What is Over-the-Air Credential Theft?

Threat actors can steal login credentials over Wi-Fi through a number of attack vectors. Examples of attacks that can lead to stolen credentials over Wi-Fi include spoofed SSIDs, man-in-the-middle (MITM) attacks, evil twin attacks, brute force attacks, social engineering, phishing emails, and more. These credential theft attacks can target both corporate users and consumers in large-scale credential harvesting.

Sometimes, the hacker uses techniques like DNS spoofing to gain access to user credentials, where they create an illegitimate web page or malicious software that seems authentic and redirect traffic there. When new users enter their corporate credentials or individual user credentials on the fake web page, they are transmitted right away to the hacker, making them susceptible to corporate credential theft and consumer credential theft. The hackers utilize these stolen credentials to gain unauthorized access to their critical data over the air.

A PKI (Public Key Infrastructure) is a framework that manages digital certificates, which are one of the greatest security defenses available to prevent credential theft. A PKI allows organizations to issue, revoke, and otherwise manage each certificate.

Because digital certificates can replace credentials in a variety of ways, they can stop hackers from stealing credentials for a number of critical resources. Certificates can prevent credential theft attacks for Wi-Fi credentials and cloud application credentials. They can even prevent stolen credentials from desktop logins.

Another common cause that allows hackers to steal credentials is password mismanagement. Users often recycle passwords or create weak passwords that malicious software can easily steal. By enabling certificate-based authentication with a PKI, administrators no longer need to worry about login credentials being vulnerable to password mismanagement.

The passwordless authentication experience for an end user is much more seamless and secure compared to traditional passwords. Passwordless authentication comes in various forms, such as Multi-Factor Authentication (MFA), Two-factor authentication, biometric authentication, or one-time passcodes received via SMS or email. One of the most secure forms of passwordless authentication is certificate-based authentication(CBA), which uses digital certificates to authenticate and can be combined with two-factor authentication.

Digital certificates work on the principle of asymmetric encryption and hence minimize almost all the risks associated with credential-based attacks, making them one of the most secure authentication methods. While the experience can vary slightly based on what users log into, it generally involves choosing their certificate at the time of authentication.

For something like Wi-Fi, end users usually have no idea a certificate is being used. Managed Devices can have certificates automatically configured for Wi-Fi using most MDMs, and 802.1x Onboarding platforms like SecureW2 configure unmanaged devices for passwordless authentication. Most users don’t even notice the difference.

Certificates are based on the concept of asymmetric encryption, which uses both a public and private key for safe encryption and decryption. The private key is integral. If threat actors don’t have the private key, they won’t be able to do anything with the certificate.

One of the greatest security measures for private key protection is to make sure they are stored in the proper places on devices. We recommend storing them in the correct key store and secure enclaves, as well as setting the private keys to non-exportable at the time of issuance. If the device has a Trusted Platform Module (TPM), storing the private keys there further enhances security. PKIs like SecureW2 can attest that private keys have been generated in hardware like TPMs and Secure Enclaves and can also configure private keys as non-exportable.