Unit 1 Lesson 2: Public Network Risks & Personal Protection

By the end of this lesson, you should be able to

• Distinguish between a Low-Skilled Adversary and a High-Skilled Adversary.
• Identify common adversary motivations, such as Greed, Recognition, Cause, Revenge, Politics, and Belief.
• Explain three wireless network attacks: Evil Twin, Jamming, and War Driving.
• Explain how HTTPS, VPNs, and public network safety habits reduce risk, and what their limits are.

Core Knowledge

1. Adversary Skills and Motivations

Adversary Skill Levels

An Adversary can be classified by skill level. Skill level describes what an attacker can do, not why the attacker acts.

A Zero-Day Vulnerability is a vulnerability that the security community or vendor has not yet documented or fixed. A high-skilled adversary may exploit it before a patch exists.

Adversary Motivations

Adversaries can have many motivations, and in real cases these motivations often overlap.

Core check: Skill is capability, and Motivation is purpose. Do not mix them together.

2. Wireless Attacks

Evil Twin Attack

An Evil Twin Attack means the attacker sets up a Rogue Access Point with an SSID, or network name, that is identical or very similar to a real network.

After the victim connects, the attacker sits between the victim’s device and the internet and can capture network traffic.

Note: if traffic uses an encrypted protocol such as HTTPS, the attacker cannot read passwords, messages, or page content, but some metadata may still be visible, such as which websites the user visits.

Jamming Attack

A Jamming Attack means the attacker sends a strong EM Signal on the same frequency, blocking legitimate wireless communication between users and the AP.

The main goal is usually not data theft, but making the network unavailable. Therefore, it is a Denial of Service / DoS attack.

War Driving Attack

A War Driving Attack means the attacker drives or walks around a target area, scans wireless network beacons, and collects information such as SSIDs, network types, and signal strength.

It is usually reconnaissance: the attacker first maps network coverage and finds whether the signal extends outside the building, such as into a parking lot or street.

Distinction: Evil Twin tricks users into connecting and captures traffic; Jamming disrupts communication; War Driving maps wireless networks and coverage.

3. Encryption, HTTPS, and VPN

HTTPS

HTTPS encrypts the content sent between the browser and the website. Even if you connect to an untrusted public Wi-Fi network, HTTPS can protect passwords, messages, and page content from being read directly.

HTTPS protects content, not the trustworthiness of a website or network. Unencrypted DNS queries or other connection metadata may still reveal destinations. Do not ignore certificate warnings.

VPN

A VPN encrypts your traffic and sends it to a VPN Provider. The public Wi-Fi network usually sees only encrypted traffic.

A VPN shifts trust from the public network to the VPN provider, which may observe destinations and traffic not protected by end-to-end encryption. HTTPS content remains separately encrypted between the browser and website. A VPN does not make a fake website genuine or remove the need to choose a trustworthy provider.

4. Public Network Safety Habits

The core rule for public networks is: avoid them when possible; reduce sensitive actions when you must use them.

Name-check limit: A different name is a warning, but an identical name is not proof of safety: an Evil Twin can copy the SSID. Connecting successfully also does not establish trust. Confirm the intended network through an independent, trusted channel.