Part 3 of 6: Attack Surface, Wireless Security, Social Engineering.
Most wireless attacks share a constraint that wired and remote attacks do not: proximity.
An attacker needs to be close enough to receive and interact with the target’s radio signals, whether from a public road, loading bay, reception area, stairwell or within Bluetooth range of a device.
That requirement makes social engineering an important part of a wireless risk assessment. Skip it, and you may be assessing the technology without testing whether an attacker could reach it.
Proximity doesn’t happen by accident
A pentest that starts with “here’s a device already in range” has skipped an important part of the attack path: getting there in the first place.
Attackers may gain that proximity through methods that have little to do with radios:
- Tailgating into a building behind an employee with a badge
- Pretexting as a contractor, courier or auditor to reach reception areas, plant rooms, comms rooms or other restricted locations
- Rogue device placement leaving a small Wi-Fi/BLE-capable device — a “drop box” — somewhere with power and plausible concealment
- Impersonating IT or facilities staff to reach network cabinets or wireless infrastructure
None of this requires specialist wireless knowledge. It requires a credible story and enough supporting information to make it work.
That is where the OSINT groundwork from last week becomes useful: supplier names, contractor relationships, physical layouts, employee information and other details that strengthen a pretext.
Why this stage gets skipped
Social engineering is harder to scope than a conventional wireless test. It involves people, physical access and clear rules of engagement, and it may not produce the neat technical finding that fits easily into a standard pentest report.
It is simpler to authorise “test the Wi-Fi” than “attempt to enter the building.”
As a result, many wireless assessments simply stipulate proximity:
“Assume the attacker is in the car park.”
But location changes the risk.
A vulnerability that can be exploited from a public road presents a very different exposure from one that requires access to a particular floor, stairwell or equipment room.
The relevant question is therefore not only whether the weakness exists, but where an attacker needs to be to exploit it and what it would take to get there.
What a wireless-focused social engineering exercise should cover
This does not need to become a full red-team engagement.
A scoped exercise can include:
- Physical access attempts at defined entry points under agreed rules of engagement
- Pretext calls or emails using information identified during OSINT to test whether staff disclose guest credentials, provide network access or facilitate entry to restricted areas
- Rogue device drop tests, with explicit client approval, to determine whether an unfamiliar device is detected, challenged or reported
- Badge and visitor process review to assess the controls between public areas and locations where wireless assets come within reach
The objective is not simply to prove that someone can enter a building.
It is to understand how physical access and human behaviour shape wireless exposure.
From OSINT to Proximity Assessment
Image: A wireless-focused social engineering assessment flow: OSINT finding → pretext built → access attempt → wireless / perimeter sweep → rogue device / entry test → outcome logged.
This exercise produces a proximity assessment: how close an attacker can get, which wireless assets become reachable from that position, what method gets them there, and which controls stand in the way.
The result is a clearer picture of how an attack could unfold.
It feeds directly into next week’s threat modelling stage by showing which trust boundaries are actually reachable, rather than merely accessible in theory.
Why this matters
Skipping social engineering leaves part of the wireless attack path untested.
A technically sound pentest can still misrepresent the risk if it begins from a position without establishing whether an attacker can reach it. As a result, the risk assessment can be distorted in either direction.
If your last wireless assessment began with “assume the tester is already in range”, ask:
What would it take for an attacker to get there?
Want to know whether your controls would stop an attacker?
Speak to IntSpired®.
Top comments (0)