AirSnitch Research Shows How Wi-Fi Isolation Can Be Bypassed
Summary
Unit 42 describes AirSnitch techniques that exploit interactions between Wi-Fi encryption, switching and routing to bypass client isolation, intercept or inject traffic, and enable cross-AP attacks. The article also outlines enterprise mitigations.
Key points
- The research describes attacks against WPA2/WPA3 networks that exploit interactions between encryption, switching and routing rather than targeting only client devices.
- Gateway Bouncing routes injected packets around Layer 2 client-isolation controls by using the gateway MAC address and the victim’s IP address.
- Port Stealing can manipulate MAC-to-port mappings to redirect a victim’s traffic to an attacker; the article also describes using this technique to intercept RADIUS traffic.
- Broadcast Reflection and misuse of shared group keys can enable packet injection; the article says modified wpa_supplicant can extract GTKs.
- The researchers describe chaining techniques and exploiting separate access points to intercept traffic across network segments.
- Suggested defenses include VLAN separation, MAC/IP spoofing prevention, per-client randomized GTKs or disabling downstream group-addressed forwarding, MACsec, and patched endpoints.
- Suggested detection indicators include unexpected MAC-to-port changes, spoofed MAC addresses, unusual broadcast or multicast frames with unicast payloads, and abnormal GTK or session-key events.
Article Details
- Attack Vectors
- Gateway Bouncing sends packets with a victim’s IP address as the destination and the gateway’s MAC address as the Layer 2 destination, allowing routing to bypass Layer 2 client isolation.
- Port Stealing spoofs a victim’s MAC address toward another BSSID or AP, manipulating forwarding-table mappings to redirect the victim’s traffic to the attacker.
- Broadcast Reflection crafts a broadcast Wi-Fi frame containing a unicast IP payload; the AP re-encrypts and broadcasts it to clients, including the victim.
- GTK misuse enables a client that has extracted the shared group key to encrypt spoofed broadcast or multicast frames carrying unicast traffic.
- Cross-AP attacks manipulate MAC-to-port mappings at distribution switches to intercept traffic across APs, including from a distant guest SSID.
- Attackers may intercept RADIUS/UDP authentication packets and brute force RADIUS authentication passphrases to establish rogue enterprise APs.
- Attackers with a known WPA3-Personal passphrase may lure clients to a fake or cloned AP to capture victim traffic.
- Defensive Notes
- Use VLANs to separate untrusted BSSIDs, such as guest networks, from trusted enterprise networks.
- Configure APs to prevent a MAC address from being used on multiple BSSIDs simultaneously, and enable IP spoofing prevention.
- Use per-client randomized GTKs and consider disabling downstream group-addressed forwarding (DGAF) where supported.
- Use link-layer device-to-device encryption such as MACsec to limit the confidentiality and integrity impact of intercepted traffic.
- Apply strict firewall policies between guest Wi-Fi and enterprise networks, and review guest SSID separation and legacy or orphaned AP connections.
- Use strong RADIUS passphrases and keep endpoint operating systems patched.
- Monitor for unexpected MAC-to-port mapping changes, spoofed MAC addresses, multicast or broadcast frames with unicast payloads, unusual GTK or session-key renegotiation, and anomalous RADIUS/UDP traffic.
MITRE ATT&CK
T1040 · Network SniffingThe article describes attackers passively decrypting and monitoring wireless traffic when they possess a shared passphrase or extracted GTK.T1110 · Brute ForceThe article describes brute forcing RADIUS authentication passphrases using intercepted RADIUS packets to enable rogue enterprise APs.T1557 · Adversary-in-the-MiddleAirSnitch manipulates MAC-to-port mappings and wireless network state to intercept or inject traffic, establishing a meddler-in-the-middle position.