Wireless, Wired, and Bluetooth Attack Surfaces Compared

Wireless, wired, and Bluetooth networks are three distinct attack surfaces, but when any of them runs without proper security controls they share the same two fundamental risks: an attacker can eavesdrop on traffic in transit, and an attacker can gain unauthorized access to the network or device. What differs is the medium — and therefore how close the attacker must be, what tools they need, and which controls close the gap.

Attack surface vs. threat vector

Two terms the SY0-701 objectives pair together. An attack surface is the sum of all points where an attacker could interact with a system — every port, protocol, radio, and jack. A threat vector is the specific path an attacker actually uses to reach a target. A laptop’s attack surface includes its Wi-Fi radio, Bluetooth radio, and Ethernet port; a rogue pairing request over Bluetooth is a threat vector exploiting one part of that surface. Reducing attack surface means disabling radios you don’t use, closing ports, and segmenting networks so fewer paths exist in the first place.

The wireless attack surface

Wi-Fi’s defining property is that it broadcasts through open air. Signals leak past walls and property lines, so an attacker never needs to touch your building.

Key threats:

• Eavesdropping/sniffing. Without strong encryption, frames can be captured passively from a parking lot. Even with encryption, management traffic historically went unprotected.
• Rogue access points and evil twins. Any unauthorized AP on the network is a rogue; an evil twin specifically impersonates a legitimate SSID (Service Set Identifier) to lure clients into connecting through attacker hardware.
• Deauthentication attacks. Spoofed management frames kick clients off the network — a denial of service on its own, and a setup step for forcing reconnection to an evil twin or capturing a WPA2 handshake.
• Cryptographic attacks on weak protocols. Wired Equivalent Privacy (WEP) is trivially broken; WPA2 pre-shared keys can be brute-forced offline from a captured handshake.

Controls: WPA3 with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks; 802.1X/Extensible Authentication Protocol (EAP) for enterprise authentication; protected management frames; wireless intrusion detection — the radio counterpart of the network sensors that monitor wired segments; and site surveys to control signal spill. See WPA3 and SAE for the protocol details.

The wired attack surface

Ethernet is often assumed safe because “you’d have to plug in.” That assumption is the vulnerability. Wired networks trust physical presence, so the attack surface is every live jack in a lobby, conference room, warehouse, or hallway — plus every unattended cable run.

Key threats:

• Unauthorized physical connection. A visitor or insider plugs a laptop, rogue switch, or drop-box device into a live port and is instantly on the LAN.
• Tapping and interception. Traffic on copper can be tapped inline; a compromised or attacker-placed device can capture everything on its segment. Cleartext protocols on the LAN are just as readable as they would be over open Wi-Fi.
• Spoofing at layer 2. Media Access Control (MAC) address spoofing impersonates approved devices; Address Resolution Protocol (ARP) poisoning redirects a segment’s traffic through the attacker for an on-path position.

Controls: physically secure or disable unused ports, port security on switches, and — the strong answer — 802.1X port-based Network Access Control (NAC), which authenticates a device before the port passes traffic. Covered in depth in 802.1X and Network Access Control.

The Bluetooth attack surface

Bluetooth is short-range (roughly 10 meters for most devices, farther with directional antennas), which limits — but does not eliminate — exposure. It creates a device-to-device attack surface that bypasses the network perimeter entirely: a compromised headset pairing touches no firewall.

Named attacks the exam expects you to distinguish:

• Bluejacking — sending unsolicited messages to a nearby device. Annoying, mostly harmless; it sends to the victim.
• Bluesnarfing — exploiting a vulnerable Bluetooth implementation to steal data (contacts, messages, files) from the device. This is the serious confidentiality breach.
• Bluebugging — going further: taking control of device functions, such as placing calls or listening in.
• Pairing and eavesdropping attacks. Legacy pairing modes used weak PINs; flaws in older Bluetooth versions allowed key negotiation to be downgraded so an attacker could decrypt the link. Devices left in discoverable mode advertise themselves to everyone in range.

Controls: keep firmware updated, disable Bluetooth when unused, turn off discoverable mode, reject unexpected pairing requests, and use current Bluetooth versions with Secure Connections pairing. Mobile Device Management (MDM) can enforce these settings on corporate devices.

Side-by-side comparison

Dimension	Wireless (Wi-Fi)	Wired (Ethernet)	Bluetooth
Attacker proximity needed	Radio range — can be off-premises	Physical access to a jack or cable	Close range (~10 m typical)
Shared core risks	Eavesdropping; unauthorized network access	Eavesdropping (taps, on-path); unauthorized access via open ports	Eavesdropping on the link; unauthorized device access/pairing
Signature attacks	Evil twin, deauth, WPA cracking	ARP poisoning, MAC spoofing, rogue devices	Bluejacking, bluesnarfing, bluebugging
Primary controls	WPA3/SAE, 802.1X/EAP	Port security, 802.1X NAC, physical security	Non-discoverable mode, patching, pairing hygiene

The pattern worth internalizing: no medium is inherently safe. Wired is not secure “because it’s wired” — it simply moves the requirement from radio proximity to physical access. Bluetooth is not safe “because it’s short-range” — range limits opportunity, not capability. Every unsecured link, regardless of medium, exposes confidentiality (interception) and access control (unauthorized connection).

How the SY0-701 exam tests this

• A “choose two” question asks which risks apply across unsecured wireless, wired, and Bluetooth networks. The credited pair is interception/eavesdropping of data in transit and unauthorized access — distractors are risks unique to one medium (deauth floods, cable taps) or irrelevant ones (password reuse).
• A scenario names symptoms — data stolen from a phone via Bluetooth with no user interaction — and asks you to label the attack. Match theft to bluesnarfing, spam messages to bluejacking, remote control to bluebugging.
• A question describes a visitor plugging into a lobby Ethernet jack and reaching internal servers, then asks the best preventive control: 802.1X/NAC or disabling unused ports beats “install antivirus.”
• Definitional items contrast attack surface with threat vector, or ask how to reduce the attack surface — the answer is eliminating entry points (disable unused radios/ports), not adding monitoring.

Attack-surface questions appear in more than one exam domain — the Security+ SY0-701 study guide maps this topic into a full study plan, and Security+ practice questions sharpen the surface-versus-vector call.

Quick reference

• Attack surface = all possible entry points; threat vector = the path actually used.
• Shared risks across all three unsecured media: eavesdropping on traffic and unauthorized access.
• Wireless extends past your walls: evil twins, deauth, handshake cracking; fix with WPA3/SAE and 802.1X.
• Wired trusts physical presence: rogue devices, taps, ARP poisoning; fix with NAC and port security.
• Bluetooth trio: bluejacking = messages, bluesnarfing = data theft, bluebugging = device control.
• Range limits opportunity, not capability — short-range Bluetooth still leaks data to nearby attackers.
• Reduce attack surface by disabling what you don’t use: radios, ports, discoverable mode.