The IEEE 802.11 Wi-Fi protocol standard has security flaws that could allow attackers to steal sensitive data and inject malicious content, researchers say.
Wi-Fi router (opens in new tab) Share network frames between them – a data container containing the MAC addresses of source and destination endpoints, or control and management data, etc.
When a Wi-Fi device is in power saving mode (sleep mode), incoming frames are queued, dequeued, encrypted, and sent to their destination.
limited impact Theoretically, an attacker could spoof a network device’s MAC address and send a power save frame to instruct the destination device to start queuing the frame. Then wake up he can send a frame and get all frames queued in the meantime.
Although the frames are encrypted, an attacker can send authentication and association frames to the destination endpoint, changing the security context of the frames in doing so. As a result, the transmitted frames may be sent in plaintext or encrypted for which the attacker has the decryption key.
Lancom, Aruba, Cisco, Asus, and D-Link devices are just a few affected by this flaw.
“Our attack impacts a wide variety of devices and operating systems (Linux, FreeBSD, iOS, Android) and can be used to hijack TCP connections or intercept client and web traffic. It has far-reaching effects,” said researchers Domien Schepers and Aanjhan. Ranganathan of Northeastern University and Mathy Vanhoef of imec-DistriNet, Leuven KU, said in the report:
They also stated that the vulnerability could be exploited to add malicious content to TCP packets containing JavaScript.
“An adversary can inject data into this TCP connection by using its own Internet-facing server to inject off-path TCP packets with spoofed sender IP addresses.”
“This could be exploited, for example, to send malicious JavaScript code over a cleartext HTTP connection to the victim in order to exploit vulnerabilities in the client’s browser.”
The researchers added that the vulnerability could be used to intercept Wi-Fi traffic, but the impact of this vulnerability should be somewhat limited.
“This attack is considered an opportunistic attack and the information obtained by the attacker is of minimal value in a securely configured network,” BleepingComputer quoted Cisco. Still, the company proposes a business usage policy enforcement mechanism for safety.
“Cisco also recommends implementing transport layer security to encrypt data in transit as much as possible to prevent attackers from using the captured data.”
Via: BleepingComputer (opens in new tab)
websitebuildersnow
GIPHY App Key not set. Please check settings