Researchers from the University of California, Riverside have developed a new class of attacks on wireless networks — AirSnitch. These attacks allow bypassing client isolation mechanisms in Wi-Fi networks that prevent clients from directly accessing each other. In the worst-case scenario, the attacks enable an attacker to redirect the victim's traffic (MITM) for analyzing or modifying unencrypted requests, as well as poisoning DNS caches to substitute site queries.
To carry out the attacks, an attacker needs to be connected to the same wireless network as the victim or a guest network serviced by the same access point. For example, attacks can be used in public wireless networks. Of the 9 tested models of wireless access points from Netgear, Tenda, D-LINK, TP-LINK, ASUS, Ubiquiti, LANCOM, and Cisco, as well as those running DD-WRT and OpenWrt firmware, all devices were susceptible to at least one attack method.
Three issues are identified that enable the attack. The first issue allows bypassing isolation between clients due to improper management of keys used to secure broadcast frames. The second issue is related to the fact that isolation is typically applied at either the MAC or IP level, but not at both levels simultaneously. The third issue arises from unreliable synchronization of client identifiers across the entire network stack, which allows intercepting incoming and outgoing traffic of other clients.
Modern wireless access points combine the functions of a radio transmitter and a network switch (Layer 2 Switch), with the switch, unlike wired networks, using logical binding to the wireless channel instead of tying the client to a physical port. The MAC address of the client serves as the identifier in this binding, which is matched with the channel in a special MAC address table. If the client switches to a different channel (for instance, moving from 2.4 GHz to 5 GHz), the data in the table is updated.
The attack occurs at the first (physical, radio channel) and second (data link, MAC address) layers of the OSI network model and amounts to the fact that an attacker, connecting to the same access point but using a frequency range different from that of the victim (for example, 2.4 GHz instead of 5 GHz), sends a connection negotiation request (4-way handshake) specifying the victim's MAC address (similar to ARP spoofing in Ethernet networks). As clients are identified by their MAC addresses, the access point assumes that the client has switched to another channel and changes the entry in the MAC address table. After this, all incoming traffic from the access point begins to be sent to the attacker's device.
To achieve bidirectional interception, the attacker, having received the data addressed to the victim, restores the state of the MAC address table to its original state. For this, an "ICMP Ping" packet is sent with a randomly specified MAC address and the packet encrypted with the GTK (Group Temporal Key), which is common for all clients in the wireless network. Upon receiving this packet, the access point returns the victim's MAC address binding to the original wireless channel. Traffic injection is carried out through cyclic substitution and restoring the entry in the MAC address table.
Source: opennet.ru
