Investigator Briefing

Topic 1.3 · Best Practices for Public Networks

You've been assigned four incident files, each involving a device connecting to a network outside the safety of a trusted, private connection. Public Wi-Fi is convenient — and that convenience is exactly what attackers count on. Your job is to read each case, examine the evidence, and answer the investigator's questions in your own words.

Essential Question: What risks are associated with public Wi-Fi, and how can users reduce those risks?

Evil Twin Attack — fraudulent network imitating a legitimate one

Jamming Attack — disrupts wireless comms by flooding frequencies

War Driving — searching for/mapping wireless networks while traveling

VPN — encrypts traffic between a device and a VPN provider

SSID — the name identifying a wireless network

Denial of Service (DoS) — prevents authorized access to a service/network

Wireless Access Point (WAP) — device providing wireless connectivity

CASE 2027-1.3A

Evil Twin Attack

The Contested Connection

Location: Grindhouse Coffee, Downtown · Reported by: Maya Ontiveros, patron

Maya sits down at her usual table at Grindhouse Coffee, opens her laptop, and clicks the Wi-Fi icon. Two networks with similar names show up in the list — more than she remembers seeing here before. She's in a hurry to submit an assignment before it's due, so she just wants to pick one and get online.

A hand-written sign taped to the counter reads: "Free Wi-Fi: ask barista for password." Maya didn't ask — she just tapped a name that looked right.

Click a row below to flag any network(s) you find suspicious.

SSID (Network Name)	Signal	Security	First Seen	Notes
Grindhouse_Coffee_Guest	-52 dBm	WPA2 (password on receipt)	Known — posted for months	Matches the shop's printed menu board
Grindhouse Coffee Free WiFi	-41 dBm (strongest)	Open — no password	First appeared ~10 min ago	Slightly different spacing/name than the shop's real network
Grindhouse_Coffee_Guest_5G	-60 dBm	WPA2 (password on receipt)	Known — posted for months	5GHz band of the same trusted network
xfinitywifi	-70 dBm	Open — captive portal	Known — citywide hotspot	Unrelated public hotspot, weak signal from outside

1. Which network(s) did you flag as suspicious, and what specific details made you flag them?

2. What is an evil twin attack, and how does it trick a victim into connecting?

3. Name at least two clues in this case that distinguish the evil twin from the legitimate network.

4. What should Maya have done before connecting to any network at the coffee shop?

5. Suppose Maya already connected to the evil twin and logged into her email. What should she do now, and why?

CASE 2027-1.3B

Jamming / Denial of Service

Silence at Gate 12

Location: Terminal B, Gate 12 · Reported by: Airport IT Operations

At 9:14 a.m., travelers waiting to board at Gate 12 begin complaining that their phones and laptops suddenly drop off the terminal Wi-Fi at the same moment. Bluetooth headphones disconnect. Mobile boarding passes won't load. The disruption lasts about a minute before the network snaps back to normal, right as boarding begins.

Airport IT pulls the wireless monitoring log for the gate's access point covering that window.

Click the log rows that show evidence of the disruption.

Time	Connected Devices	RF Noise Floor	Status
09:12:10	119	-95 dBm	Normal operation
09:13:58	121	-94 dBm	Normal operation
09:14:47	6	-41 dBm	Sharp RF noise spike; mass disconnect
09:15:10	0	-38 dBm	No client traffic; channel saturated
09:15:52	0	-40 dBm	No client traffic; channel saturated
09:19:55	123	-94 dBm	Noise floor returns to baseline; devices reconnect

1. Which log entries did you flag as evidence of the attack, and what pattern do they show?

2. Based on the sudden RF noise spike and total loss of client connections, what type of attack occurred?

3. How is a wireless jamming attack different from a typical network-based denial of service (DoS) attack?

4. Why might someone target a boarding gate specifically, right before passengers board?

5. What can a traveler do if they suspect the Wi-Fi/Bluetooth outage around them is a jamming attack rather than a normal outage?

CASE 2027-1.3C

War Driving

The War Driving Notebook

Location: Oakwood Residential District · Reported by: Neighborhood watch, Block Captain D. Reyes

For the past week, a resident has noticed the same gray sedan slow-rolling through the neighborhood at odd hours, idling briefly on each block before moving on. After a break-in attempt at a house whose Wi-Fi router still used its factory default password, police recover a laptop and a spiral notebook from a suspect's vehicle. The laptop's wireless scanning history is pulled as evidence.

Click the entries that suggest the driver was scanning and mapping networks rather than just using Wi-Fi normally.

Time	Block	SSID Detected	Signal	Encryption	Dwell Time
20:03	Oak St, 100 block	HomeNet_2G	-55 dBm	WPA2	40 sec
20:03	Oak St, 100 block	Linksys00421	-60 dBm	None (open)	40 sec
20:04	Oak St, 100 block	ATT-9F3D	-58 dBm	WPA2	40 sec
20:11	Maple Ave, 200 block	NETGEAR22	-50 dBm	WEP	35 sec
20:11	Maple Ave, 200 block	FBI Surveillance Van 2	-64 dBm	WPA2	35 sec
20:18	Birch Ln, 300 block	Reyes_Family_Wifi	-45 dBm	WPA3	32 sec
20:47	Birch Ln, 300 block (parked in driveway)	Reyes_Family_Wifi	-30 dBm	WPA3	26 min

1. Which entries did you flag, and what pattern across time, location, and dwell time points to war driving?

2. What is war driving, and what is an attacker usually trying to accomplish by doing it?

3. Which specific network(s) in the log would be the most attractive target, and why?

4. What could a homeowner do to make their own network less attractive to someone war driving through the area?

5. Is war driving itself illegal, or is it just information-gathering? Explain your reasoning, and note what would change your answer.

CASE 2027-1.3D

VPN & Public Wi-Fi Risk

VPN or Not to VPN

Location: Lakeview Hotel Business Center · Subject: Devon Park, marketing intern

Devon is working remotely for a week from a hotel. The hotel's Wi-Fi requires accepting a captive portal agreement but no password — anyone in the building can join. Devon has several tasks to get through before the end of the day and has to decide, task by task, how much risk each one carries and what to do about it.

For each task, select the risk level and the best action if using the hotel Wi-Fi without a VPN. Your selections are saved automatically.

Task on Hotel Wi-Fi	Risk Level	Best Action
Logging into an online banking app to pay a bill
Reading a public news website (no login)
Logging into a personal email account
Entering name and room number into the hotel's Wi-Fi captive portal
Connecting to the company's own VPN-protected intranet for a work file

1. Explain the risk rating you gave to online banking. What specifically is at stake?

2. What does a VPN actually protect against on public Wi-Fi? What does it not protect against?

3. Why might using a phone's cellular hotspot be safer than the hotel Wi-Fi for the most sensitive task on the list?

4. Write one general rule of thumb you'd give a friend for using public Wi-Fi safely.

Final Debrief

Synthesis · Topic 1.3 Essential Question