## 4 Attack Surface Analysis
### Radio Access Control
#### 4.1.3 Attacks on WPA/WPA2 Enterprise  
The authentication and key generation process of WPA/WPA2-Enterprise differs significantly from that of WPA/WPA2. Unlike WPA/WPA2, WPA/WPA2-Enterprise employs individual login credentials for each user and verifies them through a RADIUS server [48]. Although this setup is more complex, it improves security by utilizing unique keys for each user, enabling accountability. Consequently, administrators can fine-tune wireless access for individual users, increasing the difficulty for potential attackers to carry out certain exploits, even if the volume of generated traffic is comparable to that of a WPA/WPA2 network. Additionally, since the keys are likely unique for each participant, the traffic generated is indistinguishable from that of distinct access points, even if it originates from the same AP in theory.  
Although WPA-Enterprise deviates from WPA/WPA2 primarily in its authentication method and key generation algorithms, it retains theoretical susceptibility to the same attacks as WPA and WPA2. However, its likelihood of compromise is reduced due to its individual access point behavior for each client. However, in addition to conventional attacks targeting WPA and WPA2, WPA-Enterprise networks are vulnerable to Evil Twin attacks [49]. In such an attack, an adversary establishes a fraudulent access point with the same SSID as the genuine network, associating it with a RADIUS server. The attacker then initiates deauthentication probes or passively waits for clients to connect to the counterfeit access point. Despite potential warnings from certificates designed to validate access point authenticity, users often overlook them. Consequently, the attacker acquires the client's credentials, facilitating further exploitation, such as password cracking and unauthorized access to the corporate wireless network. Open-source tools like hostapd-wpe [50] in Kali Linux provide specific patches to hostapd and FreeRADIUS [51] servers, enabling such attacks. Implementing server certificates can mitigate these attacks by preventing access points from claiming the identity of others.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt} p{56.9 pt}} \hline \hline
**Password Format** & **1000 Usable Words** & **5000 Usable Words** & **20,000 Usable Words** & **50,000 Usable Words** \\ \hline
1 word and 1 number & 0.000166 & 0.000833 & 0.003332 & 0.00833 \\ \hline
1 word and 2 numbers & 0.05 & 0.25 & 0.5 & 2.5 \\ \hline
1 word and 3 numbers & 0.2 & 1 & 4 & 10 \\ \hline
2 words and 1 number & 0.5 & 12.5 & 200 & 1250 \\ \hline
2 words and 2 numbers & 20 & 500 & 8000 & 50,000 \\ \hline
2 words and 3 numbers & 1000 & 25,000 & 400,000 & 2,500,000 \\ \hline
3 words and 1 number & 2000 & 250,000 & \(1.6\times 10^{7}\) & \(2.5\times 10^{8}\) \\ \hline
3 words and 2 numbers & 100,000 & \(1.25\times 10^{7}\) & \(8\times 10^{8}\) & \(1.25\times 10^{10}\) \\ \hline
3 words and 3 numbers & 6,000,000 & \(7.5\times 10^{8}\) & \(4.8\times 10^{10}\) & \(7.5\times 10^{11}\) \\ \hline \hline \end{tabular}
\end{table}
Table 3: Dictionary attack times for passwords with different formats.