which has unrestricted internet access).

Evidence Artifacts:

Phase 5 — Detection & Investigation (~30 min)¶

The attack is detected when the IT security team investigates the 4-hour-old EDR network scan alert. During investigation, they discover the MAC mismatch on t.nakamura's wireless authentication (personal device vs. corporate device), the cross-VLAN lateral movement, and the SQL database access. The investigation escalates rapidly when SQL audit logs reveal bulk PHI queries.

Simultaneously, t.nakamura (the real IT admin) reports to the helpdesk that his account was locked out after multiple failed password attempts — he has been on vacation for 3 days and has not logged in. This confirms credential compromise.

Evidence Artifacts:

Phase 6 — Containment, Eradication & Regulatory Response (~30 min)¶

MedCore activates its incident response plan, engaging external forensics, legal counsel, and the FBI (due to the HIPAA breach scale and insider threat component). The containment and remediation effort addresses both the immediate compromise and the systemic wireless security gaps.

Evidence Artifacts:

Detection Opportunities¶

KQL Detection Queries¶

// Detect RADIUS authentication from unregistered MAC addresses
WiFiAuthLogs
| where AuthResult == "Success"
| join kind=leftanti (
    ManagedDevices | project MACAddress
) on $left.ClientMAC == $right.MACAddress
| project TimeGenerated, Username, ClientMAC, APSSID, APName, AuthResult
| extend Alert = "Successful WiFi auth from unregistered device MAC"

// Detect rogue access points (BSSID not in inventory)
WirelessControllerEvents
| where EventType == "APDetected"
| where BSSID !in (
    WirelessAPInventory | project BSSID
)
| where SSID in ("MedCore-Staff", "MedCore-IoT", "MedCore-Legacy") // spoofing corporate SSID
| project TimeGenerated, BSSID, SSID, Channel, SignalStrength, NearestAP
| extend Alert = "Rogue AP detected broadcasting corporate SSID"

// Detect bulk SQL queries against PHI tables
SQLAuditEvents
| where DatabaseName == "EHR_Production"
| where TableName has_any ("Patient_Demographics", "Patient_Diagnoses", "Patient_Medications")
| where RowsReturned > 100
| summarize QueryCount=count(), TotalRows=sum(RowsReturned) by LoginName, ClientIP, bin(TimeGenerated, 1h)
| where TotalRows > 1000
| extend Alert = strcat("Bulk PHI access: ", TotalRows, " rows by ", LoginName)

// Detect credential use while user is on PTO
let PTOUsers = HRCalendar | where Status == "PTO" | project UserPrincipalName, PTOStart, PTOEnd;
SigninLogs
| join kind=inner PTOUsers on $left.UserPrincipalName == $right.UserPrincipalName
| where TimeGenerated between (PTOStart .. PTOEnd)
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ResultType
| extend Alert = "Account used while employee is on PTO — possible credential compromise"

// Detect DHCP hostname anomalies (attack tool indicators)
DHCPLogs
| where Hostname has_any ("kali", "parrot", "pentoo", "blackarch", "commando", "attack")
| project TimeGenerated, MACAddress, AssignedIP, Hostname, VLAN
| extend Alert = strcat("Suspicious DHCP hostname: ", Hostname, " — possible attack tool")

Splunk (SPL) Detection Queries¶

// Rogue AP detection — BSSID not in inventory
index=wireless sourcetype=wireless_controller event_type=ap_detected
| lookup wireless_ap_inventory bssid OUTPUT ap_name as known_ap
| where isnull(known_ap)
| search ssid IN ("MedCore-Staff", "MedCore-IoT", "MedCore-Legacy")
| table _time, bssid, ssid, channel, signal_strength, nearest_legitimate_ap
| eval alert="Rogue AP broadcasting corporate SSID"

// WiFi auth with MAC mismatch for known users
index=radius sourcetype=radius_auth result=accept
| lookup corporate_devices username OUTPUT registered_mac
| where client_mac != registered_mac AND isnotnull(registered_mac)
| table _time, username, client_mac, registered_mac, ap_name, ssid
| eval alert="WiFi auth from non-registered device for known user"

// Bulk PHI database access detection
index=sqlserver sourcetype=sql_audit database="EHR_Production"
action=SELECT table_name IN ("Patient_Demographics", "Patient_Diagnoses", "Patient_Medications", "Patient_Insurance")
| bucket _time span=1h
| stats sum(rows_returned) as total_rows count as query_count by login_name, client_ip, _time
| where total_rows > 1000
| eval severity="CRITICAL"
| eval alert="Bulk PHI query: ".total_rows." rows accessed by ".login_name

// Data exfiltration via guest network — large HTTPS uploads
index=firewall sourcetype=fw_traffic src_zone="Guest_WiFi" dest_port=443 action=allow
| stats sum(bytes_out) as total_bytes by src_ip, dest_ip, dest_host
| where total_bytes > 50000000
| eval mb_transferred=round(total_bytes/1048576, 2)
| eval alert="Large data transfer via guest WiFi: ".mb_transferred." MB to ".dest_host

// Cross-VLAN lateral movement from wireless client
index=firewall sourcetype=fw_traffic src_zone="Staff_WiFi"
dest_zone IN ("Medical_Devices", "Clinical_Systems", "IT_Admin")
| stats count dc(dest_ip) as unique_destinations by src_ip, src_zone, dest_zone
| where unique_destinations > 5
| eval alert="Wireless client performing cross-VLAN reconnaissance"

Incident Response Checklist¶

Immediate Actions (0–2 hours)¶

• [ ] Reset credentials for all 34 captured accounts — force MFA re-enrollment
• [ ] Physically sweep all accessible areas for rogue wireless devices
• [ ] Revoke insider's badge access and place on administrative leave
• [ ] Block the exfiltration destination (storage.cloud-upload.example.com) at the firewall
• [ ] Isolate the compromised IT workstation (10.10.2.15) for forensic imaging
• [ ] Engage HIPAA privacy officer and legal counsel

Short-Term Actions (2–72 hours)¶

• [ ] Deploy emergency WIPS monitoring for rogue AP detection
• [ ] Determine complete scope of PHI exfiltration from SQL audit logs
• [ ] Forensically image recovered Raspberry Pi — maintain chain of custody
• [ ] Coordinate with FBI for insider threat investigation and data recovery
• [ ] File HIPAA breach notification with HHS OCR
• [ ] Remove legacy database permissions for IT accounts on clinical systems

Long-Term Actions (1–12 weeks)¶

• [ ] Migrate from PEAP-MSCHAPv2 to EAP-TLS with mutual certificate authentication
• [ ] Deploy NAC with device posture assessment and MAC authentication
• [ ] Implement medical device micro-segmentation with strict ACLs
• [ ] Add content inspection and egress filtering to guest WiFi network
• [ ] Deploy DLP solution with PHI content inspection on all network egress points
• [ ] Implement zero trust wireless architecture with continuous authentication

Lessons Learned¶

What Went Wrong¶

What Went Right¶

ATT&CK Navigator Mapping¶

Related Chapters¶

• Chapter 31 — Network Security Architecture — Wireless security, network segmentation, NAC, zero trust networking
• Chapter 43 — Network Pentesting — Evil twin attacks, wireless penetration testing, RADIUS exploitation
• Chapter 34 — Mobile & IoT Security — Medical device security, IoT network segmentation, wireless IoT protocols