Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

ndss-symposium.org

Post reply on HN
Print view View original

41–50 of 204 posts

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#41

Post by ProllyInfamous »

JKCalhoun wrote: post #31
ProllyInfamous wrote: post #16

>Unlike previous Wi-Fi attacks, AirSnitch exploits core features in Layers 1 and 2 and the failure to bind and synchronize a client across these and higher layers, other nodes, and other network names such as SSIDs (Service Set Identifiers). This cross-layer identity desynchronization is the key driver of AirSnitch attacks. >The most powerful such attack is a full, bidirectional machine-in-the-middle (MitM) attack, m…

You would like the film The Conversation (1974) .

For a second I thought this was the Mel Gibson movie where he proves a Conspiracy Theory (1997)... but Gene Hackman, post-Watergate — with an ensemble cast of eavesdroppers?! — tonight's movie, decided.

Thank you for your recommendation - it be crazy up in here (head, country, world).

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#42

Post by g-b-r »

Tangentially, does anyone know why so many of the (enormous amount of) papers accepted at this San Diego conference is from Chinese researchers? (https://www.ndss-symposium.org/ndss2026/accepted-papers)

Has China become so prominent in security research?

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#43

Post by upboundspiral »

benlivengood wrote: post #13

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…

What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#45

Post by nixpulvis »

vxxzy wrote: post #44

Had to read through all the cruft to get: "If the network is properly secured—meaning it’s protected by a strong password that’s known only to authorized users—AirSnitch may not be of much value to an attacker."

IIUC the issue is, you could have a "secure" network and a guest network sharing an AP, and that guest network can access clients on the secure network. Someone did mention the xfinity automatic guest network, which might be a pain to disable?

This is likely not a big deal for your home network, if you only have one network, but for many enterprise setups probably much worse.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#46

Post by bronco21016 »

upboundspiral wrote: post #43
benlivengood wrote: post #13

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…

What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?

It sounds like this attack would work in that scenario provided the attacker is able to connect to the guest access point.

I haven’t paid attention to one in a while but I seem to remember the need to authenticate with the guest network using Xfinity credentials. This at least makes it so attribution might be possible.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#47

Post by jcalvinowens »

This is a big deal: it means a client on one wifi network can MITM anything on any other wifi network hosted on the same AP, even if the other wifi network has different credentials. Pretty much every enterprise wifi deployment I've ever seen relies on that isolation for security.

These attacks are not new: the shocking thing here that apparently a lot of enterprise hardware doesn't do anything to mitigate these trivial attacks!

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#48

Post by dijit »

tialaramex wrote: post #29
benlivengood wrote: post #13

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…

The attacker doesn't need to be connected to the victim's network, only to the same hardware, the hardware's loss of isolation is the unexpected problem. Their University example is pertinent. The victim is an Eduroam user, and the attacker never has any Eduroam credentials, but the same WiFi hardware is serving both eduroam and the local guest provision which will be pretty bare bones, so the attacker uses the means…

I should reinforce this point by saying that it's the default position for "guest" networks to be using the same hardware as "secure" office wifi and such.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#49

Post by economistbob »

I just read the paper, and my take is that practically every home wifi user can now get pwned since most WiFi routers use the same SSID and 2.4 and 5Ghz. It can even beat people using Radius authentication, but they did not deep dive on that one. I am curious about whether the type of EAP matters for reading the traffic.

Essentially everyone with the SSID on multiple access point MAC addresses can get pwned.

Neighhood hackers drove me to EAP TLS a few years ago, and I only have it on one frequency, so the attack will not work.

The mitigation is having only a single MAC for the AP that you can connect to. The attack relies on bouncing between two. A guest and regular, or a 2.4 and 5, etc.

I need to research more to know if they can read all the packets if they pull it off on EAP TLS, with bounces between a 2.4 and 5 ghz.

It is a catastrophic situation unless you are using 20 year old state of the art rather that multi spectrum new hotness.

It might even get folks on a single SSID MAC if they do not notice the denial of service taking place. I need to research the radius implications more. TLS never sends credentials over the channel like the others. It needs investigation to know if they get the full decryption key from EAP TLS during. They were not using TLS because their tests covered Radius and the clients sending credentials.

It looks disastrous if the certificates of EAP TLS do not carry the day and they can devise the key.

That is my take.

Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]

#50

Post by happyPersonR »

upboundspiral wrote: post #43
benlivengood wrote: post #13

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…

What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?

This is probably the biggest issue.

I turn WiFi mine off and use my own WiFi ap.

Post reply on HN