Wireless, RF, and IoT Security — A Cross-Cutting Module

What this is. A phase-equivalent module on the security of the radio attack surface — Wi-Fi (802.11), Bluetooth/BLE, NFC/RFID, and the broader IoT/RF world — the layer most curricula skip because it lives off the wire. Attackers don't need a network port when they can reach you over the air from the parking lot; defenders (and authorized wireless assessors) must understand how these links authenticate, encrypt, and fail.

Why it's its own module. The rest of the track assumes IP-and-above. Wireless changes the medium: anyone in range can listen and transmit, identity is tied to radios you don't control, and "physical access" shrinks to "within ~100 m." That reframes the threat model — rogue access points, evil twins, handshake capture, BLE pairing weaknesses, and RFID cloning have no exact wired analog.

Prerequisites. Phases 02 (TLS/identity), 05 (OS), 13 (hardware). Everything here is authorized-lab-only and offline — the labs reason over captured scan/advertisement metadata, never live transmission. Transmitting on licensed/occupied spectrum or attacking networks you don't own is illegal (Phase 00); this module builds analysis and defense judgment.

Learning Objectives

By the end you can, without notes:

  1. Explain the Wi-Fi security evolution (WEP → WPA/WPA2-PSK → WPA3-SAE → Enterprise/802.1X) and what each fixed and left open.
  2. Explain the 4-way handshake, why it's capturable, and what makes a WPA2-PSK network crackable (offline dictionary attack, PMKID) versus WPA3-SAE's resistance.
  3. Detect rogue APs and evil twins and explain why "it has the right SSID" proves nothing.
  4. Reason about Bluetooth/BLE pairing (Just Works vs Passkey vs Numeric Comparison) and why Just Works has no MITM protection.
  5. Explain NFC/RFID cloning and relay attacks and the defenses (cryptographic challenge-response, distance bounding).
  6. Give the defensive playbook: WPA3/802.1X, management-frame protection (802.11w), wireless IDS, network segmentation for IoT, and "no security by obscurity of frequency."

The radio threat model (read the WARMUP)

WIRED:    attacker needs a port / a route          identity ~ cable + switchport
WIRELESS: attacker needs to be in range            identity ~ a radio anyone can imitate
          → passive capture is free and invisible
          → transmitting a stronger/identical signal hijacks the link (evil twin, rogue AP)

See WARMUP.md for the full from-zero treatment of 802.11, the handshakes, BLE, NFC/RFID, and the defenses.

Labs

LabBuildsFocus
Lab 01 — Wireless Survey Analyzerclassify Wi-Fi posture from a scan; detect rogue/evil-twin APs; rate handshake crackability802.11
Lab 02 — BLE/IoT Posture Evaluatorflag weak BLE pairing, default creds, no-OTA, NFC clonability from device metadataBLE / IoT / NFC

Each lab is pure Python (stdlib + pytest) with lab.py/solution.py/test_lab.py/README.md.

cd lab-01-wireless-survey-analyzer
LAB_MODULE=solution pytest -q
pytest -q

Safety

Authorized-lab-only and offline; the labs analyze captured/synthetic metadata. No transmission, no attacking networks/devices you don't own, no spectrum you aren't licensed for (Phase 00).