{"id":115832,"date":"2024-05-16T14:59:26","date_gmt":"2024-05-16T12:59:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi"},"modified":"2024-05-16T14:59:26","modified_gmt":"2024-05-16T12:59:27","slug":"ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-ssid-confusion-pozvolyayushhaya-podmenit-set-wi-fi","title":{"rendered":"SSID Confusion Attack, allowing for Wi-Fi network spoofing","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A group of researchers from the Catholic University of Leuven (Belgium) identified an architectural vulnerability (CVE-2023-52424) in the Wi-Fi IEEE 802.11 standard, which allows an attacker to connect to a less secure wireless network instead of the trusted network that the user intended to connect to, enabling traffic interception and manipulation. The issue manifests in the wireless stacks of any operating system and affects authentication methods such as WPA3, WEP, EAP, AMPE, and FILS. <\/p>\n
The proposed attack technique, named SSID Confusion, bypasses the authentication methods present in the protocol that protect against SSID spoofing and prevent the creation of fake networks with the name of the network to which the client is connecting. The problem arises from the specification in the standard regarding situations when the SSID may be unauthenticated. Specifically, to indicate its presence, the access point broadcasts beacon frames that include information about the SSID. To simplify the process of network discovery, clients do not authenticate the SSID in these frames, as it is assumed that verification will be necessary after the client decides to connect to the network. <\/p>\n
For the attack to be successful, the user must initiate a connection to a specific wireless network, while another wireless network with the same connection parameters as the first network is nearby. This practice occurs, for example, when different networks are created for the 2.4GHz and 5GHz bands, one of which is weakly secured and vulnerable to typical traffic interception attacks, such as KRACK or Frag. This problematic configuration is also applied in some university networks that support the Eduroam service. The attacker must be within the signal range to insert themselves between the user and the target network (MitM). To carry out the attack, the attacker does not need to know the victim's credentials. <\/p>\n
The attack involves creating a point of access by the attacker (WrongAP on the diagram), which facilitates the relay of requests to a less secure spoofed network (WrongNet) on a different channel, to which the client is supposed to connect instead of the desired network (TrustedNet). The access point can be set up on a regular laptop and is used to organize a multi-channel MitM attack on the victim (MC MitM). The attack proceeds in three stages: <\/p>\n
Network Discovery. The MitM system intercepts packets sent over the air by the victim and a Trusted Network point, replacing the SSID \u2014 in packets from the access point, the SSID is replaced with the identifier of a less secure network, while in the victim's responses, it is replaced with the real one to simulate interaction between the client and the trusted access point. As a result, the victim's device receives responses and believes that the desired network is nearby, even though these responses are transmitted by the attacker's access point.\n
Authentication hijacking. The attacker simulates a successful authentication and forces the client to connect to the less secure network instead of the trusted one. Similar to the previous stage, the attacker intercepts the frames sent during the client authentication, replaces the SSID in them, and resends them to the access point.\n
MitM. After the communication channel is established, the attacker replaces the SSID from WrongNet to TrustedNet, creating the impression that the user is operating through a trusted network rather than a less secure one.
![\"SSID](\"\/wp-content\/uploads\/2024\/05\/61f99d8f551828c4300bd9b1b498617a.jpg\")
<\/center>\n![\"Play](\"https:\/\/img.youtube.com\/vi\/VKJwek9eCig\/hqdefault.jpg\")
\r\n