WIRELESS PIVOTS: HOW TRUSTED NETWORKS BECOME INVISIBLE THREAT VECTORS

Summary from the TLDR InfoSec newsletter

Even well-configured enterprise Wi-Fi networks that use EAP-TLS can be compromised via wireless pivots targeting trusted devices connecting to untrusted networks outside the corporate perimeter. Attackers capture probe requests from corporate devices, set up rogue access points mimicking home networks (like Thomson routers), crack Wi-Fi passwords via WPA handshake captures, and use tools like Responder to intercept NetNTLM hashes from mDNS/LLMNR broadcasts. Once cracked, these hashes provide internal credentials for accessing cloud services like Office 365, illustrating that the security boundary extends beyond the corporate network to any location where trusted devices connect.