A capture on a city Enterprise SSID shows EAP identities such as [email protected]. What recon lesson should the assessor take away?
Select an answer to reveal the explanation.
Short Explanation
Seeing [email protected] in EAP is like spotting employee badges in a lobby camera. Usernames and realms can feed later password-spray classes, so treat them as sensitive recon—not proof of PMKs, WPS weakness, or the RADIUS secret.
Full Explanation
Capturing EAP identities such as [email protected] on a city Enterprise SSID teaches that EAP may expose usernames or realms useful for password-spraying classes elsewhere, so assessors must handle those strings as sensitive. Those strings do not prove the pairwise master key was already derived and stored in cleartext on the AP. They do not mean WPS PIN lockouts are disabled or that pixie-class attacks will always succeed. They also do not prove the RADIUS shared secret equals the user password. Exam caveat: outer identity privacy settings can reduce leakage when supported, but recon may still observe realms or anonymous patterns worth documenting carefully. Operational check: redact or protect identity lists in municipal reports as needed, notify identity owners of spraying risk, and verify whether profiles use anonymous outer identities without breaking AAA. For municipal and campus engagements, keep the finding language tied to authorized scope, name the building or SSID class affected, and state the residual risk to residents or staff if the rejected option had been chosen. Re-validate after the next change window that the selected control still matches inventory, monitoring, and RoE abort criteria used by the city wireless program.