51–60 of 204 posts
On the one hand, a seems-solid article by an author I mostly trust. OTOH... with the recent journalistic scandal at Ars Technica, perhaps Dan should have made sure that he spelled "Ubiquity" correctly? (5th para; it's correct further down.)
I only read his articles occasionally, but they always impressed me favorably; this one instead... the paper is probably clearer even for less technical people.
This is a big deal: it means a client on one wifi network can MITM anything on any other wifi network hosted on the same AP, even if the other wifi network has different credentials. Pretty much every enterprise wifi deployment I've ever seen relies on that isolation for security. These attacks are not new: the shocking thing here that apparently a lot of enterprise hardware doesn't do anything to mitigate these triv…
Original source (should replace the current link): https://www.ndss-symposium.org/wp-content/uploads/2026-f1282... Summary: https://www.ndss-symposium.org/ndss-paper/airsnitch-demystif... (hat tip: https://news.ycombinator.com/item?id=47167975 )
This is a big deal: it means a client on one wifi network can MITM anything on any other wifi network hosted on the same AP, even if the other wifi network has different credentials. Pretty much every enterprise wifi deployment I've ever seen relies on that isolation for security. These attacks are not new: the shocking thing here that apparently a lot of enterprise hardware doesn't do anything to mitigate these triv…
Like as in me being on the Guest network at a business can then read traffic of the Corporate network?
Exactly.
As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed som…
The attacker doesn't need to be connected to the victim's network, only to the same hardware, the hardware's loss of isolation is the unexpected problem. Their University example is pertinent. The victim is an Eduroam user, and the attacker never has any Eduroam credentials, but the same WiFi hardware is serving both eduroam and the local guest provision which will be pretty bare bones, so the attacker uses the means…
Earlier quoted context omitted.
You would like the film The Conversation (1974) .
For a second I thought this was the Mel Gibson movie where he proves a Conspiracy Theory (1997) ... but Gene Hackman , post-Watergate — with an ensemble cast of eavesdroppers?! — tonight's movie, decided. Thank you for your recommendation - it be crazy up in here (head, country, world).
Great movie.
I just read the paper, and my take is that practically every home wifi user can now get pwned since most WiFi routers use the same SSID and 2.4 and 5Ghz. It can even beat people using Radius authentication, but they did not deep dive on that one. I am curious about whether the type of EAP matters for reading the traffic. Essentially everyone with the SSID on multiple access point MAC addresses can get pwned. Neighhoo…
Earlier quoted context omitted.
You would like the film The Conversation (1974) .
For a second I thought this was the Mel Gibson movie where he proves a Conspiracy Theory (1997) ... but Gene Hackman , post-Watergate — with an ensemble cast of eavesdroppers?! — tonight's movie, decided. Thank you for your recommendation - it be crazy up in here (head, country, world).
I just read the paper, and my take is that practically every home wifi user can now get pwned since most WiFi routers use the same SSID and 2.4 and 5Ghz. It can even beat people using Radius authentication, but they did not deep dive on that one. I am curious about whether the type of EAP matters for reading the traffic. Essentially everyone with the SSID on multiple access point MAC addresses can get pwned. Neighhoo…
You still have to be able to authenticate to some network: the spoofing only allows users who can access one network to MITM others, it doesn't allow somebody with no access to do anything.
In practice a lot of businesses have a guest network with a public password, so they're vulnerable. But very few home users do that.