Inside the Wireless Airwaves: How We Turned an Arduino Into a Cybersecurity Teaching Lab

Investigation Notebook: Deconstructing Wireless Beacons & Radio Reality

Wireless local area networks (Wi-Fi) govern modern digital interactions. While users routinely rely on operating systems to discover and connect to available access points, few stop to analyze the raw radio beacons quietly coordinating those connections.

In line with my core mission at Ethixaim—understanding complex systems, debunking illusions, and dissecting how belief and trust are manipulated—I built a hands-on laboratory project. The goal? To demonstrate how the physical environment and radio spectrum can be altered using accessible hardware, and why blindly trusting what a system displays is a fundamental vulnerability.

1. Dissecting the Hardware Layer

Understanding a complex system requires peeling back its physical components. For this experiment, I utilized the Arduino UNO R4 WiFi. Unlike basic microcontrollers, this board operates as a dual-processor architecture:

• Primary Microcontroller: Renesas RA4M1 (ARM Cortex-M4 operating at 48 MHz) handling core logic.

• Wireless Transceiver: ESP32-S3 module, responsible for 2.4 GHz IEEE 802.11 b/g/n radio communications.

• On-Board Diagnostics: A built-in 12x8 LED matrix used to verify system state visually.

2. The Mechanics of Perception: Wi-Fi Beacon Frames

In standard wireless operations, an Access Point (AP) repeatedly broadcasts management packets known as Beacon Frames. These frames broadcast roughly every 100 milliseconds to announce system parameters:

• Network Identity (SSID): The human-readable name of the network.

• Capabilities & Encryption: Supported data rates and security protocols (Open, WPA2, WPA3).

• Synchronization Timestamps: Essential data for roaming clients.

Smartphones and laptops listen to these broadcasts passively across 2.4 GHz channels. This creates a psychological and technical trust model: users assume that if a network name appears on their screen, an authentic infrastructure exists behind it. An adversary can exploit this blind trust to forge SSIDs, create confusion, or spoof legitimate access points.

3. The Code: Sandboxed Rotation Architecture

To study this mechanism safely without cluttering the radio spectrum, I programmed the microcontroller to act as an alternating Access Point in a controlled rotation cycle.

C++

#include "WiFiS3.h"
#include "Arduino_LED_Matrix.h"

// Educational SSIDs broadcast in sequence
const char* listeSSID[] = {
  "LAB_CYBER_TEST_A",
  "LAB_CYBER_TEST_B",
  "LAB_CYBER_TEST_C"
};
const int nbReseaux = 3;
int indexActuel = 0;
unsigned long dernierChangement = 0;
const unsigned long intervalle = 10000; // 10-second rotation

ArduinoLEDMatrix matrix;

// Static antenna glyph for the 12x8 matrix
const uint32_t antenneFrame[] = {
    0x00240024,
    0x00180018,
    0x00180018
};

void setup() {
  Serial.begin(115200);
  while (!Serial);

  matrix.begin();
  matrix.loadFrame(antenneFrame);

  Serial.println("=================================================");
  Serial.println("   DEMONSTRATION : DIFFUSION DE BALISES WI-FI   ");
  Serial.println("=================================================");

  demarrerPointAcces(indexActuel);
}

void loop() {
  // Non-blocking timer check
  if (millis() - dernierChangement >= intervalle) {
    dernierChangement = millis();
    indexActuel = (indexActuel + 1) % nbReseaux;
    
    demarrerPointAcces(indexActuel);
  }
}

void demarrerPointAcces(int index) {
  WiFi.end(); // Terminate preceding AP instance
  delay(100);

  const char* nomReseau = listeSSID[index];
  int status = WiFi.beginAP(nomReseau);

  if (status == WL_AP_LISTENING) {
    Serial.print("[DIFFUSION ACTIVE] Nouvelle balise SSID : ");
    Serial.println(nomReseau);
    Serial.print("                   Canal Wi-Fi par defaut | IP : ");
    Serial.println(WiFi.localIP());
  } else {
    Serial.println("[ERREUR] Impossible d'initialiser le point d'acces.");
  }
}

4. Execution & Empirical Evidence

1. Compilation & Memory Mapping: The sketch compiled utilizing 58,588 bytes of flash memory (22% capacity) and 7,660 bytes of dynamic RAM, demonstrating how lightweight software can manipulate environmental perception.

2. Runtime Diagnostics: Connecting via Serial Monitor at 115200 baud captured the active rotation logs as the internal ESP32 initiated the software access points:

   Plaintext

   [DIFFUSION ACTIVE] Nouvelle balise SSID : LAB_CYBER_TEST_A
                      Canal Wi-Fi par defaut | IP : 192.168.4.1
   [DIFFUSION ACTIVE] Nouvelle balise SSID : LAB_CYBER_TEST_B
                      Canal Wi-Fi par defaut | IP : 192.168.4.1
   [DIFFUSION ACTIVE] Nouvelle balise SSID : LAB_CYBER_TEST_C
                      Canal Wi-Fi par defaut | IP : 192.168.4.1
   

3. Client-Side Reality Test: When observing the network interface on target mobile devices, the available Wi-Fi list refreshed dynamically every 10 seconds—replacing LAB_CYBER_TEST_A with LAB_CYBER_TEST_B, then LAB_CYBER_TEST_C. To the end user, three distinct infrastructure entities appeared to exist over time, when in reality, it was a single micro-device executing a loop.

5. Investigative Takeaways: Behind the Illusion

• Visibility $\neq$ Authenticity: Any $20 microcontroller can broadcast arbitrary text strings into the air. Never assume a network is legitimate simply because its identifier matches a trusted institution, business, or venue.

• Volatile Memory Audit: In this laboratory setup, no incoming connection records or client footprints were written to non-volatile storage (EEPROM/Flash). Understanding hardware memory lifecycle is crucial when auditing physical artifacts.

6. Decommissioning & Zeroization

To complete any research project ethically, the environment must be restored to its baseline state. Radio transmissions are decommissioned by overwriting the volatile setup with a null execution loop:

C++

void setup() {}
void loop() {}

Flashing this blank script shuts down all active wireless subsystems, clears runtime RAM, and leaves the hardware completely inert.