Description:
A researcher identifies several critical vulnerabilities (collectively known as "AirSnitch") in common Wi-Fi protocol implementations. These vulnerabilities could allow an attacker to bypass client isolation, a security feature designed to prevent peer-to-peer communication between devices on the same wireless network and spoof a victim device’s physical MAC address.
Reports indicated that proof-of-concept (PoC) exploit code is available. System administrators are advised to update their network appliance once the update is available.
Affected Systems:
- Devices connect to Wi-Fi network with client isolation enabled
Impact:
The researchers demonstrates that attackers can bypass isolation controls, enabling traffic interception, injection, causing network disconnections and full Man-in-the-Middle (MitM) attacks.
Recommendation:
As there is no single solution to address all vulnerabilities, a layered defence strategy is essential to mitigate the risks effectively. Both system administrators and end users should implement multi-layered security measures to mitigate risk.
For System Administrators:
- Enforce network segmentation and segregation to separate internal traffic from guest or untrusted traffic.
- Use WPA3 or enable Protected Management Frames (PMF) in WPA2 to prevent the unauthorised manipulation of Wi-Fi management traffic.
- Enable both IP and ARP spoofing prevention, where applicable.
- Implement detection and prevention mechanisms to block malicious unicast IP packets that are embedded in broadcast Wi-Fi frames.
- Detect and block rogue or unauthorised devices from connecting to the Wi-Fi network.
- Apply firmware updates from hardware vendors as security patches become available.
- Ensure strong password adopted for the Wi-Fi network.
For End Users:
- Avoid transmitting classified or personal information over public or untrusted Wi-Fi networks.
- Use VPN to secure sensitive data when using public Wi-Fi networks.
- Verify that websites use additional encryption layers, such as SSL/TLS, to protect data during transmission over Wi-Fi.
More Information:
- https://papers.mathyvanhoef.com/ndss2026-airsnitch.pdf
- https://www.hkcert.org/security-bulletin/airsnitch-attack-triggers-sensitive-information-disclosure-and-denial-of-service-condition-on-wi-fi-environment_20210716
