It seems like this attack would be thwarted by so called “multi PSK” networks (non-standard but common tech that allows giving each client their own PSK on the same SSID). Is that true?
AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
71–80 of 204 posts
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#72Earlier quoted context omitted.
What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?
This is probably the biggest issue. I turn WiFi mine off and use my own WiFi ap.
Yeah, along these lines I've always been biased strongly against using ISP hardware beyond the minimum required to connect to the outside world.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#73Earlier quoted context omitted.
For a second I thought this was the Mel Gibson movie where he proves a Conspiracy Theory (1997) ... but Gene Hackman , post-Watergate — with an ensemble cast of eavesdroppers?! — tonight's movie, decided. Thank you for your recommendation - it be crazy up in here (head, country, world).
Directed by Francis Ford Coppola, Palme d'Or at Cannes, three Oscar nominations including Best Picture (which, amusingly, it lost to The Godfather Part II ). Great movie.
In all fairness, Part II is absolutely incredible storytelling.
Are you suggesting The Conversation is even better?! So excited for tonight's showtime — I'll make an updated reply here, tomorrow morning (with my viewreport).
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#74Earlier quoted context omitted.
For a second I thought this was the Mel Gibson movie where he proves a Conspiracy Theory (1997) ... but Gene Hackman , post-Watergate — with an ensemble cast of eavesdroppers?! — tonight's movie, decided. Thank you for your recommendation - it be crazy up in here (head, country, world).
One fan theory is that Gene Hackman plays the same character, decades later, in Enemy of the State (1998).
I'll have to rewatch EofState, after tonights Conversation.
Fan theories are the only way I ever finished DFWallace's trifecta (2000 pages of gruelling chaos). Thank god for fans.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#75Earlier quoted context omitted.
They still need to be able to connect to one of the network no? So a home network without guest would be fine is my understanding?
Social vector? Come up with some tradesperson spiel if person invites home, ask for wifi password, you are in. Some people also have passwords easy to break. Friend of mine literally had "hunter22" as WiFi password.
I had organized neighbors who broke WPA3 using tools, i disabled downgrade to WPA2 and they still broke it. I had one that setup an evil twin to catch my Linux login They stole the IP of one of boxes so they could get my login, and joined my network to setup the credential stealer. I caught this when my password didn't work at the ssh login. That was an apartment and they knew when I caught them.
The problem is not wardrivers. The problem is your neighbors running 24x7 cyber operations. It happens everywhere. When I moved to a house there was a persistent attacker, and finally I setup my own key and authentication infrastructure.
They broke everything.
Finally I had to go EAP TLS and rotate certificates every three months.
Evil twin attack that keeps switching sides... The first of its kind, soon to be automated into a single button if it isn't already.
Does the temporal key mechanisms prevent them from taking a key they denial of serviced their way to while I was work -- do the temporal mechanisms prevent them from sniffing all my packets when I get home. They will not use it to get data during the denial of service.... But if they can get that radius key and use it five hours later during some backups or something...
That is the question.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#76Incidentally, this client isolation thing can be extremely annoying in practice in networks you do not control. Hardware device makers just assume that everything is on One Big Wi-Fi Network and all devices can talk to all other devices and sing Kum-Ba-Yah by the fire.
Then comes network isolation and you can no longer turn on your Elgato Wi-Fi controlled light, talk to your Bose speaker, or use a Chromecast.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#77I just read the paper, and my take is that practically every home wifi user can now get pwned since most WiFi routers use the same SSID and 2.4 and 5Ghz. It can even beat people using Radius authentication, but they did not deep dive on that one. I am curious about whether the type of EAP matters for reading the traffic. Essentially everyone with the SSID on multiple access point MAC addresses can get pwned. Neighhoo…
EAP TLS provides strong authentication, is much better than the other enterprise authentication options, but will not block these lateral attacks from other authenticated devices. The second half of the deployment is putting each identity into a VLAN to defend against the L2/L3 disconnects that can occur.
I work on https://supernetworks.org/. We propose a solution to these flaws with per-device VLANs and encourage per-device passwords as well.
More practically the risk for these attacks is as follows. A simple password makes sense for easy setup on a guest network, that's treated as untrusted. These passwords can probably be cracked from sniffing a WPA2 key exchange -- who cares says the threat model, the network is untrusted. But this attack lets the insecure network pivot out into the secure one.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#78Incidentally, this client isolation thing can be extremely annoying in practice in networks you do not control. Hardware device makers just assume that everything is on One Big Wi-Fi Network and all devices can talk to all other devices and sing Kum-Ba-Yah by the fire. Then comes network isolation and you can no longer turn on your Elgato Wi-Fi controlled light, talk to your Bose speaker, or use a Chromecast.
Adding exceptions for certain protocols, IP ranges (maybe multicast, even) are certainly ways around this, but I imagine with every hole you poke to allow something, you are also opening a hole for data to leak.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#79I just read the paper, and my take is that practically every home wifi user can now get pwned since most WiFi routers use the same SSID and 2.4 and 5Ghz. It can even beat people using Radius authentication, but they did not deep dive on that one. I am curious about whether the type of EAP matters for reading the traffic. Essentially everyone with the SSID on multiple access point MAC addresses can get pwned. Neighhoo…
EAP TLS provides strong authentication, is much better than the other enterprise authentication options, but will not block these lateral attacks from other authenticated devices. The second half of the deployment is putting each identity into a VLAN to defend against the L2/L3 disconnects that can occur. I work on https://supernetworks.org/ . We propose a solution to these flaws with per-device VLANs and encourage p…
My consumer grade routers cannot handle all that fancy VLAN stuff. Thanks for mentioning that.
Re: AirSnitch: Demystifying and breaking client isolation in Wi-Fi networks [pdf]
#80Incidentally, this client isolation thing can be extremely annoying in practice in networks you do not control. Hardware device makers just assume that everything is on One Big Wi-Fi Network and all devices can talk to all other devices and sing Kum-Ba-Yah by the fire. Then comes network isolation and you can no longer turn on your Elgato Wi-Fi controlled light, talk to your Bose speaker, or use a Chromecast.
Adding exceptions for certain protocols, IP ranges (maybe multicast, even) are certainly ways around this, but I imagine with every hole you poke to allow something, you are also opening a hole for data to leak.
Client isolation is done at L2. You can't add exceptions for IP ranges / protocols / etc this way because that's up the stack. Even if devices can learn about each other in other ways, isolation gets in the way of direct communication between them.