1

(As everyone does) I have a local WiFi password that is used for signing in and using the WiFi for local users.

I have a separate & far stronger (64 char) admin password to gain access to my WiFi router (settings, etc).

My question is:

If the WiFi password is guessed is there anything that a remote user is able to do? I'm guessing that there is not, but I have not seen this explicitly covered anywhere and I want to make sure.

Restating For Clarity

Definitions (added for clarity)

  • Local Attacker = within WiFi range
  • Remote Attacker = not within WiFi range, but an attacker from across the Internet who has discovered my router's IP Address.

Again, I'm guessing that only a local attacker would be able to use the WiFi password in order to get onto my WiFi network. I'm also guessing that the remote attacker cannot use the WiFi password in any way to gain access to the router or network. Is that true?

2
  • 1
    A business should be using WPA2 Enterprise with a Radius server, not relying on shared passwords.
    – Ron Maupin
    Oct 20, 2022 at 19:45
  • I'm not sure what the router has to do with this. Your Wi-Fi is on WAPs that are either fat or connect to a controller. An attacker with your router password can get into the router that has full access to your network. If you mean a consumer-grade router/switch/WAP, those are off-topic here.
    – Ron Maupin
    Oct 20, 2022 at 20:18

2 Answers 2

3

Unless you've managed to configure the same password in both places, the attacker can't gain access.

BUT, you've given the attacker access to your network (discreetly), from which they can try all sorts of other attacks -- against things far more valuable than your admin password.

I will also add that WPA2-Enterprise is the best way to control access for users. That requires a Radius server, maybe an Active Directory server, and quite a bit of configuring. For a small company with a handful of users, it's probably not worth the effort -- unless you have high-value assets to protect.

3
  • So you're saying that an attacker who is connected via the Internet can somehow use my WiFi password to get onto my network? Please show docs or diagram that explain this more clearly? What is the Interface they would use to do that remotely? I'm very confused about this. Thanks
    – raddevus
    Oct 20, 2022 at 20:05
  • 3
    No, I'm saying an attacker in the parking lot, outside your physical control, where you can't see them, can access your network.
    – Ron Trunk
    Oct 20, 2022 at 20:06
  • 1
    Yes, that is definitely true ( a local attacker in the parking lot). I agree. Thank you for clearing that up & I'm not trying to say that is fine or anything. Just trying to separate the two types of attackers. Thanks for help
    – raddevus
    Oct 20, 2022 at 20:08
2

If the WiFi password is guessed

If the pre-shared key (PSK) is disclosed or guessed, then anyone with that knowledge can connect to your network. That is equivalent to entering your premises and plugging a laptop into your switch.

What exactly they can do from there depends on the additional layers of security that your network uses.

I'm also guessing that the remote attacker cannot use the WiFi password in any way to gain access to the router or network.

Then you're guessing wrong. The PSK is the only thing that is required to gain access to your network. (With 'remote' meaning as far as the radio waves carry - connecting across the Internet isn't possible, of course. Radio waves can carry surprising distances if the attacker uses a directional antenna.)

Businesses should always use WPA2 Enterprise with user-specific logins (usually backed by RADIUS and/or X.509 certificates). That way, the admin can change user passwords that have been disclosed or specifically lock out compromised users. A pre-shared key requires you to interrupt service and notify all users to reconnect.

2
  • How would an attacker go about signing into my network using the WiFi password? Is there a way to access that remotely -- as in across the Internet/Web? Can you share documentation that describes this type of breach? Thanks.
    – raddevus
    Oct 20, 2022 at 20:03
  • Thank you for the changes. I also updated the question to add a bit more definition to local & remote attacker. Thanks for your interesting & informative answer.
    – raddevus
    Oct 20, 2022 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.