Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

151–160 of 204 posts

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#151

Post by nickburns »

vanhoefm wrote: post #137
nickburns wrote: post #119

Earlier quoted context omitted.

Much of (if not the vast majority of the 'worthwhile') traffic you're intercepting is still encrypted packets though. Not to minimize the recon value of the plaintext stuff. But not really fair to say you're 'bypassing' any encryption but for the WPA-specific kind.

People who use or rely on client isolation want to prevent inter-client attacks, for whatever reason. We show that this can often be broken. This can be problematic when you have older hardware in your network that is rarely updated, and many then rely on client isolation to mitigate attacks. If everything is encrypted and properly patched, then our attack indeed has less impact, but then there also wouldn't have bee…

Disagree with your final statement. There's good security (and performance) reason to use any/all viable network isolation/segmentation/separation, etc., whenever/wherever possible. So-called Wi-Fi 'client isolation' is but a single network security strategy. No single strategy should be relied upon exclusively, nor avoided for that matter.

But it seems we otherwise agree on the overall impact of this vector. My point was mostly about the statement regarding any 'bypassing' of encryption.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#152

Post by cyberax »

cluckindan wrote: post #134
russdill wrote: post #107

Earlier quoted context omitted.

It looks like both clients must be on the same VLAN for the attack to work. They could be connected on different BSSIDs or even different SSIDs, but they still must be on the same VLAN.

If the vulnerability is between layers 1 and 2, wouldn’t that imply that VLAN tagging at layer 2 might not be effective in segregating the traffic?

Wireless cards typically don't expose the VLAN tags directly. So VLANs should be OK.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#153

Post by nickburns »

blobbers wrote: post #133
NetMageSCW wrote: post #123

Earlier quoted context omitted.

Do separate VLANs behind the different SSIDs provide protection?

I would guess that the VLAN separation should prevent it, but perhaps there are implementation errors on the VLAN implementation inside of individual brands of routers? Inter-VLAN routing shouldn't be done at the wifi access point, packets would need to be tagged coming out of the wifi AP and switched upstream, unless I'm mistaken about this.

Access points by their very definition are not capable of inter-VLAN routing.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#155

Post by ipython »

0x457 wrote: post #116
drnick1 wrote: post #111

Earlier quoted context omitted.

What makes you say that? It does not seem trivial at all to guess a valid MAC.

It's in managmenet frames that you can sniff.

Does wpa3 pmf fix this particular issue?

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#156

Post by kyboren »

economistbob wrote: post #75
varispeed wrote: post #68

Earlier quoted context omitted.

Social vector? Come up with some tradesperson spiel if person invites home, ask for wifi password, you are in. Some people also have passwords easy to break. Friend of mine literally had "hunter22" as WiFi password.

I had organized neighbors who broke WPA3 using tools, i disabled downgrade to WPA2 and they still broke it. I had one that setup an evil twin to catch my Linux login They stole the IP of one of boxes so they could get my login, and joined my network to setup the credential stealer. I caught this when my password didn't work at the ssh login. That was an apartment and they knew when I caught them. The problem is not w…

Where the fuck do you live?

Both an apartment you lived in and a house you moved to had neighbors who cracked your WPA3 network and compromised your infrastructure?

Also: You use EAP TLS on your home network but not SSH keys?

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#157

Post by benlivengood »

vanhoefm wrote: post #142
blobbers wrote: post #131

Earlier quoted context omitted.

Hi! In the case of accessing the private Enterprise SSID, was the network VLAN isolated or some other type of virtualization of the bssid? Thanks for your work on the topic! This is quite interesting!

When testing our own Enterprise devices, VLANs were not used. This was done to understand the impact of client isolation on its own. For the university networks that we tested, I'd have to ask my co-author. But perhaps my other comment can further contextualize this: https://news.ycombinator.com/item?id=47172327 Summarized, I'm sure that it is possible to configure devices securely, and VLANs can play an important ro…

Without 802.1X (EAP), there isn't really a way to achieve client isolation against inside attackers who can mount mc-mitm [0] attacks against base stations and clients. The basic problem is single shared secrets that allow anyone who knows it to act as any of the participants (which also breaks privacy). Unfortunately the infrastructure for EAP is unwieldy for unmanaged devices.

The real solution is zero-trust network access which gets closer to reality with passkeys; the last mile will be internal (LAN) devices that need a way to provision trusted identities (Bluetooth proximity, QR codes, physical presence buttons, etc.). Quite a pain for smartbulbs or other numerous IoT. If ZTNA is solved then 802.1x is trivial as well for e.g. preventing bandwidth stealing.

EDIT: I guess Matter is leading the way here. I need to do some more reading/learning on that.

[0] https://www.rit.edu/wisplab/sites/rit.edu.wisplab/files/2022...

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#158

Post by 1bpp »

upboundspiral wrote: post #43
benlivengood wrote: post #13

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…

What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?

As of a few years ago, you could simply spoof your MAC to that of a Comcast subscriber with these and you'd get unrestricted access on the hotspot.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#159

Post by ProllyInfamous »

ipython wrote: post #155
0x457 wrote: post #116

Earlier quoted context omitted.

It's in managmenet frames that you can sniff.

Does wpa3 pmf fix this particular issue?

This isn't considered "broken" — it's part of how WiFi works/associates.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#160

Post by abdhass »

ssl-3 wrote: post #140
jwr wrote: post #76

Incidentally, this client isolation thing can be extremely annoying in practice in networks you do not control. Hardware device makers just assume that everything is on One Big Wi-Fi Network and all devices can talk to all other devices and sing Kum-Ba-Yah by the fire. Then comes network isolation and you can no longer turn on your Elgato Wi-Fi controlled light, talk to your Bose speaker, or use a Chromecast.

That seems less annoying than a hotel full of people who can play whatever they want with my Chromecast. No malice is required for this to happen; it is completely possible to do by mistake. Words like " I've been trying to use the Chromecast! " "The Living Room Chromecast?" "Yes! It says it's playing, but I don't see anything on the TV screen!" "You hit the play button, right?" "Yeah, and then it keeps stopping on i…

Will a travel router like this prevent this sort of attack?
Post reply on HN