31–40 of 204 posts
>Unlike previous Wi-Fi attacks, AirSnitch exploits core features in Layers 1 and 2 and the failure to bind and synchronize a client across these and higher layers, other nodes, and other network names such as SSIDs (Service Set Identifiers). This cross-layer identity desynchronization is the key driver of AirSnitch attacks. >The most powerful such attack is a full, bidirectional machine-in-the-middle (MitM) attack, m…
Bit of a sensational title? This doesn't "break WiFi encryption", only device isolation if the attacker is already in the same network.
Many businesses and universities, and likely some government offices, rely on client isolation for segmenting their networks. It’s a big deal.
Also client isolation is not considered "needed" in home/SOHO networks because this kind of attack is kinda assumed out of scope; it's not even tried to address this. "If you give people access to your wifi, they can fuck with your wifi devices." This should probably be communicated more clearly, but any claims on this attack re. home networks are junk.
Earlier quoted context omitted.
Little Snitch is probably the most popular one, written my devs who deeply understand macOS firewall architecture. https://obdev.at/products/littlesnitch/index.html
Little Snitch is a user-friendly, software-level blocker, only – use with caution. Just FYI: LittleSnitch pre-resolves DNS entries BEFORE you click `Accept/Deny` , if you care & understand this potential security issue. Your upstream provider still knows whether you denied a query. Easily verifiable with a PiHole (&c). I liken the comparison to disk RAIDs: a RAID is not a true backup; LittleSnitch is not a true firew…
This also feels like an exfil route? Are DNS queries (no tcp connect) logged/blocked?
Earlier quoted context omitted.
Many businesses and universities, and likely some government offices, rely on client isolation for segmenting their networks. It’s a big deal.
you are definitely correct that it is potentially a big deal because it breaks expectation around network segmentation and isolation however, most people will read "breaks wi-fi encryption" and assume that it means that someone can launch this attack while wardriving, which they cant.
As a former wardriver (¡WEPlol!), it only makes this more difficult. In my US city every home/business has a fiber/copper switch, usually outside. A screw-driver and you're in.
Granted, this now becomes a physical attack (only for initial access) — but still viable.
----
>the next step is to put [AirSnitch] into historical context and assess how big a threat it poses in the real world. In some respects, it resembles the 2007 PTW attack ... that completely and immediately broke WEP, leaving Wi-Fi users everywhere with no means to protect themselves against nearby adversaries. For now, client isolation is similarly defeated—almost completely and overnight—with no immediate remedy available.
----
I think the article's main point is that so many places have similarly-such-unsecured plug-in points. Perhaps even a user was authorized for one WiFi network segment, and is already "in" — bless this digital mess!
The article is hot garbage, here's the abstract from the paper ( https://www.ndss-symposium.org/ndss-paper/airsnitch-demystif... ): To prevent malicious Wi-Fi clients from attacking other clients on the same network, vendors have introduced client isolation, a combination of mechanisms that block direct communication between clients. However, client isolation is not a standardized feature, making its security guarant…
A tad sensationalist perhaps, but "hot garbage" is a bit much.
Earlier quoted context omitted.
you are definitely correct that it is potentially a big deal because it breaks expectation around network segmentation and isolation however, most people will read "breaks wi-fi encryption" and assume that it means that someone can launch this attack while wardriving, which they cant.
>assume that it means that someone can launch this attack while wardriving, which they cant. As a former wardriver (¡WEPlol!), it only makes this more difficult. In my US city every home/business has a fiber/copper switch, usually outside. A screw-driver and you're in . Granted, this now becomes a physical attack (only for initial access) — but still viable. ---- >the next step is to put [AirSnitch] into historical c…
Original source (should replace the current link): https://www.ndss-symposium.org/wp-content/uploads/2026-f1282... Summary: https://www.ndss-symposium.org/ndss-paper/airsnitch-demystif... (hat tip: https://news.ycombinator.com/item?id=47167975 )
Yeah, this is a much clearer source and the abstract gets pretty directly to the point. The first paragraph tells you pretty much everything you need to know before you read more. The Ars article took 4 paragraphs to mention "client isolation" and even longer to get into the meat.
Earlier quoted context omitted.
Little Snitch is a user-friendly, software-level blocker, only – use with caution. Just FYI: LittleSnitch pre-resolves DNS entries BEFORE you click `Accept/Deny` , if you care & understand this potential security issue. Your upstream provider still knows whether you denied a query. Easily verifiable with a PiHole (&c). I liken the comparison to disk RAIDs: a RAID is not a true backup; LittleSnitch is not a true firew…
>Just FYI: LittleSnitch pre-resolves DNS entries BEFORE you click `Accept/Deny`, if you care & understand this potential security issue. Your upstream provider still knows whether you denied a query. Easily verifiable with a PiHole (&c). This also feels like an exfil route? Are DNS queries (no tcp connect) logged/blocked?
No, not with LittleSnitch (neither in/out-bound).
When you see the LittleSnitch dialogue (asking to `Accept/Deny`), whatever hostname is there has already been pre-resolved by upstream DNS provider (does not matter which option you select). This software pares well with a PiHole (for easy layperson installs), but even then is insufficient for OP's attack.
Even if they can rewrite the MAC and force a new one via ping, which are usually already disabled, they still can’t eavesdrop on the TLS key exchange. I fail to see how this is a risk to HTTPS traffic? It’s a mitm sure but it is watching encrypted traffic.