{"id":107780,"date":"2023-04-08T12:48:10","date_gmt":"2023-04-08T10:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=107780"},"modified":"2023-04-10T11:12:07","modified_gmt":"2023-04-10T09:12:07","slug":"uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-besprovodnyh-tochkah-dostupa-pozvolyayushhaya-organizovat-perehvat-trafika","title":{"rendered":"Vulnerability in wireless access points allowing traffic interception","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A group of researchers from Tsinghua University (China) and George Mason University (USA) revealed information about a vulnerability (CVE-2022-25667) in wireless access points that allows for traffic interception (MITM) in wireless networks protected by WPA, WPA2, and WPA3 protocols. By manipulating ICMP packets with the 'redirect' flag, an attacker can redirect the victim's traffic within the wireless network through their system, which can be used to intercept and replace unencrypted sessions (for example, requests to sites without HTTPS). <\/p>\n

The vulnerability is caused by insufficient filtering of spoofed ICMP messages with a forged source address in Network Processing Units (NPU) that provide low-level packet processing in the wireless network. Among other things, the NPU redirected unverified spoofed ICMP packets with the 'redirect' flag, which can be used to modify routing table entries on the victim's device. The attack involves sending an ICMP packet on behalf of the access point with the 'redirect' flag, specifying forged data in the packet header. Due to the vulnerability, the message is redirected by the access point and processed by the victim's network stack, which believes the message was sent by the access point.

\"Vulnerability<\/center> <\/p>\n

Additionally, researchers have proposed a method for bypassing ICMP packet checks with the 'redirect' flag on the end user's side and altering their routing table. To circumvent filtering, the attacker first identifies an active UDP port on the victim's side. Being on the same wireless network, the attacker can intercept traffic but cannot decrypt it since they do not know the session key used when the victim connects to the access point. However, by sending verification packets to the victim, the attacker can, based on the analysis of the incoming ICMP responses with the 'Destination Unreachable' flag, determine the active UDP port. Next, the attacker constructs an ICMP message with the 'redirect' flag and a forged UDP header indicating the discovered open UDP port. Processing this message leads to distortions in the routing table on the victim's system, redirecting traffic for interception in clear text at the link layer.

\"Vulnerability<\/center> <\/p>\n

The presence of the problem has been confirmed in access points using chips from HiSilicon and Qualcomm. An examination of 55 different models of access points from 10 well-known manufacturers (Cisco, NetGear, Xiaomi, Mercury, 360, Huawei, TP-Link, H3C, Tenda, Ruijie) showed that they are all vulnerable and do not block spoofed ICMP packets. Furthermore, an analysis of 122 existing wireless networks revealed the possibility of an attack in 109 networks (89%).

\"Vulnerability<\/center> <\/p>\n

To exploit the vulnerabilities, an attacker must have legitimate access to the Wi-Fi network, meaning they must know the credentials for the wireless network (the vulnerabilities allow bypassing the traffic separation mechanisms in the WPA* protocols). Unlike traditional MITM attacks on wireless networks, by using ICMP packet spoofing techniques, the attacker can avoid deploying their own fake access point for traffic interception and instead use legitimate access points serving the network to redirect specially crafted ICMP packets to the victim.