6 ms·

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expe

As far as I can tell, all of these attacks require the attacker to already be associated to a victim's network. Most of these attacks seem similar to ones expected on shared wifi (airports, cafes) that have been known about for a while. The novel attacks seem to exploit weaknesses in particular router implementations that didn't actually segregate traffic between guest and normal networks. I'm curious if I missed something because that doesn't sound like it allows the worst kind of attacks, e.g. drive-by with no ability to associate to APs without cracking keys.

wat10000 8mo ago
That’s my read as well. It’s not good, but it’s not nearly as bad as the headline makes it sound.
strongpigeon 8mo ago
That's my read as well. It's bad for places that rely on client isolation, but not really for the general case. I feel like this also overstates the "stealing authentication cookies": most people's cookies will be protected by TLS rather than physical layer protection. Still an interesting attack though.
- NetMageSCW 8mo ago
  I think that places that rely on client isolation might be the general case - every public space that has a guest network - e.g. retail stores, doctor’s offices, hotels, hospitals - is probably using client isolation on their wireless network.
tialaramex 8mo ago
The attacker doesn't need to be connected to the victim's network, only to the same hardware, the hardware's loss of isolation is the unexpected problem. Their University example is pertinent. The victim is an Eduroam user, and the attacker never has any Eduroam credentials, but the same WiFi hardware is serving both eduroam and the local guest provision which will be pretty bare bones, so the attacker uses the means described to start getting packets meant for that Eduroam user. If you only have a single appropriately authenticated WiFi network then the loss of isolation doesn't matter, in the same way that a Sandbox escape in your web browser doesn't matter if you only visit a single trusted web site...
- dijit 8mo ago
  I should reinforce this point by saying that it's the default position for "guest" networks to be using the same hardware as "secure" office wifi and such.
  - TeMPOraL 8mo ago
    I'd further reinforce this by pointing out that this is what the specific term, guest network, means - it's the common name used by router manufacturers to describe an optional feature of serving secondary network from the same hardware, intended for the specific, common use case of serving transient and/or less trusted users. This is in contrast to more genetic, descriptive terms like "additional network", "separate network for guests", etc.
- benlivengood 8mo ago
  Yeah, that commercial-grade hardware didn't actually isolate at the PHY-MAC layer is a bit surprising. How would they have working VLANs at the AP?
  - eqvinox 8mo ago
    802.11 is kinda poorly designed in this regard, but they do isolate to some degree. I need to read the paper, some claims here have a very strong "misunderstood or wrong or specific vendor problem" smell.
  - thenthenthen 8mo ago
    Fun story, back in uni, if you would spin up a webserver ($ python -m http.server 8000 for example) one could access it from other campuses. We never tried it across countries, but it might (have) worked
    - tialaramex 8mo ago
      That's usually just because it's the same network, it's not a loss of isolation. It is possible for your university to run a single WiFi network that is multi-campus, and so some "local" packets have to be sent between campuses, whether that's a good idea doesn't necessarily affect whether it's how it was set up. If your university has campuses in other countries (as mine does) it is not likely they use a single WiFi LAN though it isn't impossible. However the fact that the networks operated by UCLA, Manchester University and the Sorbonne are all named "eduroam" is just for the pragmatic reason that WiFi devices connect by name, those aren't the same WiFI LANs, any more than the guy I know named "Steve Harris" is the bassist from Iron Maiden just because they share the same name. [The Eduroam name has more significance than the coincidence of name, but that's all the name is doing here, WiFi devices which trust your local cafe "Coffee WiFi" will also connect to the "Coffee WiFi" offered in a completely different store.]
upboundspiral 8mo ago
What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?
- bronco21016 8mo ago
  It sounds like this attack would work in that scenario provided the attacker is able to connect to the guest access point. I haven’t paid attention to one in a while but I seem to remember the need to authenticate with the guest network using Xfinity credentials. This at least makes it so attribution might be possible.
  - russdill 8mo ago
    It looks like both clients must be on the same VLAN for the attack to work. They could be connected on different BSSIDs or even different SSIDs, but they still must be on the same VLAN.
    - cluckindan 8mo ago
      If the vulnerability is between layers 1 and 2, wouldn’t that imply that VLAN tagging at layer 2 might not be effective in segregating the traffic?
      - cyberax 8mo ago
        Wireless cards typically don't expose the VLAN tags directly. So VLANs should be OK.
- happyPersonR 8mo ago
  This is probably the biggest issue. I turn WiFi mine off and use my own WiFi ap.
  - chrisweekly 8mo ago
    Yeah, along these lines I've always been biased strongly against using ISP hardware beyond the minimum required to connect to the outside world.
ectospheno 8mo ago
Access points frequently have multiple BSSIDs even if just for broadcasting on 2.4 and 5 at the same time. Any multiple AP scenario will have them regardless. Couple that with weak duplicate MAC checking and shared GTK (WPA2-PSK) and the attack becomes trivial. I imagine old hardware will be broken forever. Especially pre 802.11w.
vanhoefm 8mo ago
I'm a co-author on the paper: I would personally indeed not use the phrase "we can break Wi-Fi encryption", because that might be misinterpreated that we can break any Wi-Fi network. What we can do is that, when an adversary is connected to a co-located open network, or is a malicious insider, they can attack other clients. More technically, that we can bypass client isolation. We encountered one interesting case where the open Wi-Fi network of a university enabled us to intercept all traffic of co-located networks, including the private Enterprise SSID. In this sense, the work doesn't break encryption. We bypass encryption. If you don't rely on client/network isolation, you are safe. More importantly, if you have a router broadcasting a single SSID that only you use, we can't break it.
- nickburns 8mo ago
  Much of (if not the vast majority of the 'worthwhile') traffic you're intercepting is still encrypted packets though. Not to minimize the recon value of the plaintext stuff. But not really fair to say you're 'bypassing' any encryption but for the WPA-specific kind.
  - vanhoefm 8mo ago
    People who use or rely on client isolation want to prevent inter-client attacks, for whatever reason. We show that this can often be broken. This can be problematic when you have older hardware in your network that is rarely updated, and many then rely on client isolation to mitigate attacks. If everything is encrypted and properly patched, then our attack indeed has less impact, but then there also wouldn't have been a good reason to use client isolation in the first place ;)
    - nickburns 8mo ago
      Disagree with your final statement. There's good security (and performance) reason to use any/all viable network isolation/segmentation/separation, etc., whenever/wherever possible. So-called Wi-Fi 'client isolation' is but a single network security strategy. No single strategy should be relied upon exclusively, nor avoided for that matter. But it seems we otherwise agree on the overall impact of this vector. My point was mostly about the statement regarding any 'bypassing' of encryption.

wat10000 8mo ago

That’s my read as well. It’s not good, but it’s not nearly as bad as the headline makes it sound.

strongpigeon 8mo ago

That's my read as well. It's bad for places that rely on client isolation, but not really for the general case. I feel like this also overstates the "stealing authentication cookies": most people's cookies will be protected by TLS rather than physical layer protection. Still an interesting attack though.

NetMageSCW 8mo ago
I think that places that rely on client isolation might be the general case - every public space that has a guest network - e.g. retail stores, doctor’s offices, hotels, hospitals - is probably using client isolation on their wireless network.

tialaramex 8mo ago

The attacker doesn't need to be connected to the victim's network, only to the same hardware, the hardware's loss of isolation is the unexpected problem. Their University example is pertinent. The victim is an Eduroam user, and the attacker never has any Eduroam credentials, but the same WiFi hardware is serving both eduroam and the local guest provision which will be pretty bare bones, so the attacker uses the means described to start getting packets meant for that Eduroam user. If you only have a single appropriately authenticated WiFi network then the loss of isolation doesn't matter, in the same way that a Sandbox escape in your web browser doesn't matter if you only visit a single trusted web site...

dijit 8mo ago
I should reinforce this point by saying that it's the default position for "guest" networks to be using the same hardware as "secure" office wifi and such.
- TeMPOraL 8mo ago
  I'd further reinforce this by pointing out that this is what the specific term, guest network, means - it's the common name used by router manufacturers to describe an optional feature of serving secondary network from the same hardware, intended for the specific, common use case of serving transient and/or less trusted users. This is in contrast to more genetic, descriptive terms like "additional network", "separate network for guests", etc.
benlivengood 8mo ago
Yeah, that commercial-grade hardware didn't actually isolate at the PHY-MAC layer is a bit surprising. How would they have working VLANs at the AP?
- eqvinox 8mo ago
  802.11 is kinda poorly designed in this regard, but they do isolate to some degree. I need to read the paper, some claims here have a very strong "misunderstood or wrong or specific vendor problem" smell.
- thenthenthen 8mo ago
  Fun story, back in uni, if you would spin up a webserver ($ python -m http.server 8000 for example) one could access it from other campuses. We never tried it across countries, but it might (have) worked
  - tialaramex 8mo ago
    That's usually just because it's the same network, it's not a loss of isolation. It is possible for your university to run a single WiFi network that is multi-campus, and so some "local" packets have to be sent between campuses, whether that's a good idea doesn't necessarily affect whether it's how it was set up. If your university has campuses in other countries (as mine does) it is not likely they use a single WiFi LAN though it isn't impossible. However the fact that the networks operated by UCLA, Manchester University and the Sorbonne are all named "eduroam" is just for the pragmatic reason that WiFi devices connect by name, those aren't the same WiFI LANs, any more than the guy I know named "Steve Harris" is the bassist from Iron Maiden just because they share the same name. [The Eduroam name has more significance than the coincidence of name, but that's all the name is doing here, WiFi devices which trust your local cafe "Coffee WiFi" will also connect to the "Coffee WiFi" offered in a completely different store.]

upboundspiral 8mo ago

What about XFinity, which by default shares the wifi you pay for with strangers to create access points around the city?

bronco21016 8mo ago
It sounds like this attack would work in that scenario provided the attacker is able to connect to the guest access point. I haven’t paid attention to one in a while but I seem to remember the need to authenticate with the guest network using Xfinity credentials. This at least makes it so attribution might be possible.
- russdill 8mo ago
  It looks like both clients must be on the same VLAN for the attack to work. They could be connected on different BSSIDs or even different SSIDs, but they still must be on the same VLAN.
  - cluckindan 8mo ago
    If the vulnerability is between layers 1 and 2, wouldn’t that imply that VLAN tagging at layer 2 might not be effective in segregating the traffic?
    - cyberax 8mo ago
      Wireless cards typically don't expose the VLAN tags directly. So VLANs should be OK.
happyPersonR 8mo ago
This is probably the biggest issue. I turn WiFi mine off and use my own WiFi ap.
- chrisweekly 8mo ago
  Yeah, along these lines I've always been biased strongly against using ISP hardware beyond the minimum required to connect to the outside world.

ectospheno 8mo ago

Access points frequently have multiple BSSIDs even if just for broadcasting on 2.4 and 5 at the same time. Any multiple AP scenario will have them regardless. Couple that with weak duplicate MAC checking and shared GTK (WPA2-PSK) and the attack becomes trivial. I imagine old hardware will be broken forever. Especially pre 802.11w.

vanhoefm 8mo ago

I'm a co-author on the paper: I would personally indeed not use the phrase "we can break Wi-Fi encryption", because that might be misinterpreated that we can break any Wi-Fi network. What we can do is that, when an adversary is connected to a co-located open network, or is a malicious insider, they can attack other clients. More technically, that we can bypass client isolation. We encountered one interesting case where the open Wi-Fi network of a university enabled us to intercept all traffic of co-located networks, including the private Enterprise SSID. In this sense, the work doesn't break encryption. We bypass encryption. If you don't rely on client/network isolation, you are safe. More importantly, if you have a router broadcasting a single SSID that only you use, we can't break it.

nickburns 8mo ago
Much of (if not the vast majority of the 'worthwhile') traffic you're intercepting is still encrypted packets though. Not to minimize the recon value of the plaintext stuff. But not really fair to say you're 'bypassing' any encryption but for the WPA-specific kind.
- vanhoefm 8mo ago
  People who use or rely on client isolation want to prevent inter-client attacks, for whatever reason. We show that this can often be broken. This can be problematic when you have older hardware in your network that is rarely updated, and many then rely on client isolation to mitigate attacks. If everything is encrypted and properly patched, then our attack indeed has less impact, but then there also wouldn't have been a good reason to use client isolation in the first place ;)
  - nickburns 8mo ago
    Disagree with your final statement. There's good security (and performance) reason to use any/all viable network isolation/segmentation/separation, etc., whenever/wherever possible. So-called Wi-Fi 'client isolation' is but a single network security strategy. No single strategy should be relied upon exclusively, nor avoided for that matter. But it seems we otherwise agree on the overall impact of this vector. My point was mostly about the statement regarding any 'bypassing' of encryption.