Nearly All Wi-Fi Devices Are Vulnerable to New FragAttacks

Three design and multiple implementation flaws have been
disclosed in IEEE 802.11 technical standard that undergirds Wi-Fi,
potentially enabling an adversary to take control over a system and
plunder confidential data.

Called FragAttacks^[1]
(short for FRgmentation and AGgregation attacks), the weaknesses
impact all Wi-Fi security protocols, from Wired Equivalent Privacy
(WEP) all the way to Wi-Fi Protected Access 3 (WPA3), thus
virtually putting almost every wireless-enabled device at risk of
attack.

“An adversary that is within radio range of a victim can abuse
these vulnerabilities to steal user information or attack devices,”
Mathy Vanhoef, a security academic at New York University Abu
Dhabi, said. “Experiments indicate that every Wi-Fi product is
affected by at least one vulnerability and that most products are
affected by several vulnerabilities.”

IEEE 802.11 provides the basis for all modern devices using the
Wi-Fi family of network protocols, allowing laptops, tablets,
printers, smartphones, smart speakers, and other devices to
communicate with each other and access the Internet via a wireless
router.

Introduced in January 2018, WPA3^[2]
is a third-generation security protocol that’s at the heart of most
Wi-Fi devices with several enhancements such as robust
authentication and increased cryptographic strength to safeguard
wireless computer networks.

According to Vanhoef, the issues^[3] stem from “widespread”
programming mistakes encoded in the implementation of the standard,
with some flaws dating all the way back to 1997. The
vulnerabilities have to do with the way the standard fragments and
aggregates frames, allowing threat actors to inject arbitrary
packets and trick a victim into using a malicious DNS server, or
forge the frames to siphon data.

The list of 12 flaws^[4]
is as follows —

• CVE-2020-24588: Accepting non-SPP A-MSDU
  frames
• CVE-2020-24587: Reassembling fragments
  encrypted under different keys
• CVE-2020-24586: Not clearing fragments from
  memory when (re)connecting to a network
• CVE-2020-26145: Accepting plaintext broadcast
  fragments as full frames (in an encrypted network)
• CVE-2020-26144: Accepting plaintext A-MSDU
  frames that start with an RFC1042 header with EtherType EAPOL (in
  an encrypted network)
• CVE-2020-26140: Accepting plaintext data
  frames in a protected network
• CVE-2020-26143: Accepting fragmented plaintext
  data frames in a protected network
• CVE-2020-26139: Forwarding EAPOL frames even
  though the sender is not yet authenticated
• CVE-2020-26146: Reassembling encrypted
  fragments with non-consecutive packet numbers
• CVE-2020-26147: Reassembling mixed
  encrypted/plaintext fragments
• CVE-2020-26142: Processing fragmented frames
  as full frames
• CVE-2020-26141: Not verifying the TKIP MIC of
  fragmented frames

A bad actor can leverage these flaws to inject arbitrary network
packets, intercept and exfiltrate user data, launch
denial-of-service attacks, and even possibly decrypt packets in WPA
or WPA2 networks.

“If network packets can be injected towards a client, this can
be abused to trick the client into using a malicious DNS server,”
Vanhoef explained in an accompanying research paper^[5]. “If network packets can
be injected towards an [access point], the adversary can abuse this
to bypass the NAT/firewall and directly connect to any device in
the local network.”

In a hypothetical attack scenario, these vulnerabilities can be
exploited as a stepping stone to launch advanced attacks,
permitting an attacker to take over an outdated Windows 7 machine
inside a local network. But on a brighter note, the design flaws
are hard to exploit as they require user interaction or are only
possible when using uncommon network settings.

The findings have been shared with the Wi-Fi Alliance, following
which firmware updates were prepared during a 9-month-long
coordinated disclosure period. Microsoft, for its part, released
fixes for some of the flaws (CVE-2020-24587^[6], CVE-2020-24588^[7], and CVE-2020-26144^[8]) as part of its Patch
Tuesday update for May 2021. Vanhoef said an updated Linux kernel
is in the works for actively supported distributions.

This is not the first time Vanhoef has demonstrated severe flaws
in the Wi-Fi standard. In 2017, the researcher disclosed what’s
called KRACKs^[9]
(Key Reinstallation AttACKs) in WPA2 protocol, enabling an attacker
to read sensitive information and steal credit card numbers,
passwords, messages, and other data.

“Interestingly, our aggregation attack could have been avoided
if devices had implemented optional security improvements earlier,”
Vanhoef concluded. “This highlights the importance of deploying
security improvements before practical attacks are known. The two
fragmentation based design flaws were, at a high level, caused by
not adequately separating different security contexts. From this we
learn that properly separating security contexts is an important
principle to take into account when designing protocols.”

Mitigations for FragAttacks from other companies like Cisco,
HPE/Aruba Networks, Juniper Networks, and Sierra Wireless can be
accessed in the advisory^[10] released by the
Industry Consortium for Advancement of Security on the Internet
(ICASI).

“There is no evidence of the vulnerabilities being used against
Wi-Fi users maliciously, and these issues are mitigated through
routine device updates that enable detection of suspect
transmissions or improve adherence to recommended security
implementation practices,” the Wi-Fi Alliance said^[11].