New Wi-Fi Protocol Security Flaw Affecting Linux, Android and iOS Devices

Mar 30, 2023Ravie LakshmananNetwork Security

A group of academics from Northeastern University and KU Leuven
has disclosed a fundamental design flaw in the IEEE 802.11 Wi-Fi
protocol standard, impacting a wide range of devices running Linux,
FreeBSD, Android, and iOS.

Successful exploitation of the shortcoming could be abused to
hijack TCP connections or intercept client and web traffic,
researchers Domien Schepers, Aanjhan Ranganathan, and Mathy Vanhoef
said in a paper published this week.

The approach^[1]
exploits power-save mechanisms^[2]
in endpoint devices to trick access points into leaking data frames^[3]
in plaintext, or encrypt them using an all-zero
key^[4].

“The unprotected nature of the power-save bit in a frame’s
header […] also allows an adversary to force queue frames
intended for a specific client resulting in its disconnection and
trivially executing a denial-of-service attack,” the researchers
noted.

In other words, the goal is to leak frames from the access point
destined to a victim client station by taking advantage of the fact
that most Wi-Fi stacks do not adequately dequeue or purge their
transmit queues when the security context changes.

Besides manipulating the security context to leak frames from
the queue, an attacker can override the client’s security context
used by an access point to receive packets intended for the victim.
This attack pre-supposes that the targeted party is connected to a
hotspot-like network.

“The core idea behind the attack is that the manner in which
clients are authenticated is unrelated to how packets are routed to
the correct Wi-Fi client,” Vanhoef explained^[5].

“A malicious insider can abuse this to intercept data towards a
Wi-Fi client by disconnecting a victim and then connecting under
the MAC address of the victim (using the credentials of the
adversary). Any packets that were still underway to the victim,
such website data that the victim was still loading, will now be
received by the adversary instead.”

Cisco, in an informational advisory, described^[6]
the vulnerabilities as an “opportunistic attack and the information
gained by the attacker would be of minimal value in a securely
configured network.”

However, the company acknowledged that the attacks presented in
the study may be successful against Cisco Wireless Access Point
products and Cisco Meraki products with wireless capabilities.

To reduce the probability of such attacks, it’s recommended to
implement transport layer security (TLS) to encrypt data in transit
and apply policy enforcement mechanisms to restrict network
access.

The findings arrive months after researchers Ali Abedi and
Deepak Vasisht demonstrated a location-revealing privacy attack
called Wi-Peep^[8]
that also exploits the 802.11 protocol’s power-saving mechanism to
localize target devices.

The research also follows other recent studies that have
leveraged the Google Geolocation API^[9]
to launch location spoofing attacks^[10] in urban areas, not to
mention use Wi-Fi signals to detect and map human
movement^[11] in a room.